You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
104 lines
3.4 KiB
104 lines
3.4 KiB
#!/bin/bash
|
|
set -euxo pipefail
|
|
|
|
if kubectl get cm -n auth dex -o yaml | grep -q "redirectURIs.*http://authservice"; then
|
|
kubectl apply -f - <<EOF
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dex
|
|
namespace: auth
|
|
data:
|
|
config.yaml: |
|
|
issuer: http://dex.auth.svc.cluster.local:5556/dex
|
|
storage:
|
|
type: kubernetes
|
|
config:
|
|
inCluster: true
|
|
web:
|
|
http: 0.0.0.0:5556
|
|
logger:
|
|
level: "debug"
|
|
format: text
|
|
oauth2:
|
|
skipApprovalScreen: true
|
|
enablePasswordDB: true
|
|
staticPasswords:
|
|
- email: user@example.com
|
|
hashFromEnv: DEX_USER_PASSWORD
|
|
username: user
|
|
userID: "15841185641784"
|
|
staticClients:
|
|
- idEnv: OIDC_CLIENT_ID
|
|
redirectURIs: ["/oauth2/callback"]
|
|
name: 'Dex Login Application'
|
|
secretEnv: OIDC_CLIENT_SECRET
|
|
EOF
|
|
kubectl rollout restart deployment -n auth dex
|
|
sleep 5
|
|
fi
|
|
|
|
# Create OIDC client secrets
|
|
kubectl create secret generic oidc-client-secret -n auth \
|
|
--from-literal=OIDC_CLIENT_ID=kubeflow-oidc-authservice \
|
|
--from-literal=OIDC_CLIENT_SECRET=pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
kubectl create secret generic oidc-client-secret -n oauth2-proxy \
|
|
--from-literal=OIDC_CLIENT_ID=kubeflow-oidc-authservice \
|
|
--from-literal=OIDC_CLIENT_SECRET=pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
if ! kubectl get deploy -n auth dex -o yaml | grep -q "OIDC_CLIENT_ID"; then
|
|
kubectl create secret generic dex-secret -n auth \
|
|
--from-literal=DEX_USER_PASSWORD=$(python3 -c 'from passlib.hash import bcrypt; print(bcrypt.using(rounds=12, ident="2y").hash("12341234"))') \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
kubectl create secret generic oidc-client-secret -n auth \
|
|
--from-literal=OIDC_CLIENT_ID=kubeflow-oidc-authservice \
|
|
--from-literal=OIDC_CLIENT_SECRET=pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
./tests/gh-actions/install_dex.sh
|
|
fi
|
|
|
|
if kubectl get deployment -n oauth2-proxy oauth2-proxy &>/dev/null; then
|
|
kubectl rollout restart deployment -n oauth2-proxy oauth2-proxy
|
|
fi
|
|
|
|
RETRY_COUNT=0
|
|
MAX_RETRIES=3
|
|
until curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/dex/health 2>/dev/null | grep -q "200\|302\|404"; do
|
|
RETRY_COUNT=$((RETRY_COUNT+1))
|
|
if [ $RETRY_COUNT -ge $MAX_RETRIES ]; then
|
|
echo "Error: Dex health endpoint not available after $MAX_RETRIES attempts"
|
|
exit 1
|
|
fi
|
|
sleep 10
|
|
done
|
|
|
|
sed -i 's/raise RuntimeError/print("ERROR:"); exit 1/g' tests/gh-actions/test_dex_login.py
|
|
|
|
# Create a temporary python script file instead of using heredoc
|
|
cat > /tmp/update_dex_login.py << 'PYTHONEOF'
|
|
import re
|
|
with open('tests/gh-actions/test_dex_login.py', 'r') as f:
|
|
content = f.read()
|
|
content = re.sub('import re', 'import re, time, sys', content, count=1)
|
|
retry_pattern = r'([ \t]+)session_cookies = dex_session_manager\.get_session_cookies\(\)'
|
|
replacement = r"""\1# Try with retries
|
|
\1for _attempt in range(3):
|
|
\1 session_cookies = dex_session_manager.get_session_cookies()
|
|
\1 if session_cookies:
|
|
\1 break
|
|
\1 if _attempt == 2: # Last attempt failed
|
|
\1 print("Error: Failed to get Dex session cookies after 3 attempts")
|
|
\1 sys.exit(1)
|
|
\1 time.sleep(5)"""
|
|
content = re.sub(retry_pattern, replacement, content, count=1)
|
|
with open('tests/gh-actions/test_dex_login.py', 'w') as f:
|
|
f.write(content)
|
|
PYTHONEOF
|
|
|
|
python3 /tmp/update_dex_login.py
|
|
rm /tmp/update_dex_login.py |