From 800ad1b24fe102b995a5bdf41adf1b5c395fc281 Mon Sep 17 00:00:00 2001 From: kayibal Date: Fri, 29 Oct 2021 10:31:48 +0200 Subject: [PATCH 1/3] Support general configuration overrides for ory --- modules/ory/oathkeeper/config-oathkeeper.yaml | 2 - modules/ory/oathkeeper/main.tf | 39 ++++++++++++++----- modules/ory/oathkeeper/variables.tf | 7 +++- 3 files changed, 35 insertions(+), 13 deletions(-) diff --git a/modules/ory/oathkeeper/config-oathkeeper.yaml b/modules/ory/oathkeeper/config-oathkeeper.yaml index e4180126..a4fbce0f 100644 --- a/modules/ory/oathkeeper/config-oathkeeper.yaml +++ b/modules/ory/oathkeeper/config-oathkeeper.yaml @@ -1,4 +1,3 @@ ---- log: # Set a lower level when running in production level: debug @@ -108,4 +107,3 @@ mutators: { "session": {{ .Extra | toJson }} } ---- \ No newline at end of file diff --git a/modules/ory/oathkeeper/main.tf b/modules/ory/oathkeeper/main.tf index 88330d34..63b68d24 100644 --- a/modules/ory/oathkeeper/main.tf +++ b/modules/ory/oathkeeper/main.tf @@ -2,6 +2,34 @@ locals { config_mount_path = "/etc/config" secrets_mount_path = "/etc/secrets" access_rules_path = "${path.module}/access-rule-oathkeeper.yaml" + configuration_defaults = yamldecode(file("config-oathkeeper.yaml")) + configuration_default_overrides = { + errors={ + handlers={ + redirect={ + config={ + to="${var.protocol}://${var.hostname}/profile/auth/login" + } + } + } + } + mutators={ + id_token={ + config={ + issuer_url="${var.protocol}://${var.hostname}" + jwk_urls="file://${local.secrets_mount_path}/id_token.jwks.json" + } + } + } + } +} + +locals { + configuration = merge( + local.configuration_defaults, # lowest precedence + var.configuration_overrides, + local.configuration_default_overrides # highest precedence + ) } data "template_file" "oathkeeper-access-rules"{ @@ -12,15 +40,6 @@ data "template_file" "oathkeeper-access-rules"{ } } -data "template_file" "oathkeeper-config"{ - template = file("${path.module}/config-oathkeeper.yaml") - vars = { - hostname = var.hostname - protocol = var.protocol - config_path = local.config_mount_path - secret_path = local.secrets_mount_path - } -} resource "kubernetes_config_map" "oathkeeper-configs" { metadata { @@ -29,7 +48,7 @@ resource "kubernetes_config_map" "oathkeeper-configs" { } data = { "access-rule-oathkeeper.yaml" = data.template_file.oathkeeper-access-rules.rendered - "config-oathkeeper.yaml" = data.template_file.oathkeeper-config.rendered + "config-oathkeeper.yaml" = yamlencode(local.configuration) } } diff --git a/modules/ory/oathkeeper/variables.tf b/modules/ory/oathkeeper/variables.tf index def4356c..a0d23c1c 100644 --- a/modules/ory/oathkeeper/variables.tf +++ b/modules/ory/oathkeeper/variables.tf @@ -10,6 +10,11 @@ variable "protocol" { default = "http" } +variable "configuration_overrides" { + description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/" + default={} +} + variable "enable_registration" { description = "Bool to set if registration page will or not be visible to users" type = bool @@ -18,4 +23,4 @@ variable "enable_registration" { variable "access_rules_path" { type = string default = null -} \ No newline at end of file +} From a7de18b92af76daecf9ba9314a2264c2b66996cb Mon Sep 17 00:00:00 2001 From: kayibal Date: Fri, 29 Oct 2021 10:37:30 +0200 Subject: [PATCH 2/3] Make all access rules configurable --- modules/ory/oathkeeper/main.tf | 10 +--------- modules/ory/oathkeeper/variables.tf | 23 +++++++++++++++++++++++ 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/modules/ory/oathkeeper/main.tf b/modules/ory/oathkeeper/main.tf index 63b68d24..10c58fdf 100644 --- a/modules/ory/oathkeeper/main.tf +++ b/modules/ory/oathkeeper/main.tf @@ -32,14 +32,6 @@ locals { ) } -data "template_file" "oathkeeper-access-rules"{ - template = file("%{if var.access_rules_path == null}${path.module}/access-rule-oathkeeper.yaml%{else}${var.access_rules_path}%{ endif }") - vars = { - hostname = var.hostname - enable_registration = var.enable_registration - } -} - resource "kubernetes_config_map" "oathkeeper-configs" { metadata { @@ -47,7 +39,7 @@ resource "kubernetes_config_map" "oathkeeper-configs" { namespace = var.namespace } data = { - "access-rule-oathkeeper.yaml" = data.template_file.oathkeeper-access-rules.rendered + "access-rule-oathkeeper.yaml" = yamlencode(var.access_rules) "config-oathkeeper.yaml" = yamlencode(local.configuration) } } diff --git a/modules/ory/oathkeeper/variables.tf b/modules/ory/oathkeeper/variables.tf index a0d23c1c..32ce521f 100644 --- a/modules/ory/oathkeeper/variables.tf +++ b/modules/ory/oathkeeper/variables.tf @@ -15,6 +15,29 @@ variable "configuration_overrides" { default={} } +variable "access_rules" { + description = "Access rules" + type=list(object({ + id=string + match=object({ + url = string + methods = list(string) + }) + authenticators = list(object({ + handler = string + })) + authorizer=object({ + handler=string + }) + mutators = list(object({ + handler = string + })) + credential_issuer=object({ + handler=string + }) + })) +} + variable "enable_registration" { description = "Bool to set if registration page will or not be visible to users" type = bool From 0857102fb6cbf9bca837ca94e86e6b3be57213b5 Mon Sep 17 00:00:00 2001 From: kayibal Date: Fri, 29 Oct 2021 10:45:13 +0200 Subject: [PATCH 3/3] Propagate new ory configuration variables up --- ...thkeeper.yaml => default-access-rules.yaml | 0 main.tf | 8 ++++- modules/ory/variables.tf | 30 ++++++++++++++++++- variables.tf | 28 +++++++++++++++++ 4 files changed, 64 insertions(+), 2 deletions(-) rename modules/ory/oathkeeper/access-rule-oathkeeper.yaml => default-access-rules.yaml (100%) diff --git a/modules/ory/oathkeeper/access-rule-oathkeeper.yaml b/default-access-rules.yaml similarity index 100% rename from modules/ory/oathkeeper/access-rule-oathkeeper.yaml rename to default-access-rules.yaml diff --git a/main.tf b/main.tf index 9ef7eb14..1837fa3f 100644 --- a/main.tf +++ b/main.tf @@ -205,6 +205,10 @@ resource "kubernetes_namespace" "ory_namespace" { } } +locals { + default_access_rules = yamldecode("default-access-rules") +} + module "ory" { count = var.enable_ory_authentication ? 1 : 0 source = "./modules/ory" @@ -223,9 +227,11 @@ module "ory" { smtp_from_address = var.smtp_from_address access_rules_path = var.access_rules_path + access_rules = concat(local.default_access_rules, var.ory_additional_access_rules) + configuration_overrides = var.ory_configuration_overrides } module "k8s_tools" { source = "./modules/k8s_tools" install_metrics_server = var.install_metrics_server -} \ No newline at end of file +} diff --git a/modules/ory/variables.tf b/modules/ory/variables.tf index 10cd41fe..f11b54e5 100644 --- a/modules/ory/variables.tf +++ b/modules/ory/variables.tf @@ -11,6 +11,34 @@ variable "protocol" { default = "http" } +variable "configuration_overrides" { + description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/" + default={} +} + +variable "access_rules" { + description = "Access rules" + type=list(object({ + id=string + match=object({ + url = string + methods = list(string) + }) + authenticators = list(object({ + handler = string + })) + authorizer=object({ + handler=string + }) + mutators = list(object({ + handler = string + })) + credential_issuer=object({ + handler=string + }) + })) +} + // KRATOS variable "kratos_db_password"{ description = "PostgreSQL Database Password" @@ -69,4 +97,4 @@ variable "oauth2_providers" { variable "access_rules_path" { type = string default = null -} \ No newline at end of file +} diff --git a/variables.tf b/variables.tf index 656b4d80..3a2e9c67 100644 --- a/variables.tf +++ b/variables.tf @@ -231,6 +231,34 @@ variable "ory_kratos_cookie_secret" { sensitive = true } +variable "ory_configuration_overrides" { + description="Additional overrides should follow the config structure as specified here: https://www.ory.sh/oathkeeper/docs/reference/configuration/" + default={} +} + +variable "ory_additional_access_rules" { + description = "Additional access rules. Will be merged with access rules for OML services." + type=list(object({ + id=string + match=object({ + url = string + methods = list(string) + }) + authenticators = list(object({ + handler = string + })) + authorizer=object({ + handler=string + }) + mutators = list(object({ + handler = string + })) + credential_issuer=object({ + handler=string + }) + })) +} + variable "oauth2_providers" { // Configure multiple Oauth2 providers. // example: