POC: Kube-bind skeleton

.gitignore

@@ -37,3 +37,8 @@ docs/generators/cli-doc/cli-doc
 # Ignore UNIX sockets and delve binaries
 *.sock
 __debug_*
+
+dex/
+*.crt
+*.key
+*.pem

contrib/kcp-dex/README.md

@@ -0,0 +1,75 @@
+# KCP Dex
+
+How to run local kcp with dex.
+
+## Step by step guide
+
+### Dex
+
+Run dex outside of kcp
+We use dex to manage OIDC, following the steps below you can run a local OIDC issuer using dex:
+
+* First, clone the dex repo: `git clone https://github.com/mjudeikis/dex.git -b mjudeikis/groups.support`
+  * Important: We use fork to allow local group support k8s relies on: https://github.com/dexidp/dex/issues/1080
+* `cd dex` and then build the dex binary `make build`
+* The binary will be created in `bin/dex`
+* Adjust the config file(`examples/config-dev.yaml`) for dex by specifying the server callback method:
+* Generate certificates for dex:
+```bash
+GOBIN=$(pwd)/bin go install github.com/mjudeikis/genkey
+./bin/genkey 127.0.0.1
+```
+
+* Run dex: `./bin/dex serve ../contrib/kcp-dex/kcp-config.yaml `
+
+
+### KCP
+
+Start kcp with oidc enabled:
+
+```bash
+o run ./cmd/kcp start \
+--oidc-issuer-url=https://127.0.0.1:5556/dex \
+--oidc-client-id=kcp-dev \
+--oidc-groups-claim=groups \
+--oidc-ca-file=127.0.0.1.pem
+```
+
+### Login
+
+Use oidc plugin:
+
+```bash
+kubectl krew install oidc-login
+
+# to test
+kubectl oidc-login get-token \
+--oidc-issuer-url=https://127.0.0.1:5556/dex \
+--oidc-client-id=kcp-dev \
+--oidc-client-secret=Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg== \
+--insecure-skip-tls-verify \
+--oidc-extra-scope=groups,email
+
+# to configure kubectl to use this plugin
+export KUBECONFIG=.kcp/admin.kubeconfig
+
+# create a new user with oidc
+kubectl config set-credentials oidc \
+  --exec-api-version=client.authentication.k8s.io/v1beta1 \
+  --exec-command=kubectl \
+  --exec-arg=oidc-login \
+  --exec-arg=get-token \
+  --exec-arg=--oidc-issuer-url=https://127.0.0.1:5556/dex  \
+  --exec-arg=--oidc-client-id=kcp-dev \
+  --exec-arg=--oidc-client-secret=Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg== \
+  --exec-arg=--oidc-extra-scope=groups \
+  --exec-arg=--oidc-extra-scope=email \
+  --exec-arg=--insecure-skip-tls-verify
+
+# set current context to use oidc
+kubectl config set-context --current --user=oidc
+
+# test
+# password is admin:password
+kubectl get ws
+kubectl create workspace bob

contrib/kcp-dex/kcp-config.yaml

@@ -0,0 +1,33 @@
+
+issuer: https://127.0.0.1:5556/dex
+web:
+  https: 127.0.0.1:5556
+  tlsCert: ../127.0.0.1.pem
+  tlsKey: ../127.0.0.1.pem
+storage:
+  type: sqlite3
+  config:
+    file: examples/dex.db
+staticClients:
+  - id: kcp-dev
+    public: true
+    redirectURIs:
+    - http://localhost:8000 # oidc-login callback url
+    - https://127.0.0.1:8080/callback # kube-bind callback url
+    name: 'KCP App'
+    secret: Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg==
+
+# Let dex keep a list of passwords which can be used to login to dex.
+enablePasswordDB: true
+
+# A static list of passwords to login the end user. By identifying here, dex
+# won't look in its underlying storage for passwords.
+#
+# If this option isn't chosen users may be added through the gRPC API.
+staticPasswords:
+- email: "admin"
+  # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2)
+  hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+  username: "admin"
+  userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+  groups: ["system:kcp:admin", "system:admin"]

contrib/kube-bind/Makefile

@@ -0,0 +1,18 @@
+
+build: WHAT ?= ./cmd/...
+build:
+	GOOS=$(OS) GOARCH=$(ARCH) go build $(BUILDFLAGS) -ldflags="$(LDFLAGS)" -o bin/ $(WHAT)
+.PHONY: build
+
+
+run-dev:
+	bin/backend \
+	--oidc-issuer-client-secret=Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg== \
+	--oidc-issuer-client-id=kcp-dev \
+	--oidc-issuer-url=https://127.0.0.1:5556/dex \
+	--oidc-callback-url=https://127.0.0.1:8080/callback \
+	--oidc-ca-file=../../127.0.0.1.pem \
+	--pretty-name="CorpAAA.com" \
+	--namespace-prefix="kube-bind-" \
+	--cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
+	--cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y=

contrib/kube-bind/README.md

@@ -0,0 +1,35 @@
+# Kube-Bind for KCP
+
+This is example backend for KCP that uses [kube-bind](https://github.com/kube-bind/kube-bind) to bind api-exports.
+
+Values here should match the values used to start kcp with so that the oidc tokens are valid.
+We use kcp from `contrib/kcp-dex` as an example.
+
+```
+make build
+
+bin/backend \
+  --oidc-issuer-client-secret=Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg== \
+  --oidc-issuer-client-id=kcp-dev \
+  --oidc-issuer-url=https://127.0.0.1:5556/dex \
+  --oidc-callback-url=https://127.0.0.1:8080/callback \
+  --pretty-name="CorpAAA.com" \
+  --namespace-prefix="kube-bind-" \
+  --cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
+  --cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y=
+  ```
+
+
+# Architecture
+
+Challenges:
+1. backend needs to be aware of every workspace where APIExports are enabled to be
+exported.
+   1.1. We can use separate workspace and bind dedicated workspace for kube-bind.
+   This means any workspace wanting to use kube-bind backend, would need to bind to this
+   workspace apis.
+   1.2. We can give global permissions to kube-bind and enable each labeled/annotated export
+   to be exported.
+
+Preferred solution: 1.1 as it would enable multipe kube-bind backends to be used simultaneously.
+

contrib/kube-bind/cmd/backend/main.go

@@ -0,0 +1,94 @@
+/*
+Copyright 2022 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spf13/pflag"
+
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	logsv1 "k8s.io/component-base/logs/api/v1"
+	"k8s.io/component-base/version"
+	"k8s.io/klog/v2"
+
+	backend "github.com/kcp-dev/kcp/contrib/kube-bind"
+	"github.com/kcp-dev/kcp/contrib/kube-bind/options"
+)
+
+func main() {
+	ctx := genericapiserver.SetupSignalContext()
+	if err := run(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context) error {
+	defer klog.Flush()
+
+	options := options.NewOptions()
+	options.AddFlags(pflag.CommandLine)
+	pflag.Parse()
+
+	// setup logging first
+	if err := logsv1.ValidateAndApply(options.Logs, nil); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+	ver := version.Get().GitVersion
+	if i := strings.Index(ver, "bind-"); i != -1 {
+		ver = ver[i+5:] // example: v1.25.2+kubectl-bind-v0.0.7-52-g8fee0baeaff3aa
+	}
+	logger := klog.FromContext(ctx)
+	logger.Info("Starting example-backend", "version", ver)
+
+	// create server
+	completed, err := options.Complete()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+	if err := completed.Validate(); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+
+	// start server
+	config, err := backend.NewConfig(completed)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+	server, err := backend.NewServer(ctx, config)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+	server.OptionallyStartInformers(ctx)
+	if err := server.Run(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v", err) // nolint: errcheck
+		os.Exit(1)
+	}
+	fmt.Printf("Listening on port %s\n", server.Addr())
+
+	<-ctx.Done()
+	return nil
+}

contrib/kube-bind/config.go

@@ -0,0 +1,79 @@
+/*
+Copyright 2022 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package backend
+
+import (
+	"time"
+
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	apiextensionsinformers "k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions"
+	kubeinformers "k8s.io/client-go/informers"
+	kubernetesclient "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/kcp-dev/kcp/contrib/kube-bind/options"
+	bindclient "github.com/kube-bind/kube-bind/pkg/client/clientset/versioned"
+	bindinformers "github.com/kube-bind/kube-bind/pkg/client/informers/externalversions"
+)
+
+type Config struct {
+	Options *options.CompletedOptions
+
+	ClientConfig        *rest.Config
+	BindClient          *bindclient.Clientset
+	KubeClient          *kubernetesclient.Clientset
+	ApiextensionsClient *apiextensionsclient.Clientset
+
+	KubeInformers          kubeinformers.SharedInformerFactory
+	BindInformers          bindinformers.SharedInformerFactory
+	ApiextensionsInformers apiextensionsinformers.SharedInformerFactory
+}
+
+func NewConfig(options *options.CompletedOptions) (*Config, error) {
+	config := &Config{
+		Options: options,
+	}
+
+	// create clients
+	rules := clientcmd.NewDefaultClientConfigLoadingRules()
+	rules.ExplicitPath = options.KubeConfig
+	var err error
+	config.ClientConfig, err = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(rules, nil).ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+	config.ClientConfig = rest.CopyConfig(config.ClientConfig)
+	config.ClientConfig = rest.AddUserAgent(config.ClientConfig, "kube-bind-example-backend")
+
+	if config.BindClient, err = bindclient.NewForConfig(config.ClientConfig); err != nil {
+		return nil, err
+	}
+	if config.KubeClient, err = kubernetesclient.NewForConfig(config.ClientConfig); err != nil {
+		return nil, err
+	}
+	if config.ApiextensionsClient, err = apiextensionsclient.NewForConfig(config.ClientConfig); err != nil {
+		return nil, err
+	}
+
+	// construct informer factories
+	config.KubeInformers = kubeinformers.NewSharedInformerFactory(config.KubeClient, time.Minute*30)
+	config.BindInformers = bindinformers.NewSharedInformerFactory(config.BindClient, time.Minute*30)
+	config.ApiextensionsInformers = apiextensionsinformers.NewSharedInformerFactory(config.ApiextensionsClient, time.Minute*30)
+
+	return config, nil
+}