Create and populate OIDC blob store for the cluster #3564

rajdeepc2792 · 2024-05-07T16:44:19Z

Which issue this PR addresses:

Jira issue :- ARO-4373
Related Docs:-
https://msazure.visualstudio.com/AzureRedHatOpenShift/_wiki/wikis/AzureRedHatOpenShift.wiki/603739/OIDC-Traffic-Flow
Similar Implementation:-
https://gitlab.cee.redhat.com/service/uhc-clusters-service/-/tree/master/pkg/aws/cloudcredentialbuilder

What this PR does / why we need it:

The RP needs to generate a keypair
The private key needs to be stored in cosmos, It needs to be encrypted if it's stored in cosmos
The private key will be passed to the installer-aro-wrapper via a secret as part of the existing cluster document in CosmosDB(Not implemented here)
Set / populate OIDC issuerURL in the internal API
The RP should generate OIDC docs
Should populate them in regional storage accounts
The OIDC doc needs to be resolvable through the regional AFD instances and should follow a hashing pattern

Test plan for issue:

Is there any documentation that needs to be updated for this PR?

Doc for setting up the full RP. (Part of the PR)

How do you know this will function as expected in production?

Testing the implementation in all the environments.

rajdeepc2792 · 2024-05-07T17:07:47Z

/azp run ci,e2e

azure-pipelines · 2024-05-07T17:07:59Z

Azure Pipelines successfully started running 2 pipeline(s).

cadenmarchese

not a full review, just a few questions as you're working through the draft and testing. looks great!

pkg/util/storage/manager.go

github-actions · 2024-05-07T18:45:39Z

Please rebase pull request.

rajdeepc2792 · 2024-05-08T18:11:59Z

/azp run e2e

azure-pipelines · 2024-05-08T18:12:05Z

Pull request contains merge conflicts.

pkg/api/openshiftcluster.go

pkg/cluster/deploybaseresources.go

pkg/cluster/install.go

pkg/env/env.go

pkg/frontend/asyncoperationresult_get.go

pkg/util/oidcbuilder/jwks.go

github-actions · 2024-05-13T15:32:05Z

Please rebase pull request.

pkg/api/openshiftcluster.go

pkg/cluster/install.go

pkg/cluster/deploybaseresources.go

…edKeyAccess

pkg/cluster/deploybaseresources.go

hack/devtools/deploy-shared-env.sh

gouthamMN

lgtm

niontive · 2024-06-21T15:15:25Z

pkg/api/openshiftcluster.go

+	ResourceGroupID               string               `json:"resourceGroupId,omitempty"`
+	FipsValidatedModules          FipsValidatedModules `json:"fipsValidatedModules,omitempty"`
+	OIDCIssuer                    *OIDCIssuer          `json:"oidcIssuer,omitempty"`
+	BoundServiceAccountSigningKey *SecureString        `json:"boundServiceAccountSigningKey,omitempty"`


Why do we make the signing key a pointer to SecureString, but we make pull secret a SecureString?

It's been discussed here: #3564 (comment)

kimorris27

~~I'm suggesting one change to ensure this code works in FairFax, and I left a few smaller comments/questions.~~

Edit: I think we're all good WRT the FairFax thing, so I just have some small questions and nits.

pkg/deploy/generator/resources_oic.go

pkg/util/azblob/manager.go

pkg/util/oidcbuilder/jwks.go

pkg/util/oidcbuilder/oidcbuilder.go

pkg/util/azblob/manager.go

kimorris27 · 2024-06-24T17:18:26Z

LGTM, but my recommendation is to wait until we have E2E available before merging because of the size and scope of the PR.

rajdeepc2792 · 2024-06-25T20:02:19Z

/azp run ci,e2e

azure-pipelines · 2024-06-25T20:02:33Z

Azure Pipelines successfully started running 2 pipeline(s).

cadenmarchese · 2024-06-27T12:56:00Z

As a note to other reviewers, we've decided to rely on a healthy signal from local e2e since we don't have PR e2e available yet. The CI e2e was passing when it was healthy, and we've confirmed it's still passing locally.

rajdeepc2792 · 2024-06-28T14:10:22Z

/azp run ci,e2e

azure-pipelines · 2024-06-28T14:10:35Z

Azure Pipelines successfully started running 2 pipeline(s).

rajdeepc2792 · 2024-06-28T16:21:15Z

/azp run e2e

azure-pipelines · 2024-06-28T16:21:23Z

Azure Pipelines successfully started running 1 pipeline(s).

rajdeepc2792 added work-in-progress chainsaw Pull requests or issues owned by Team Chainsaw labels May 7, 2024

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch 2 times, most recently from 58d9129 to 1b8076a Compare May 7, 2024 17:01

cadenmarchese reviewed May 7, 2024

View reviewed changes

pkg/util/storage/manager.go Outdated Show resolved Hide resolved

pkg/util/storage/manager.go Outdated Show resolved Hide resolved

github-actions bot added the needs-rebase branch needs a rebase label May 7, 2024

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch from 1b8076a to 52b785b Compare May 8, 2024 18:34

github-actions bot removed the needs-rebase branch needs a rebase label May 8, 2024

rajdeepc2792 added the hold Hold label May 8, 2024

bennerv reviewed May 8, 2024

View reviewed changes

github-actions bot added the needs-rebase branch needs a rebase label May 13, 2024

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch from 52b785b to feb76f9 Compare May 28, 2024 18:21

github-actions bot removed the needs-rebase branch needs a rebase label May 28, 2024

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch from feb76f9 to c145d49 Compare May 28, 2024 18:35

cadenmarchese reviewed May 30, 2024

View reviewed changes

pkg/api/openshiftcluster.go Outdated Show resolved Hide resolved

pkg/cluster/install.go Show resolved Hide resolved

pkg/cluster/deploybaseresources.go Outdated Show resolved Hide resolved

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch 4 times, most recently from d684aeb to a067322 Compare May 31, 2024 21:20

rajdeepc2792 marked this pull request as ready for review May 31, 2024 21:20

rajdeepc2792 requested review from jewzaam, hawkowl, rogbas and petrkotas as code owners May 31, 2024 21:20

rajdeepc2792 added 6 commits June 20, 2024 23:50

ARO-4373 resolve PR comments

0ce8a44

ARO-4373 additional unit tests and comments resolution

17a1897

ARO-4373 add RP Feature Flag EnablePublicOIDCBlobAccess

415cc61

ARO-4373 convert BoundServiceAccountSigningKey to *SecureString

9b89aa3

ARO-4373 change OIDCIssuer field to pointer

67ba8c2

ARO-4373 update mgmtstorage sdk to 2019-06-01 for disabling allowShar…

fc80e4d

…edKeyAccess

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch from ebe1600 to 85d7994 Compare June 21, 2024 03:51

ARO-4373 Enable Web Endpoint for the OIDC Storage Account

66f608e

rajdeepc2792 force-pushed the rajdeepc2792/ARO-4373 branch from 85d7994 to 66f608e Compare June 21, 2024 04:27

rajdeepc2792 commented Jun 21, 2024

View reviewed changes

pkg/cluster/deploybaseresources.go Show resolved Hide resolved

rajdeepc2792 commented Jun 21, 2024

View reviewed changes

hack/devtools/deploy-shared-env.sh Show resolved Hide resolved

gouthamMN reviewed Jun 21, 2024

View reviewed changes

niontive reviewed Jun 21, 2024

View reviewed changes

kimorris27 requested changes Jun 21, 2024

View reviewed changes

ARO-4373 resolve comments and parameter fixes

8a82d29

rajdeepc2792 requested a review from kimorris27 June 22, 2024 00:51

rajdeepc2792 added ready-for-review and removed hold Hold labels Jun 24, 2024

kimorris27 approved these changes Jun 27, 2024

View reviewed changes

cadenmarchese approved these changes Jun 27, 2024

View reviewed changes

cadenmarchese merged commit 42daa82 into master Jul 1, 2024
21 checks passed

SudoBrendan deleted the rajdeepc2792/ARO-4373 branch July 24, 2024 15:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create and populate OIDC blob store for the cluster #3564

Create and populate OIDC blob store for the cluster #3564

rajdeepc2792 commented May 7, 2024 •

edited

Loading

rajdeepc2792 commented May 7, 2024

azure-pipelines bot commented May 7, 2024

cadenmarchese left a comment

github-actions bot commented May 7, 2024

rajdeepc2792 commented May 8, 2024

azure-pipelines bot commented May 8, 2024

github-actions bot commented May 13, 2024

gouthamMN left a comment

niontive Jun 21, 2024

kimorris27 Jun 21, 2024

kimorris27 left a comment •

edited

Loading

kimorris27 commented Jun 24, 2024

rajdeepc2792 commented Jun 25, 2024

azure-pipelines bot commented Jun 25, 2024

cadenmarchese commented Jun 27, 2024

rajdeepc2792 commented Jun 28, 2024

azure-pipelines bot commented Jun 28, 2024

rajdeepc2792 commented Jun 28, 2024

azure-pipelines bot commented Jun 28, 2024

Create and populate OIDC blob store for the cluster #3564

Create and populate OIDC blob store for the cluster #3564

Conversation

rajdeepc2792 commented May 7, 2024 • edited Loading

Which issue this PR addresses:

What this PR does / why we need it:

Test plan for issue:

Is there any documentation that needs to be updated for this PR?

How do you know this will function as expected in production?

rajdeepc2792 commented May 7, 2024

azure-pipelines bot commented May 7, 2024

cadenmarchese left a comment

Choose a reason for hiding this comment

github-actions bot commented May 7, 2024

rajdeepc2792 commented May 8, 2024

azure-pipelines bot commented May 8, 2024

github-actions bot commented May 13, 2024

gouthamMN left a comment

Choose a reason for hiding this comment

niontive Jun 21, 2024

Choose a reason for hiding this comment

kimorris27 Jun 21, 2024

Choose a reason for hiding this comment

kimorris27 left a comment • edited Loading

Choose a reason for hiding this comment

kimorris27 commented Jun 24, 2024

rajdeepc2792 commented Jun 25, 2024

azure-pipelines bot commented Jun 25, 2024

cadenmarchese commented Jun 27, 2024

rajdeepc2792 commented Jun 28, 2024

azure-pipelines bot commented Jun 28, 2024

rajdeepc2792 commented Jun 28, 2024

azure-pipelines bot commented Jun 28, 2024

rajdeepc2792 commented May 7, 2024 •

edited

Loading

kimorris27 left a comment •

edited

Loading