Skip to content

Commit d46c896

Browse files
majst01majst01
authored
Add metal-apiserver as preview in the mini-lab (#231)
1 parent aae31b8 commit d46c896

File tree

11 files changed

+206
-0
lines changed

11 files changed

+206
-0
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ sonic-vs.img
1717
files/certs/*.pem
1818
files/certs/**/*.pem
1919
files/certs/**/*.crt
20+
.vscode

‎deploy_control_plane.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@
2424
- name: metal-roles/control-plane/roles/auditing-meili
2525
when: metal_auditing_meili_enabled
2626
tags: auditing
27+
- name: metal-roles/control-plane/roles/valkey
28+
tags: valkey
29+
- name: auth-dex
30+
tags: auth
2731
- name: metal-roles/control-plane/roles/metal
2832
tags: metal
2933

‎inventories/group_vars/all/images.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ setup_yaml:
1212
# metal_hammer_image_url: https://images.metal-stack.io/metal-hammer/pull-requests/<pr-number-and-title>/metal-hammer-initrd.img.lz4
1313
# metal_api_image_name:
1414
# metal_api_image_tag:
15+
# metal_apiserver_image_name:
16+
# metal_apiserver_image_tag:
1517
# metal_metalctl_image_name:
1618
# metal_metalctl_image_tag:
1719
# metal_masterdata_api_image_name:

‎inventories/group_vars/control-plane/dex.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
auth_dex_ingress_dns: "auth.{{ metal_control_plane_ingress_dns }}"
3+
auth_dex_issuer_url: http://auth.{{ metal_control_plane_ingress_dns }}:8080/dex
4+
5+
auth_dex_static_clients:
6+
- id: metal-stack
7+
public: true
8+
name: "metal-stack"
9+
secret: secret
10+
redirectURIs:
11+
- 'http://v2.api.172.17.0.1.nip.io:8080/auth/oidc/callback'
12+
13+
auth_dex_static_passwords:
14+
- email: [email protected]
15+
hash: "{{ 'change-me' | string | password_hash('bcrypt', salt='jKfnxzOP3oJPeZYXMOc00Y') }}"
16+
username: "admin"
17+
userID: "00000000-0000-0000-0000-000000000001"
18+
- email: [email protected]
19+
hash: "{{ 'change-me' | string | password_hash('bcrypt', salt='jKfnxzOP3oJPeZYXMOc00Y') }}"
20+
username: "editor"
21+
userID: "00000000-0000-0000-0000-000000000002"
22+
- email: [email protected]
23+
hash: "{{ 'change-me' | string | password_hash('bcrypt', salt='jKfnxzOP3oJPeZYXMOc00Y') }}"
24+
username: "viewer"
25+
userID: "00000000-0000-0000-0000-000000000003"

‎inventories/group_vars/control-plane/metal.yml

+11
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@ metal_api_admin_key: metal-admin
1111

1212
metal_api_nsq_tcp_address: nsqd:4150
1313

14+
metal_apiserver_enabled: true
15+
metal_apiserver_url: http://v2.api.{{ metal_control_plane_ingress_dns }}:8080
16+
17+
metal_apiserver_oidc_discovery_url: http://auth.{{ metal_control_plane_ingress_dns }}:8080/dex/.well-known/openid-configuration
18+
metal_apiserver_oidc_end_session_url: ""
19+
metal_apiserver_oidc_client_id: metal-stack
20+
metal_apiserver_oidc_client_secret: secret
21+
22+
metal_apiserver_redis_password: change-me-soon
23+
metal_apiserver_admin_subjects: "CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDESBWxvY2Fs@oidc"
24+
1425
metal_api_images:
1526
- id: firewall-ubuntu-3.0
1627
name: Firewall 3 Ubuntu

‎inventories/group_vars/control-plane/valkey.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
valkey_replicas: 1

‎roles/auth-dex/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# auth-dex
2+
3+
Deploys [Dex](https://dexidp.io/).

‎roles/auth-dex/defaults/main/main.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
auth_dex_namespace: "metal-control-plane"
3+
4+
auth_dex_image_name: ghcr.io/dexidp/dex
5+
auth_dex_image_tag: latest
6+
7+
auth_dex_ingress_dns: https://{{ auth_dex_issuer_url }}/dex
8+
auth_dex_issuer_url: "{{ auth_dex_ingress_dns }}"
9+
10+
auth_dex_static_clients: []
11+
# - id: metal-stack
12+
# public: true
13+
# name: "metal-stack"
14+
# secret: secret
15+
16+
auth_dex_static_passwords: []
17+
# - email: "[email protected]"
18+
# # password in bcrypt
19+
# hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
20+
# username: "admin"
21+
# userID: "00000000-0000-0000-0000-000000000001"

‎roles/auth-dex/tasks/main.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
- name: Deploy dex
3+
k8s:
4+
definition: "{{ lookup('template', 'dex.yaml') }}"
5+
namespace: "{{ auth_dex_namespace }}"
6+
apply: true

‎roles/auth-dex/templates/dex-config.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
issuer: {{ auth_dex_issuer_url }}
2+
3+
storage:
4+
type: sqlite3
5+
config:
6+
file: /data/sqlite.db
7+
8+
web:
9+
http: 0.0.0.0:5556
10+
telemetry:
11+
http: 0.0.0.0:5558
12+
grpc:
13+
addr: 0.0.0.0:5557
14+
15+
staticClients: {{ auth_dex_static_clients | to_json }}
16+
staticPasswords: {{ auth_dex_static_passwords | to_json }}
17+
18+
enablePasswordDB: true

‎roles/auth-dex/templates/dex.yaml

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: StatefulSet
4+
metadata:
5+
name: dex
6+
namespace: {{ auth_dex_namespace }}
7+
labels:
8+
app.kubernetes.io/name: dex
9+
spec:
10+
selector:
11+
matchLabels:
12+
app.kubernetes.io/name: dex
13+
template:
14+
metadata:
15+
labels:
16+
app.kubernetes.io/name: dex
17+
annotations:
18+
checksum/certs: "{{ lookup('template', 'dex-config.yaml') | string | hash('sha1') }}"
19+
spec:
20+
containers:
21+
- name: dex
22+
image: ghcr.io/dexidp/dex
23+
args:
24+
- dex
25+
- serve
26+
- /dex-config/config.yaml
27+
volumeMounts:
28+
- name: configuration
29+
readonly: true
30+
mountPath: /dex-config
31+
- name: data
32+
mountPath: /data
33+
ports:
34+
- name: web
35+
containerPort: 5556
36+
- name: grpc
37+
containerPort: 5557
38+
- name: telemetry
39+
containerPort: 5558
40+
41+
volumes:
42+
- name: configuration
43+
secret:
44+
secretName: dex-config
45+
items:
46+
- key: config.yaml
47+
path: config.yaml
48+
49+
volumeClaimTemplates:
50+
- apiVersion: v1
51+
kind: PersistentVolumeClaim
52+
metadata:
53+
name: data
54+
spec:
55+
accessModes:
56+
- ReadWriteOnce
57+
resources:
58+
requests:
59+
storage: 1Gi
60+
---
61+
apiVersion: v1
62+
kind: Secret
63+
metadata:
64+
name: dex-config
65+
namespace: {{ auth_dex_namespace }}
66+
labels:
67+
app.kubernetes.io/part-of: dex
68+
stringData:
69+
config.yaml: |
70+
{{ lookup('template', 'dex-config.yaml') | indent(width=4, first=false) }}
71+
---
72+
apiVersion: v1
73+
kind: Service
74+
metadata:
75+
name: dex
76+
namespace: {{ auth_dex_namespace }}
77+
labels:
78+
app.kubernetes.io/name: dex
79+
spec:
80+
type: ClusterIP
81+
selector:
82+
app.kubernetes.io/name: dex
83+
ports:
84+
- name: web
85+
port: 5556
86+
targetPort: 5556
87+
- name: grpc
88+
port: 5557
89+
targetPort: 5557
90+
- name: telemetry
91+
port: 5558
92+
targetPort: 5558
93+
---
94+
apiVersion: networking.k8s.io/v1
95+
kind: Ingress
96+
metadata:
97+
name: dex
98+
namespace: {{ auth_dex_namespace }}
99+
labels:
100+
app.kubernetes.io/name: dex
101+
spec:
102+
ingressClassName: nginx
103+
rules:
104+
- host: {{ auth_dex_ingress_dns }}
105+
http:
106+
paths:
107+
- backend:
108+
service:
109+
name: dex
110+
port:
111+
name: web
112+
path: /
113+
pathType: Prefix

0 commit comments

Comments
 (0)