Mercurial > code > home > repos > pomerium

comparison make_global.py @ 34:b1f75b0584f3

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
redo 'run' task and 'delete' (less tested)
author drewp@bigasterisk.com
date Wed, 21 Jun 2023 23:01:32 -0700
parents 1d3d12b7cf6d
children
comparison
equal deleted inserted replaced
33:48b4ebc37636 34:b1f75b0584f3
3 import json 3 import json
4 import subprocess 4 import subprocess
5 import sys 5 import sys
6 import time 6 import time
7 7
8 POM_CERT_NAME = 'pomerium-proxy-tls'
9 AUTH_HOST = 'authenticate2.bigasterisk.com'
8 10
9 def getSuffixedName() -> str: 11 (phase,) = sys.argv[1:]
10 ns = 'pomerium' 12
13
14 def secretExists(qname):
15 ns, localName = qname.split('/')
11 j = json.loads(subprocess.check_output(["kubectl", "get", "-n", ns, "secret", "-o", "json"]).decode('utf8')) 16 j = json.loads(subprocess.check_output(["kubectl", "get", "-n", ns, "secret", "-o", "json"]).decode('utf8'))
12 for item in j['items']: 17 for item in j['items']:
13 name = item['metadata']['name'] 18 name = item['metadata']['name']
14 if name.startswith('pomerium-proxy-tls'): 19 if name == localName:
15 return ns + '/' + name 20 return
16 raise ValueError() 21 raise ValueError()
17 22
18 23
19 def retryGetSuffixedName() -> str: 24 def waitForSecret(qname):
20 sys.stderr.write("\nwait for secret: ") 25 sys.stderr.write(f"\nwait for secret {qname}: ")
21 for tries in range(100): 26 for tries in range(100):
22 try: 27 try:
23 return getSuffixedName() 28 return secretExists(qname)
24 except ValueError: 29 except ValueError:
25 sys.stderr.write('.') 30 sys.stderr.write('.')
26 sys.stderr.flush() 31 sys.stderr.flush()
27 time.sleep(10) 32 time.sleep(10)
28 else: 33 else:
29 raise ValueError 34 raise ValueError
30 35
36 def pomeriumGlobalConfig():
31 37
32 config = { 38 config = {
33 'apiVersion': "ingress.pomerium.io/v1", 39 'apiVersion': "ingress.pomerium.io/v1",
34 'kind': "Pomerium", 40 'kind': "Pomerium",
35 'metadata': { 41 'metadata': {
36 'name': "global" 42 'name': "global"
37 },
38 'spec': {
39 'secrets': "pomerium/bootstrap",
40 'authenticate': {
41 'url': "https://authenticate.bigasterisk.com"
42 }, 43 },
43 'cookie': { 44 'spec': {
44 'expire': "20h" 45 'secrets': "pomerium/bootstrap",
45 }, 46 'authenticate': {
46 'identityProvider': { 47 'url': f"https://{AUTH_HOST}"
47 'provider': "oidc", 48 },
48 'url': "https://accounts.google.com", 49 'cookie': {
49 'scopes': [ 50 'expire': "20h"
50 "openid", 51 },
51 "email", 52 'identityProvider': {
52 "profile" # adds name+locale to user details 53 'provider': "oidc",
53 ], 54 'url': "https://accounts.google.com",
54 'secret': "pomerium/idp" 55 'scopes': [
55 }, 56 "openid",
56 # 'storage': { 57 "email",
57 # 'postgres': { 58 "profile" # adds name+locale to user details
58 # 'secret': "pomerium/postgres-connection-key" 59 ],
59 # } 60 'secret': "pomerium/idp"
60 # }, 61 },
62 # 'storage': {
63 # 'postgres': {
64 # 'secret': "pomerium/postgres-connection-key"
65 # }
66 # },
67 }
61 } 68 }
69
70 if phase == 'wait_for_cert':
71 waitForSecret('pomerium/pomerium-proxy-tls')
72 config['spec']['certificates'] = [f'pomerium/{POM_CERT_NAME}']
73
74 sys.stderr.write('\n')
75 return config
76
62 def pomCert(): 77 def pomCert():
63 return { 78 return {
64 "apiVersion": "cert-manager.io/v1", 79 "apiVersion": "cert-manager.io/v1",
65 "kind": "Certificate", 80 "kind": "Certificate",
66 "metadata": { 81 "metadata": {
77 }, 92 },
78 "secretName": "pomerium-proxy-tls" 93 "secretName": "pomerium-proxy-tls"
79 } 94 }
80 } 95 }
81 96
82 # Old note: pom won't start up if this cert doesn't exist, so you have to run once 97 if phase == 'output_pom_cert':
83 # with it commented out, then after cert success, run again with it enabled. 98 output = pomCert()
99 else:
100 output = pomeriumGlobalConfig()
84 101
85 config['spec']['certificates'] = [ 102 print(json.dumps(output))
86 # retryGetSuffixedName() # it appear this is a temporary cert and we should set the line below then wait a few minutes
87 'pomerium/pomerium-proxy-tls'
88 ]
89
90 sys.stderr.write('\n')
91
92 print(json.dumps(config))