Repository navigation
Use OAuth-Proxy to secure endpoints on dedicated Routes #24023
Description
Is your enhancement related to a problem? Please describe
For instances where a user does not want to, or cannot, place an endpoint on a subpath via urlRewriteSupported: true, the Dev Spaces / Che environment should create the necessary ServiceAccount, Service, Route, and oauth-proxy instance to secure the endpoint/s.
Describe the solution you'd like
An endpoint defined thusly:
- exposure: public
name: my-secure-app
targetPort: 8444
secure: trueShould result in a SA, Service, and Route
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-secure-app
annotations:
serviceaccounts.openshift.io/oauth-redirectreference.primary: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"my-secure-app"}}'
---
apiVersion: v1
kind: Secret
metadata:
name: my-secure-app
labels:
controller.devfile.io/mount-to-devworkspace: "true"
controller.devfile.io/watch-secret: "true"
annotations:
kubernetes.io/service-account.name: my-secure-app
controller.devfile.io/mount-as: file
controller.devfile.io/mount-path: /var/run/my-secure-app
type: kubernetes.io/service-account-token
---
kind: Service
apiVersion: v1
metadata:
name: my-secure-app
spec:
ports:
- name: my-secure-app
protocol: TCP
port: 4180
targetPort: 4180
internalTrafficPolicy: Cluster
type: ClusterIP
sessionAffinity: None
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: my-secure-app
spec:
to:
kind: Service
name: my-secure-app
weight: 100
port:
targetPort: 4180
tls:
termination: edge
insecureEdgeTerminationPolicy: RedirectAn instance of oauth-proxy should be launched in the workspace that serves the Route/Service
COOKIE_SECRET=$(openssl rand -base64 32) && OPENSHIFT_SAR="{\"namespace\":\"${DEVWORKSPACE_NAMESPACE}\",\"resource\":\"pods\",\"verb\":\"get\"}" && /usr/bin/oauth-proxy --http-address=:4180 --provider=openshift --https-address= --upstream=http://localhost:8444 --cookie-secret=${COOKIE_SECRET} --cookie-secure=true --pass-basic-auth=false --skip-provider-button=true --client-id=system:serviceaccount:${DEVWORKSPACE_NAMESPACE}:my-secure-app --client-secret-file=/var/run/my-secure-app/token --openshift-ca=/etc/pki/tls/cert.pem --openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt --openshift-sar="${OPENSHIFT_SAR}"Ideally, if a single oauth-proxy container can run multiple concurrent instances of oauth-proxy, then a single sidecar container should be used rather than creating a sidecar per endpoint.
Describe alternatives you've considered
The SA, Secret, and Route can be manually configured, or created as inline OpenShift components in the devfile.yaml. This solution requires additional privileges for the user.
Additional context
Working prototype - https://github.com/cgruver/chrome-in-dev-spaces-ubi10
Activity