Skip to content
This repository was archived by the owner on Jan 22, 2026. It is now read-only.

Commit 66e9bbd

Browse files
mangelajomangelajo
authored
Merge pull request #5 from jumpstarter-dev/oidc-login
2 parents 1341930 + 9e96640 commit 66e9bbd

File tree

9 files changed

+215
-27
lines changed

9 files changed

+215
-27
lines changed

‎.github/workflows/selftest.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ jobs:
66
runs-on: ubuntu-24.04
77
steps:
88
- uses: actions/checkout@v4
9-
- uses: ./
9+
with:
10+
path: e2e
11+
- uses: ./e2e
1012
with:
1113
controller-ref: main
1214
jumpstarter-ref: main

‎action.yml‎

Lines changed: 45 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,16 @@ runs:
3030
- name: Deploy jumpstarter controller
3131
shell: bash
3232
run: |
33+
cp "$GITHUB_ACTION_PATH"/values.kind.yaml ./controller/deploy/helm/jumpstarter/values.kind.yaml
34+
cp "$GITHUB_ACTION_PATH"/kind_cluster.yaml ./controller/hack/kind_cluster.yaml
3335
make -C controller deploy
36+
- name: Deploy dex
37+
shell: bash
38+
run: |
39+
kubectl create namespace dex
40+
kubectl apply -f "$GITHUB_ACTION_PATH"/dex.yaml
41+
helm repo add dex https://charts.dexidp.io
42+
helm install --namespace dex --wait -f "$GITHUB_ACTION_PATH"/dex.values.yaml dex dex/dex
3443
- name: Install jumpstarter
3544
shell: bash
3645
run: |
@@ -43,47 +52,57 @@ runs:
4352
- name: Run jumpstarter
4453
shell: bash
4554
run: |
55+
sudo cp "$GITHUB_ACTION_PATH"/minica.pem /usr/local/share/ca-certificates/minica.crt
56+
sudo update-ca-certificates
57+
58+
echo "127.0.0.1 dex.dex.svc.cluster.local" | sudo tee -a /etc/hosts
59+
60+
ENDPOINT=$(helm get values jumpstarter --output json | jq -r '."jumpstarter-controller".grpc.endpoint')
61+
4662
sudo mkdir -p /etc/jumpstarter/exporters
4763
sudo chown $USER /etc/jumpstarter/exporters
4864
4965
. .venv/bin/activate
5066
5167
export JUMPSTARTER_GRPC_INSECURE=1
5268
53-
jmp admin create client test-client-1 --save --unsafe
54-
jmp admin create exporter test-exporter-1 --save
55-
jmp admin create exporter test-exporter-2 --save
69+
jmp admin create client test-client-oidc --unsafe --out /dev/null --oidc-username dex:test-client-oidc
70+
jmp admin create client test-client-legacy --unsafe --save
71+
jmp admin create exporter test-exporter-oidc --out /dev/null --oidc-username dex:test-exporter-oidc \
72+
--label example.com/board oidc
73+
jmp admin create exporter test-exporter-legacy --save \
74+
--label example.com/board legacy
5675
57-
cat <<EOF >> /etc/jumpstarter/exporters/test-exporter-1.yaml
58-
export:
59-
power:
60-
type: jumpstarter_driver_power.driver.MockPower
61-
EOF
62-
63-
kubectl -n default patch exporters.jumpstarter.dev test-exporter-1 \
64-
--type=merge --patch '{"metadata":{"labels":{"example.com/board":"rpi4"}}}'
76+
jmp client list-configs
77+
jmp exporter list-configs
6578
66-
cat <<EOF >> /etc/jumpstarter/exporters/test-exporter-2.yaml
67-
export:
68-
storage:
69-
type: jumpstarter_driver_opendal.driver.MockStorageMux
70-
EOF
79+
jmp client login test-client-oidc \
80+
--endpoint "$ENDPOINT" --namespace default --name test-client-oidc \
81+
--issuer https://dex.dex.svc.cluster.local:5556 \
82+
--username test-client-oidc@example.com --password password --unsafe
83+
jmp exporter login test-exporter-oidc \
84+
--endpoint "$ENDPOINT" --namespace default --name test-exporter-oidc \
85+
--issuer https://dex.dex.svc.cluster.local:5556 \
86+
--username test-exporter-oidc@example.com --password password
7187
72-
kubectl -n default patch exporters.jumpstarter.dev test-exporter-2 \
73-
--type=merge --patch '{"metadata":{"labels":{"example.com/board":"rpi5"}}}'
88+
go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
89+
/etc/jumpstarter/exporters/test-exporter-oidc.yaml
90+
go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
91+
/etc/jumpstarter/exporters/test-exporter-legacy.yaml
7492
75-
jmp client list-configs
93+
jmp client list-configs
7694
jmp exporter list-configs
7795
78-
jmp exporter run test-exporter-1 &
79-
jmp exporter run test-exporter-2 &
96+
jmp exporter run test-exporter-oidc &
97+
jmp exporter run test-exporter-legacy &
8098
81-
sleep 5
99+
kubectl -n default wait --for=condition=Registered exporters.jumpstarter.dev/test-exporter-oidc
100+
kubectl -n default wait --for=condition=Registered exporters.jumpstarter.dev/test-exporter-legacy
82101
83-
jmp client shell test-client-1 --label example.com/board rpi4 <<EOF
84-
j power
102+
jmp client shell test-client-oidc --label example.com/board oidc <<EOF
103+
j power on
85104
EOF
86105
87-
jmp client shell test-client-1 --label example.com/board rpi5 <<EOF
88-
j storage
106+
jmp client shell test-client-legacy --label example.com/board legacy <<EOF
107+
j power on
89108
EOF

‎dex.values.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
https:
2+
enabled: true
3+
config:
4+
issuer: https://dex.dex.svc.cluster.local:5556
5+
web:
6+
tlsCert: /etc/dex/tls/tls.crt
7+
tlsKey: /etc/dex/tls/tls.key
8+
storage:
9+
type: kubernetes
10+
config:
11+
inCluster: true
12+
staticClients:
13+
- id: jumpstarter-cli
14+
name: Jumpstarter CLI
15+
public: true
16+
oauth2:
17+
responseTypes: ["code", "token", "id_token", "id_token token"]
18+
passwordConnector: local
19+
enablePasswordDB: true
20+
staticPasswords:
21+
- email: "test-client-oidc@example.com"
22+
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # password
23+
username: "test-client-oidc"
24+
userID: "73bca0b9-9be6-4e73-a8fb-347c2ac23255"
25+
- email: "test-exporter-oidc@example.com"
26+
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # password
27+
username: "test-exporter-oidc"
28+
userID: "a4cb4de2-4467-4e5c-a42a-33be8783649d"
29+
volumes:
30+
- name: tls
31+
secret:
32+
secretName: dex-tls
33+
volumeMounts:
34+
- name: tls
35+
mountPath: /etc/dex/tls
36+
service:
37+
type: NodePort
38+
ports:
39+
http:
40+
port: 5554
41+
https:
42+
port: 5556
43+
nodePort: 32000

‎dex.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: dex-tls
5+
namespace: dex
6+
type: Opaque
7+
stringData:
8+
tls.crt: |
9+
-----BEGIN CERTIFICATE-----
10+
MIIB/jCCAYWgAwIBAgIIGiIRZdsY1ZswCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
11+
bWluaWNhIHJvb3QgY2EgNzI5MGI2MB4XDTI1MDIxMzE5MjQzNloXDTI3MDMxNTE4
12+
MjQzNlowJDEiMCAGA1UEAxMZZGV4LmRleC5zdmMuY2x1c3Rlci5sb2NhbDB2MBAG
13+
ByqGSM49AgEGBSuBBAAiA2IABOXOUhakYrIsNnmWSrDNk0VAB3HLjlxIvDBKt/As
14+
7kEFZyi3Q+6kPwDGZlYS/CLBQz7MleB57xV+BTXeU4C9JJ2VYfUzrzUWMI9U2a+/
15+
XAWc1L2GDw6TrLV2COFJQ7njlqOBhzCBhDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l
16+
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
17+
FoAUmUQQlLj97WtsbH451iI74L8+H6IwJAYDVR0RBB0wG4IZZGV4LmRleC5zdmMu
18+
Y2x1c3Rlci5sb2NhbDAKBggqhkjOPQQDAwNnADBkAjAr3xJ+MuSx1IsabimAlaIC
19+
FvzA7VqtukdJ4ycZ5ndZlC3BOAHw8LEotgYHQpBItjQCMF7x/LkdBThU1nCChoA6
20+
r5F8RrqBNPeHeaItjnPpYq6sT3dDqGQF9Rm7bbaG6ExhKA==
21+
-----END CERTIFICATE-----
22+
tls.key: |
23+
-----BEGIN PRIVATE KEY-----
24+
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDMWWagdOx7Neqeeg2g
25+
ofPS9ipeeliiTUv6B/9+oiTMGlTRMPHu4ruSqS7kiw3oBQuhZANiAATlzlIWpGKy
26+
LDZ5lkqwzZNFQAdxy45cSLwwSrfwLO5BBWcot0PupD8AxmZWEvwiwUM+zJXgee8V
27+
fgU13lOAvSSdlWH1M681FjCPVNmvv1wFnNS9hg8Ok6y1dgjhSUO545Y=
28+
-----END PRIVATE KEY-----

‎exporter.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
export:
2+
power:
3+
type: jumpstarter_driver_power.driver.MockPower
4+
storage:
5+
type: jumpstarter_driver_opendal.driver.MockStorageMux

‎kind_cluster.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
kind: Cluster
2+
apiVersion: kind.x-k8s.io/v1alpha4
3+
kubeadmConfigPatches:
4+
- |
5+
kind: ClusterConfiguration
6+
apiServer:
7+
extraArgs:
8+
"service-node-port-range": "3000-32767"
9+
- |
10+
kind: InitConfiguration
11+
nodeRegistration:
12+
kubeletExtraArgs:
13+
node-labels: "ingress-ready=true"
14+
nodes:
15+
- role: control-plane
16+
extraPortMappings:
17+
- containerPort: 80 # ingress controller
18+
hostPort: 5080
19+
protocol: TCP
20+
- containerPort: 30010 # grpc nodeport
21+
hostPort: 8082
22+
protocol: TCP
23+
- containerPort: 30011 # grpc router nodeport
24+
hostPort: 8083
25+
protocol: TCP
26+
- containerPort: 32000 # dex nodeport
27+
hostPort: 5556
28+
protocol: TCP
29+
30+
- containerPort: 443
31+
hostPort: 5443
32+
protocol: TCP
33+
# if we needed to mount a hostPath volume into the kind cluster, we can do it like this
34+
# extraMounts:
35+
# - hostPath: ./bin/e2e-certs
36+
# containerPath: /tmp/e2e-certs
37+

‎minica-key.pem‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDC2m+wWKd8N0puHKcgF
3+
i9qE6zqk+0gnPSQYoYdO/faf9wenw2AYSi8mTMiFmwIO6MuhZANiAAQzezKJ4My3
4+
5HPeoJvvzTjhS2uJMBYrYfrs5csxZjiyq8ORrHM539XhWlA6sVZODhzcF2KL4mC9
5+
xKz/yIrsws+LKsIWNHGGmIPEKFYnHBGwVBGeARvhpzZP/9frJXAN/8c=
6+
-----END PRIVATE KEY-----

‎minica.pem‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB/DCCAYKgAwIBAgIIcpC2uS+SjEIwCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
3+
bWluaWNhIHJvb3QgY2EgNzI5MGI2MCAXDTI1MDIwMzE5MzMyNVoYDzIxMjUwMjAz
4+
MTkzMzI1WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA3MjkwYjYwdjAQBgcq
5+
hkjOPQIBBgUrgQQAIgNiAAQzezKJ4My35HPeoJvvzTjhS2uJMBYrYfrs5csxZjiy
6+
q8ORrHM539XhWlA6sVZODhzcF2KL4mC9xKz/yIrsws+LKsIWNHGGmIPEKFYnHBGw
7+
VBGeARvhpzZP/9frJXAN/8ejgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQW
8+
MBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1Ud
9+
DgQWBBSZRBCUuP3ta2xsfjnWIjvgvz4fojAfBgNVHSMEGDAWgBSZRBCUuP3ta2xs
10+
fjnWIjvgvz4fojAKBggqhkjOPQQDAwNoADBlAjADql5Ks5wh181iUa1ZBnx4XOVe
11+
l0l7I+mwlwJSPmkZHxruWZTx7gQU4tfDCr+UuzUCMQC2aDXRb17cphipK4gzbExv
12+
EDLExjhHAqMPrKDmT0jHIi7Bbos38/1tyZ/IoKjLnv0=
13+
-----END CERTIFICATE-----

‎values.kind.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
global:
2+
baseDomain: jumpstarter.127.0.0.1.nip.io
3+
metrics:
4+
enabled: false
5+
6+
jumpstarter-controller:
7+
grpc:
8+
mode: "ingress"
9+
authenticationConfig: |
10+
apiVersion: jumpstarter.dev/v1alpha1
11+
kind: AuthenticationConfiguration
12+
jwt:
13+
- issuer:
14+
url: https://dex.dex.svc.cluster.local:5556
15+
audiences:
16+
- jumpstarter-cli
17+
audienceMatchPolicy: MatchAny
18+
certificateAuthority: |
19+
-----BEGIN CERTIFICATE-----
20+
MIIB/DCCAYKgAwIBAgIIcpC2uS+SjEIwCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
21+
bWluaWNhIHJvb3QgY2EgNzI5MGI2MCAXDTI1MDIwMzE5MzMyNVoYDzIxMjUwMjAz
22+
MTkzMzI1WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA3MjkwYjYwdjAQBgcq
23+
hkjOPQIBBgUrgQQAIgNiAAQzezKJ4My35HPeoJvvzTjhS2uJMBYrYfrs5csxZjiy
24+
q8ORrHM539XhWlA6sVZODhzcF2KL4mC9xKz/yIrsws+LKsIWNHGGmIPEKFYnHBGw
25+
VBGeARvhpzZP/9frJXAN/8ejgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQW
26+
MBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1Ud
27+
DgQWBBSZRBCUuP3ta2xsfjnWIjvgvz4fojAfBgNVHSMEGDAWgBSZRBCUuP3ta2xs
28+
fjnWIjvgvz4fojAKBggqhkjOPQQDAwNoADBlAjADql5Ks5wh181iUa1ZBnx4XOVe
29+
l0l7I+mwlwJSPmkZHxruWZTx7gQU4tfDCr+UuzUCMQC2aDXRb17cphipK4gzbExv
30+
EDLExjhHAqMPrKDmT0jHIi7Bbos38/1tyZ/IoKjLnv0=
31+
-----END CERTIFICATE-----
32+
claimMappings:
33+
username:
34+
claim: "name"
35+
prefix: "dex:"

0 commit comments

Comments
 (0)