feat(dex): dex backend storage adapter implementation

.github/licenserc.yaml

@@ -38,8 +38,10 @@ header:
     - 'pkg/idproxy/web/**'
     - 'pkg/apis/scheme_builder.go' # Belongs to the Kubernetes authors
     - '**/zz_generated.deepcopy.go' # Generated by Kubebuilder
-    - 'charts/**/templates/*.yaml' # license headers on helm templates are causing issues 
-
+    - 'charts/**/templates/*.yaml' # license headers on helm templates are causing issues
+    - '.mockery.yaml'     # Mockery config file
+    - 'pkg/mocks/**'    # Mockery generated files
+
   comment: on-failure
 
   # license-location-threshold specifies the index threshold where the license header can be located,

.mockery.yaml

@@ -1,6 +1,3 @@
-# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
-# SPDX-License-Identifier: Apache-2.0
-
 # .mockery.yaml
 with-expecter: false
 filename: "mock_{{.InterfaceName}}.go"
@@ -13,4 +10,7 @@ packages:
   sigs.k8s.io/controller-runtime/pkg/client:
     interfaces:
       Client:
-      SubResourceWriter:
+      SubResourceWriter:
+  github.com/dexidp/dex/storage:
+    interfaces:
+      Storage:

charts/idproxy/templates/deployment.yaml

@@ -54,6 +54,25 @@ spec:
             {{- range $origin := .Values.corsAllowedOrigins | default (list "*") }}
             - --allowed-origins={{ $origin }}
             {{- end }}
+          env:
+          - name: DEX_POSTGRES_DATABASE
+            value: {{ .Values.postgresql.postgresqlDatabase }}
+          - name: DEX_POSTGRES_HOST
+            value: {{ .Values.postgresql.postgresqlHost }}
+          - name: DEX_POSTGRES_USER
+            value: {{ .Values.postgresql.postgresqlUsername }}
+          - name: DEX_POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: postgres-password
+                name: dex-postgres-pguser-dex
+          - name: FEATURE_FLAG_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: FEATURE_FLAG_CONFIG_MAP_NAME
+            value: {{ include "manager.fullname" . }}-feature-flags
           ports:
             - name: oidc
               containerPort: 8080

charts/manager/etc/feature_flags.yaml

@@ -0,0 +1,13 @@
+dex-sql-backend:
+  variations:
+    true: true
+    false: false
+  defaultRule:
+    variation: false
+
+dex-kubernetes-backend:
+  variations:
+    true: true
+    false: false
+  defaultRule:
+    variation: true

charts/manager/templates/deployment.yaml

@@ -35,6 +35,17 @@ spec:
         {{- include "manager.params" . | indent 8 }}
         {{- end }}
         env:
+        - name: DEX_POSTGRES_DATABASE
+          value: {{ .Values.postgresql.postgresqlDatabase }}
+        - name: DEX_POSTGRES_HOST
+          value: 
+        - name: DEX_POSTGRES_USER
+          value: {{ .Values.postgresql.postgresqlUsername }}
+        - name: DEX_POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: postgres-password
+              name: dex-postgres-pguser-dex
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:

charts/manager/templates/manager-featureflag.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "manager.fullname" . }}-feature-flags
+data:
+    config.yaml: |-
+        {{- .Files.Get "etc/feature_flags.yaml" | nindent 4 }}

cmd/greenhouse/controllers.go

@@ -76,8 +76,10 @@ func startOrganizationReconciler(name string, mgr ctrl.Manager) error {
 	if v, ok := os.LookupEnv("POD_NAMESPACE"); ok {
 		namespace = v
 	}
+
 	return (&organizationcontrollers.OrganizationReconciler{
 		Namespace: namespace,
+		NetworkDB: postgresDB,
 	}).SetupWithManager(name, mgr)
 }
 

cmd/greenhouse/main.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/dexidp/dex/storage/sql"
 	flag "github.com/spf13/pflag"
 	"go.uber.org/zap/zapcore"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -58,6 +59,8 @@ var (
 	remoteClusterBearerTokenValidity,
 	renewRemoteClusterBearerTokenAfter time.Duration
 	kubeClientOpts clientutil.RuntimeOptions
+	// DB connection parameters
+	postgresDB sql.NetworkDB
 )
 
 func init() {
@@ -91,6 +94,12 @@ func main() {
 	flag.StringVar(&common.DNSDomain, "dns-domain", "",
 		"The DNS domain to use for the Greenhouse central cluster")
 
+	flag.StringVar(&postgresDB.Database, "database", clientutil.GetEnvOrDefault("DEX_POSTGRES_DATABASE", "dex"), "Database name")
+	flag.StringVar(&postgresDB.Host, "dbHost", clientutil.GetEnvOrDefault("DEX_POSTGRES_HOST", "localhost"), "Database host")
+	flag.Uint16Var(&postgresDB.Port, "dbPort", 5432, "Database port")
+	flag.StringVar(&postgresDB.User, "dbUser", clientutil.GetEnvOrDefault("DEX_POSTGRES_USER", "dex"), "Database user")
+	flag.StringVar(&postgresDB.Password, "dbPassword", clientutil.GetEnvOrDefault("DEX_POSTGRES_PASSWORD", "dex"), "Database password")
+
 	opts := zap.Options{
 		Development: true,
 		TimeEncoder: zapcore.RFC3339TimeEncoder,

cmd/idproxy/main.go

@@ -16,8 +16,11 @@ import (
 	"time"
 
 	"github.com/dexidp/dex/server"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/sql"
 	"github.com/go-logr/logr"
 	"github.com/oklog/run"
+	"github.com/open-feature/go-sdk/openfeature"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -29,6 +32,7 @@ import (
 	logk "sigs.k8s.io/controller-runtime/pkg/log"
 
 	greenhousesapv1alpha1 "github.com/cloudoperators/greenhouse/pkg/apis/greenhouse/v1alpha1"
+	"github.com/cloudoperators/greenhouse/pkg/features"
 	"github.com/cloudoperators/greenhouse/pkg/idproxy"
 	"github.com/cloudoperators/greenhouse/pkg/idproxy/web"
 )
@@ -39,6 +43,11 @@ func main() {
 	var idTokenValidity time.Duration
 	var listenAddr, metricsAddr string
 	var allowedOrigins []string
+	// DB connection parameters
+	var postgresDB sql.NetworkDB
+	var dexStorage storage.Storage
+	var err error
+
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 	// set default logger to be used by log
 	slog.SetDefault(logger)
@@ -48,6 +57,11 @@ func main() {
 	flag.StringVar(&kubeconfig, "kubeconfig", os.Getenv("KUBECONFIG"), "Use kubeconfig for authentication")
 	flag.StringVar(&kubecontext, "kubecontext", os.Getenv("KUBECONTEXT"), "Use context from kubeconfig")
 	flag.StringVar(&kubenamespace, "kubenamespace", os.Getenv("KUBENAMESPACE"), "Use namespace")
+	flag.StringVar(&postgresDB.Database, "database", os.Getenv("DEX_POSTGRES_DATABASE"), "Database name")
+	flag.StringVar(&postgresDB.Host, "dbHost", os.Getenv("DEX_POSTGRES_HOST"), "Database host")
+	flag.Uint16Var(&postgresDB.Port, "dbPort", 5432, "Database port")
+	flag.StringVar(&postgresDB.User, "dbUser", os.Getenv("DEX_POSTGRES_USER"), "Database user")
+	flag.StringVar(&postgresDB.Password, "dbPassword", os.Getenv("DEX_POSTGRES_PASSWORD"), "Database password")
 	flag.StringVar(&issuer, "issuer", "", "Issuer URL")
 	flag.StringVar(&listenAddr, "listen-addr", ":8080", "oidc listen address")
 	flag.StringVar(&metricsAddr, "metrics-addr", ":6543", "bind address for metrics")
@@ -59,9 +73,34 @@ func main() {
 		log.Fatal("No --issuer given")
 	}
 
-	dexStorage, err := idproxy.NewKubernetesStorage(kubeconfig, kubecontext, kubenamespace, logger.With("component", "storage"))
+	ofClient := features.GetOFClient("idproxy")
+	evalCtx := openfeature.NewEvaluationContext(
+		"backend",
+		map[string]interface{}{},
+	)
+	postgresBackend, err := ofClient.BooleanValue(context.TODO(), "dex-sql-backend", false, evalCtx)
 	if err != nil {
-		log.Fatalf("Failed to initialize kubernetes storage: %s", err)
+		log.Fatalf("Failed to get dex-sql-backend value details: %s", err)
+	}
+
+	k8sBackend, err := ofClient.BooleanValue(context.TODO(), "dex-kubernetes-backend", false, evalCtx)
+	if err != nil {
+		log.Fatalf("Failed to get dex-kubernetes-backend value details: %s", err)
+	}
+
+	switch {
+	case postgresBackend:
+		dexStorage, err = idproxy.NewPostgresStorage(sql.SSL{Mode: "disable"}, postgresDB, logger.With("component", "storage"))
+		if err != nil {
+			log.Fatalf("Failed to initialize postgres storage: %s", err)
+		}
+	case k8sBackend:
+		dexStorage, err = idproxy.NewKubernetesStorage(kubeconfig, kubecontext, kubenamespace, logger.With("component", "storage"))
+		if err != nil {
+			log.Fatalf("Failed to initialize kubernetes storage: %s", err)
+		}
+	default:
+		log.Fatalf("Exactly one of dex-sql-backend or dex-kubernetes-backend must be true")
 	}
 
 	refreshPolicy, err := server.NewRefreshTokenPolicy(logger.With("component", "refreshtokenpolicy"), true, "24h", "24h", "5s")

go.mod

@@ -26,12 +26,17 @@ require (
 	github.com/oklog/run v1.1.1-0.20240127200640-eee6e044b77c
 	github.com/onsi/ginkgo/v2 v2.22.2
 	github.com/onsi/gomega v1.36.2
+	github.com/open-feature/go-sdk v1.14.1
+	github.com/open-feature/go-sdk-contrib/providers/go-feature-flag-in-process v0.1.0
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.20.5
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.10.0
+	github.com/testcontainers/testcontainers-go v0.35.0
+	github.com/testcontainers/testcontainers-go/modules/postgres v0.35.0
+	github.com/thomaspoignant/go-feature-flag v1.40.0
 	github.com/vladimirvivien/gexe v0.4.1
 	github.com/wI2L/jsondiff v0.6.1
 	go.uber.org/zap v1.27.0
@@ -52,42 +57,63 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.9.2 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
+	cloud.google.com/go/auth v0.11.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
 	dario.cat/mergo v1.0.1 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.12.6 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/creack/pty v1.1.23 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
 	github.com/miekg/dns v1.1.58 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/nikunjy/rules v1.5.0 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/shirou/gopsutil/v3 v3.23.12 // indirect
+	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
+	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/yusufpapurcu/wmi v1.2.3 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
-	gotest.tools/v3 v3.5.1 // indirect
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.5.0 // indirect
+	cloud.google.com/go/compute/metadata v0.5.2 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
@@ -142,8 +168,8 @@ require (
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.3 // indirect
-	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
@@ -157,7 +183,7 @@ require (
 	github.com/jonboulle/clockwork v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
@@ -182,7 +208,7 @@ require (
 	github.com/otiai10/copy v1.14.1
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.59.1 // indirect
+	github.com/prometheus/common v0.60.1 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rubenv/sql-migrate v1.7.0 // indirect
@@ -195,24 +221,24 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/otel v1.29.0 // indirect
-	go.opentelemetry.io/otel/metric v1.29.0 // indirect
-	go.opentelemetry.io/otel/trace v1.29.0 // indirect
+	go.opentelemetry.io/otel v1.32.0 // indirect
+	go.opentelemetry.io/otel/metric v1.32.0 // indirect
+	go.opentelemetry.io/otel/trace v1.32.0 // indirect
 	go.starlark.net v0.0.0-20240725214946-42030a7cedce // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
 	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/oauth2 v0.22.0 // indirect
+	golang.org/x/oauth2 v0.24.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
 	golang.org/x/term v0.27.0 // indirect
 	golang.org/x/time v0.9.0
 	golang.org/x/tools v0.28.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/api v0.195.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240827150818-7e3bb234dfed // indirect
-	google.golang.org/grpc v1.66.3 // indirect
+	google.golang.org/api v0.210.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697 // indirect
+	google.golang.org/grpc v1.68.1 // indirect
 	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect