From 1a89b3bd55da86effc8b2d39aef2128c97aad359 Mon Sep 17 00:00:00 2001 From: Noah Santschi-Cooney Date: Tue, 25 Aug 2026 14:19:35 +0100 Subject: [PATCH] feat: add support for Keycloak/Cognito to OCP deployment profile --- internal/resources/webapp/constants.go | 10 +-- internal/resources/webapp/deployment.go | 91 +++++++++++++------- internal/resources/webapp/deployment_test.go | 7 +- 3 files changed, 66 insertions(+), 42 deletions(-) diff --git a/internal/resources/webapp/constants.go b/internal/resources/webapp/constants.go index 8f19ece..09f22cb 100644 --- a/internal/resources/webapp/constants.go +++ b/internal/resources/webapp/constants.go @@ -71,7 +71,7 @@ const ( // EnvDockerConfig points to the Docker config directory. EnvDockerConfig = "DOCKER_CONFIG" // EnvQuarkusRestClientExploitIQURL is the URL for the ExploitIQ REST client. - EnvQuarkusRestClientExploitIQURL = "QUARKUS_REST-CLIENT_EXPLOIT_IQ_URL" + EnvQuarkusRestClientExploitIQURL = "QUARKUS_REST_CLIENT_EXPLOIT_IQ_URL" // EnvQuarkusMongoDBHosts lists MongoDB hosts. EnvQuarkusMongoDBHosts = "QUARKUS_MONGODB_HOSTS" // EnvQuarkusMongoDBDatabase is the MongoDB database name. @@ -85,13 +85,13 @@ const ( // EnvQuarkusHTTPSSLCertificateFiles is a list of TLS certificate files. EnvQuarkusHTTPSSLCertificateFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_FILES" // EnvQuarkusHTTPSSLCertificateKeyFiles is a list of TLS key files. - EnvQuarkusHTTPSSLCertificateKeyFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES" + EnvQuarkusHTTPSSLCertificateKeyFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_KEY_FILES" // EnvQuarkusHTTPSSLPort is the HTTPS port for Quarkus. - EnvQuarkusHTTPSSLPort = "QUARKUS_HTTP_SSL-PORT" + EnvQuarkusHTTPSSLPort = "QUARKUS_HTTP_SSL_PORT" // EnvQuarkusHTTPInsecureRequests controls insecure request policy. - EnvQuarkusHTTPInsecureRequests = "QUARKUS_HTTP_INSECURE-REQUESTS" + EnvQuarkusHTTPInsecureRequests = "QUARKUS_HTTP_INSECURE_REQUESTS" // EnvQuarkusHTTPSSLCertificateReloadPeriod is the reload period for TLS certs. - EnvQuarkusHTTPSSLCertificateReloadPeriod = "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD-PERIOD" + EnvQuarkusHTTPSSLCertificateReloadPeriod = "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD_PERIOD" // EnvExploitIQUIIncludesPath points to includes.json path. EnvExploitIQUIIncludesPath = "EXPLOIT_IQ_UI_INCLUDES_PATH" // EnvExploitIQUIExcludesPath points to excludes.json path. diff --git a/internal/resources/webapp/deployment.go b/internal/resources/webapp/deployment.go index a292de3..bd7a7ee 100644 --- a/internal/resources/webapp/deployment.go +++ b/internal/resources/webapp/deployment.go @@ -159,7 +159,8 @@ func buildWebAppEnv( // OIDC CA bundle — inject trust store env vars when a custom CA ConfigMap is provided. if cr.Spec.WebApp.OIDCCaBundleConfigMapRef != nil { - envs = append(envs, + envs = append( + envs, corev1.EnvVar{ Name: "QUARKUS_OIDC_TLS_TLS_CONFIGURATION_NAME", Value: "oidc", @@ -186,35 +187,54 @@ func buildWebAppEnv( if profile.IsOpenShift() { envs = append( - envs, + envs, corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_FILES", Value: "/etc/tls/tls.crt"}, corev1.EnvVar{ - Name: "OAUTH_CLIENT_SECRET", - ValueFrom: &corev1.EnvVarSource{ - SecretKeyRef: &corev1.SecretKeySelector{ - LocalObjectReference: corev1.LocalObjectReference{Name: SecretName}, - Key: SecretKeyOAuthClient, + Name: "QUARKUS_HTTP_SSL_CERTIFICATE_KEY_FILES", + Value: "/etc/tls/tls.key", + }, + corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_PORT", Value: "8443"}, + corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE_REQUESTS", Value: "disabled"}, + corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD_PERIOD", Value: "30m"}, + ) + + if cr.Spec.Auth.OIDC != nil { + // Activate the external-idp Quarkus profile for generic OIDC discovery. + envs = append( + envs, + corev1.EnvVar{Name: "QUARKUS_PROFILE", Value: "external-idp"}, + corev1.EnvVar{Name: "QUARKUS_OIDC_AUTH_SERVER_URL", Value: cr.Spec.Auth.OIDC.IssuerURL}, + corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: cr.Spec.Auth.OIDC.ClientID}, + corev1.EnvVar{ + Name: "QUARKUS_OIDC_CREDENTIALS_SECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &cr.Spec.Auth.OIDC.ClientSecretRef, }, }, - }, - corev1.EnvVar{ - Name: "OPENSHIFT_DOMAIN", - ValueFrom: &corev1.EnvVarSource{ - SecretKeyRef: &corev1.SecretKeySelector{ - LocalObjectReference: corev1.LocalObjectReference{Name: SecretName}, - Key: SecretKeyOpenshiftDomain, + ) + } else { + envs = append( + envs, + corev1.EnvVar{ + Name: "OAUTH_CLIENT_SECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{Name: SecretName}, + Key: SecretKeyOAuthClient, + }, }, }, - }, - corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_FILES", Value: "/etc/tls/tls.crt"}, - corev1.EnvVar{ - Name: "QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES", - Value: "/etc/tls/tls.key", - }, - corev1.EnvVar{Name: "QUARKUS_HTTP_SSL-PORT", Value: "8443"}, - corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE-REQUESTS", Value: "disabled"}, - corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD-PERIOD", Value: "30m"}, - corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT-ID", Value: OAuthClientName}, - ) + corev1.EnvVar{ + Name: "OPENSHIFT_DOMAIN", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{Name: SecretName}, + Key: SecretKeyOpenshiftDomain, + }, + }, + }, + corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: OAuthClientName}, + ) + } } if profile.IsKubernetes() { @@ -222,12 +242,13 @@ func buildWebAppEnv( envs, corev1.EnvVar{Name: "OAUTH_CLIENT_SECRET", Value: "disabled"}, corev1.EnvVar{Name: "OPENSHIFT_DOMAIN", Value: "disabled"}, - corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE-REQUESTS", Value: "enabled"}, + corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE_REQUESTS", Value: "enabled"}, ) if cr.Spec.Auth.OIDC != nil { // Activate the external-idp Quarkus profile for generic OIDC discovery. - envs = append(envs, + envs = append( + envs, corev1.EnvVar{Name: "QUARKUS_PROFILE", Value: "external-idp"}, corev1.EnvVar{Name: "QUARKUS_OIDC_AUTH_SERVER_URL", Value: cr.Spec.Auth.OIDC.IssuerURL}, corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: cr.Spec.Auth.OIDC.ClientID}, @@ -239,7 +260,8 @@ func buildWebAppEnv( }, ) } else { - envs = append(envs, + envs = append( + envs, corev1.EnvVar{Name: "QUARKUS_OIDC_TENANT_ENABLED", Value: "false"}, corev1.EnvVar{ Name: "QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_POLICY", @@ -377,7 +399,8 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar { var envs []corev1.EnvVar if db.Mode == exploitiqv1alpha1.DatabaseModeConnectionString { - envs = append(envs, + envs = append( + envs, corev1.EnvVar{ Name: "QUARKUS_MONGODB_CONNECTION_STRING", ValueFrom: &corev1.EnvVarSource{ @@ -390,11 +413,12 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar { corev1.EnvVar{Name: EnvQuarkusMongoDBDatabase, Value: dbName}, ) if db.AuthSource != "" { - envs = append(envs, corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH-SOURCE", Value: authSource}) + envs = append(envs, corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH_SOURCE", Value: authSource}) } } else { // mode=hostPort (default) - envs = append(envs, + envs = append( + envs, corev1.EnvVar{ Name: EnvQuarkusMongoDBHosts, ValueFrom: &corev1.EnvVarSource{ @@ -423,7 +447,7 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar { }, }, }, - corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH-SOURCE", Value: authSource}, + corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH_SOURCE", Value: authSource}, corev1.EnvVar{Name: "QUARKUS_MONGODB_APPLICATION_NAME", Value: MongoDBDefaultDatabase}, ) } @@ -435,7 +459,8 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar { if db.TLS.ConfigurationName != "" && db.TLS.TrustStorePEMConfigMapRef != nil { mountPath := MongoDBTLSMountBase + "/" + db.TLS.ConfigurationName envName := "QUARKUS_TLS_" + strings.ToUpper(strings.ReplaceAll(db.TLS.ConfigurationName, "-", "_")) + "_TRUST_STORE_PEM_CERTS" - envs = append(envs, + envs = append( + envs, corev1.EnvVar{Name: "QUARKUS_MONGODB_TLS_CONFIGURATION_NAME", Value: db.TLS.ConfigurationName}, corev1.EnvVar{Name: envName, Value: mountPath + "/" + MongoDBTLSCACertKey}, ) diff --git a/internal/resources/webapp/deployment_test.go b/internal/resources/webapp/deployment_test.go index 9d48e8d..74b07d2 100644 --- a/internal/resources/webapp/deployment_test.go +++ b/internal/resources/webapp/deployment_test.go @@ -189,7 +189,7 @@ func TestDeployment(t *testing.T) { validateDeployment: func(t *testing.T, dep *appsv1.Deployment, cr *exploitiqv1alpha1.ExploitIQStack, prof *platform.PlatformProfile, params ManifestsParams) { assert.Len(t, dep.Spec.Template.Spec.Containers, 1) envMap := envToMap(dep.Spec.Template.Spec.Containers[0].Env) - assert.Equal(t, OAuthClientName, envMap["QUARKUS_OIDC_CLIENT-ID"]) + assert.Equal(t, OAuthClientName, envMap["QUARKUS_OIDC_CLIENT_ID"]) assert.Contains(t, envMap, "OAUTH_CLIENT_SECRET") assert.Contains(t, envMap, "OPENSHIFT_DOMAIN") assert.Contains(t, envMap, "QUARKUS_HTTP_SSL_CERTIFICATE_FILES") @@ -243,7 +243,7 @@ func TestDeployment(t *testing.T) { assert.Equal(t, "secret:oidc-secret/client-secret", envMap["QUARKUS_OIDC_CREDENTIALS_SECRET"]) // Quarkus binds to 0.0.0.0 (no sidecar localhost binding) assert.Equal(t, "0.0.0.0", envMap["QUARKUS_HTTP_HOST"]) - assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE-REQUESTS"]) + assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE_REQUESTS"]) }, expectError: false, }, @@ -274,7 +274,7 @@ func TestDeployment(t *testing.T) { assert.Len(t, dep.Spec.Template.Spec.Containers, 1) envMap := envToMap(dep.Spec.Template.Spec.Containers[0].Env) assert.Equal(t, "0.0.0.0", envMap["QUARKUS_HTTP_HOST"]) - assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE-REQUESTS"]) + assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE_REQUESTS"]) }, expectError: false, }, @@ -705,7 +705,6 @@ func TestNewOAuth2ProxySidecar_Removed(t *testing.T) { }, }, } - } func TestGetMainContainerResources(t *testing.T) {