software-engineering/zitadel-k8s-operator
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add PAT to machineuser

Browse Source 
[ZITADOPER-1]
This commit is contained in:
Haim Kortovich
2024-05-20 11:47:39 -05:00
parent 33071d2b8b
commit 680aa19216
4 changed files with 111 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ops/chart/crds/machineuser-crd.yaml
View File

@@ -158,11 +158,15 @@ spec:
keyId:
default: ""
type: string
patId:
default: ""
type: string
userId:
default: ""
type: string
required:
- keyId
- patId
- userId
type: object
type: object

3
src/api/v1alpha1/machineuser_types.go
View File

@@ -49,6 +49,9 @@ type MachineUserStatus struct {
UserId string `json:"userId"`
// +kubebuilder:default=""
KeyId string `json:"keyId"`
// +kubebuilder:default=""
PATId string `json:"patId"`
}
func (d *MachineUserStatus) SetCondition(condition metav1.Condition) {

4
src/config/crd/bases/zitadel.topmanage.com_machineusers.yaml
View File

@@ -159,11 +159,15 @@ spec:
keyId:
default: ""
type: string
patId:
default: ""
type: string
userId:
default: ""
type: string
required:
- keyId
- patId
- userId
type: object
type: object

121
src/internal/controller/machineuser_controller.go
View File

@@ -12,7 +12,6 @@ import (
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/controller/zitadel"
"github.com/zitadel/zitadel-go/v2/pkg/client/management"
"github.com/zitadel/zitadel-go/v2/pkg/client/middleware"
"github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/authn"
pb "github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/management"
user "github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/user"
corev1 "k8s.io/api/core/v1"
@@ -84,28 +83,51 @@ func newWrappedMachineUserReconciler(client client.Client, refResolver *zitadelv
}
}
type machineUserReconcilePhase struct {
Name string
Reconcile func(context.Context, *management.Client) error
}
func (wr *wrappedMachineUserReconciler) Reconcile(ctx context.Context, ztdClient *management.Client) error {
// TODO: update machine user
org, err := wr.refResolver.OrganizationRef(ctx, &wr.MachineUser.Spec.OrganizationRef, wr.MachineUser.Namespace)
phases := []machineUserReconcilePhase{
{
Name: "machineUser",
Reconcile: wr.reconcileMachineUser,
},
{
Name: "pat",
Reconcile: wr.reconcilePAT,
},
}
for _, p := range phases {
err := p.Reconcile(ctx, ztdClient)
if err != nil {
return err
}
if wr.MachineUser.Status.UserId != "" {
_, err = ztdClient.UpdateMachine(middleware.SetOrgID(ctx, org.Status.OrgId),
&pb.UpdateMachineRequest{
UserId: wr.MachineUser.Status.UserId,
Name: wr.MachineUser.Name,
Description: wr.MachineUser.Name,
AccessTokenType: user.AccessTokenType(user.AccessTokenType_value[wr.MachineUser.Spec.AccessTokenType]),
})
if err != nil {
if !strings.Contains(err.Error(), "No changes") {
return fmt.Errorf("Error updating OIDCApp: %v", err)
}
}
return nil
}
func (wr *wrappedMachineUserReconciler) reconcileMachineUser(ctx context.Context, ztdClient *management.Client) error {
org, err := wr.refResolver.OrganizationRef(ctx, &wr.MachineUser.Spec.OrganizationRef, wr.MachineUser.Namespace)
if err != nil {
return err
}
zitadel, err := wr.refResolver.ZitadelCluster(ctx, &org.Spec.ZitadelClusterRef, wr.MachineUser.Namespace)
if err != nil {
return err
}
machineUser, err := ztdClient.GetUserByLoginNameGlobal(ctx, &pb.GetUserByLoginNameGlobalRequest{
LoginName: strings.ToLower(fmt.Sprintf("%s@%s.%s", wr.MachineUser.Name, org.Name, zitadel.Spec.Host)),
})
if err != nil {
if !strings.Contains(err.Error(), "could not be found") {
return fmt.Errorf("Error getting machineuser: %v", err)
}
}
var userid string
if machineUser == nil {
resp, err := ztdClient.AddMachineUser(middleware.SetOrgID(ctx, org.Status.OrgId),
&pb.AddMachineUserRequest{
Name: wr.MachineUser.Name,
@@ -115,51 +137,76 @@ func (wr *wrappedMachineUserReconciler) Reconcile(ctx context.Context, ztdClient
},
)
if err != nil {
if strings.Contains(err.Error(), "AlreadyExists") {
return nil
}
return fmt.Errorf("error creating MachineUser in Zitadel: %v", err)
}
userid = resp.UserId
} else {
_, err = ztdClient.UpdateMachine(middleware.SetOrgID(ctx, org.Status.OrgId),
&pb.UpdateMachineRequest{
UserId: machineUser.User.Id,
Name: wr.MachineUser.Name,
Description: wr.MachineUser.Name,
AccessTokenType: user.AccessTokenType(user.AccessTokenType_value[wr.MachineUser.Spec.AccessTokenType]),
})
if err != nil {
if !strings.Contains(err.Error(), "No changes") {
return fmt.Errorf("Error updating MchineUser: %v", err)
}
}
userid = machineUser.User.Id
}
patch := ctrlClient.MergeFrom(wr.MachineUser.DeepCopy())
wr.MachineUser.Status.UserId = resp.UserId
if err := wr.Client.Status().Patch(ctx, wr.MachineUser, patch); err != nil {
return err
wr.MachineUser.Status.UserId = userid
return wr.Client.Status().Patch(ctx, wr.MachineUser, patch)
}
if wr.MachineUser.Status.KeyId != "" {
respKey, err := ztdClient.AddMachineKey(ctx, &pb.AddMachineKeyRequest{
UserId: resp.UserId,
Type: authn.KeyType_KEY_TYPE_JSON,
ExpirationDate: nil,
func (wr *wrappedMachineUserReconciler) reconcilePAT(ctx context.Context, ztdClient *management.Client) error {
org, err := wr.refResolver.OrganizationRef(ctx, &wr.MachineUser.Spec.OrganizationRef, wr.MachineUser.Namespace)
if err != nil {
return err
}
ctx = middleware.SetOrgID(ctx, org.Status.OrgId)
token, err := ztdClient.GetPersonalAccessTokenByIDs(ctx, &pb.GetPersonalAccessTokenByIDsRequest{
UserId: wr.MachineUser.Status.UserId,
TokenId: wr.MachineUser.Status.PATId,
})
if err != nil {
return fmt.Errorf("Error Adding MachineKey: %v", err)
if !strings.Contains(err.Error(), "not found") {
return fmt.Errorf("Error getting PAT: %v", err)
}
}
if token == nil {
resp, err := ztdClient.AddPersonalAccessToken(ctx, &pb.AddPersonalAccessTokenRequest{
UserId: wr.MachineUser.Status.UserId,
})
if err != nil {
return fmt.Errorf("Error adding PAT: %v", err)
}
key := types.NamespacedName{
Name: wr.MachineUser.Name + "-machinekey-secret",
Name: wr.MachineUser.Name + "-pat-secret",
Namespace: wr.MachineUser.Namespace,
}
secret, err := wr.Builder.BuildSecret(
builder.SecretOpts{
patSecret, err := wr.Builder.BuildSecret(builder.SecretOpts{
Key: key,
Immutable: true,
Data: map[string][]byte{
"key.json": respKey.KeyDetails,
"pat": []byte(resp.Token),
},
}, wr.MachineUser)
if err != nil {
return fmt.Errorf("error building Secret: %v", err)
return fmt.Errorf("error building PAT Secret: %v", err)
}
if err := wr.Create(ctx, secret); err != nil {
return fmt.Errorf("error creating machine key Secret: %v", err)
if err := wr.Create(ctx, patSecret); err != nil {
return fmt.Errorf("error creating pat-secret Secret: %v", err)
}
patch = ctrlClient.MergeFrom(wr.MachineUser.DeepCopy())
wr.MachineUser.Status.KeyId = respKey.KeyId
patch := ctrlClient.MergeFrom(wr.MachineUser.DeepCopy())
wr.MachineUser.Status.PATId = resp.TokenId
return wr.Client.Status().Patch(ctx, wr.MachineUser, patch)
}
return nil
}