From b31939f3ab1664e4f45675d3cbb3ade4f4b2b492 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Fri, 24 Jul 2026 15:13:58 +0100 Subject: [PATCH] feat: inject envoy proxy into workflow pods --- charts/auth-broker/Chart.yaml | 2 +- charts/auth-broker/templates/deployment.yaml | 3 + charts/auth-broker/values.yaml | 2 +- charts/workflows/Chart.yaml | 2 +- charts/workflows/staging-values.yaml | 6 +- ...daemon-inject-container-clusterpolicy.yaml | 2 +- .../inject-envoy-sidecar-clusterpolicy.yaml | 364 ++++++++++++++++++ .../inject-envoy-sidecar/chainsaw-test.yaml | 113 ++++++ .../fake-auth-broker.yaml | 68 ++++ .../inject-envoy-sidecar/fake-graph.yaml | 72 ++++ .../inject-envoy-sidecar/pod-mutated.yaml | 22 ++ .../inject-envoy-sidecar/pod-succeeded.yaml | 6 + .../test-policy/inject-envoy-sidecar/pod.yaml | 37 ++ .../inject-envoy-sidecar/values-chainsaw.yaml | 13 + charts/workflows/values.yaml | 16 +- 15 files changed, 722 insertions(+), 6 deletions(-) create mode 100644 charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/chainsaw-test.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/fake-auth-broker.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/fake-graph.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/pod-mutated.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/pod-succeeded.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/pod.yaml create mode 100644 charts/workflows/test-policy/inject-envoy-sidecar/values-chainsaw.yaml diff --git a/charts/auth-broker/Chart.yaml b/charts/auth-broker/Chart.yaml index decd22a68..039e8b29b 100644 --- a/charts/auth-broker/Chart.yaml +++ b/charts/auth-broker/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: auth-broker description: Token broker service that validates pod identity via Kubernetes TokenReview and serves OIDC access tokens type: application -version: 0.1.2 +version: 0.1.3 appVersion: 0.1.0 dependencies: diff --git a/charts/auth-broker/templates/deployment.yaml b/charts/auth-broker/templates/deployment.yaml index b680714e5..5c117990a 100644 --- a/charts/auth-broker/templates/deployment.yaml +++ b/charts/auth-broker/templates/deployment.yaml @@ -58,6 +58,9 @@ spec: - name: config mountPath: /etc/auth-broker readOnly: true + env: + - name: LOG_LEVEL + value: "info" volumes: - name: config secret: diff --git a/charts/auth-broker/values.yaml b/charts/auth-broker/values.yaml index 6bc2c5092..f65e94b36 100644 --- a/charts/auth-broker/values.yaml +++ b/charts/auth-broker/values.yaml @@ -4,7 +4,7 @@ image: registry: "" repository: ghcr.io/diamondlightsource/workflows-auth-broker tag: latest - digest: "" + digest: "sha256:70cc33ff46ed8de53ebb02b569260a5b63add937d12021eff96292ce977fb2ea" pullPolicy: IfNotPresent diff --git a/charts/workflows/Chart.yaml b/charts/workflows/Chart.yaml index 17a043e4c..d75a7df28 100644 --- a/charts/workflows/Chart.yaml +++ b/charts/workflows/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: workflows description: Data Analysis workflow orchestration type: application -version: 0.13.55 +version: 0.13.56 dependencies: - name: argo-workflows repository: https://argoproj.github.io/argo-helm diff --git a/charts/workflows/staging-values.yaml b/charts/workflows/staging-values.yaml index ca1d9924e..5d6cc1477 100644 --- a/charts/workflows/staging-values.yaml +++ b/charts/workflows/staging-values.yaml @@ -41,4 +41,8 @@ postgresql-ha: allowTriggerUid: true authenticatedWorkflows: - enabled: true + authDaemon: + enabled: false + envoy: + enabled: false + graphAddress: staging.workflows.diamond.ac.uk diff --git a/charts/workflows/templates/auth-daemon-inject-container-clusterpolicy.yaml b/charts/workflows/templates/auth-daemon-inject-container-clusterpolicy.yaml index 17bbc60b1..e7bcdfd85 100644 --- a/charts/workflows/templates/auth-daemon-inject-container-clusterpolicy.yaml +++ b/charts/workflows/templates/auth-daemon-inject-container-clusterpolicy.yaml @@ -1,4 +1,4 @@ -{{- if .Values.authenticatedWorkflows.enabled }} +{{- if .Values.authenticatedWorkflows.authDaemon.enabled }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml b/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml new file mode 100644 index 000000000..2742c0812 --- /dev/null +++ b/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml @@ -0,0 +1,364 @@ +{{- if .Values.authenticatedWorkflows.envoy.enabled }} +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: {{ .Release.Name }}-inject-envoy-sidecar + annotations: + pod-policies.kyverno.io/autogen-controllers: none +spec: + validationFailureAction: Enforce + background: false + + rules: + - name: inject-envoy-sidecar + match: + any: + - resources: + kinds: + - Pod + operations: + - CREATE + selector: + matchExpressions: + - key: workflows.argoproj.io/workflow + operator: Exists + + preconditions: + all: + - key: "{{ `{{ request.object.metadata.annotations.\"workflows.diamond.ac.uk/authenticated\" || '' }}` }}" + operator: Equals + value: "true" + + - key: '{{ "{{ (request.object.spec.initContainers || `[]`)[?name == ''workflows-auth-init''] | length(@) }}" }}' + operator: Equals + value: 0 + + mutate: + patchStrategicMerge: + spec: + volumes: + - name: workflows-envoy-config + emptyDir: {} + + initContainers: + - name: workflows-auth-init + image: busybox:1.36 + resources: + requests: + cpu: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).cpu | default "25m" }} + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).memory | default "32Mi" }} + limits: + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).limits).memory | default "64Mi" }} + command: + - /bin/sh + - -c + # Configure Envoy Proxy for the following behaviour: + # + # main container + # POST http://127.0.0.1:6000/graphql + # | + # v + # Envoy listener :6000 + # | + # v + # HTTP connection manager + # | + # v + # Lua filter #1 + # reads /var/run/secrets/kubernetes.io/serviceaccount/token + # adds k8s-pod-service-account-token header + # | + # v + # ext_authz filter + # sends authorization check to auth-broker + # includes selected headers and up to 1 MiB request body + # | + # | if denied + # | -> Envoy returns 403 to caller + # | + # | if allowed + # v + # Lua filter #2 + # removes k8s-pod-service-account-token + # | + # v + # Router filter + # forwards request to graph-upstream + # | + # v + # GraphQL server + - | + cat > /etc/envoy/envoy.yaml << 'ENVOYEOF' + static_resources: + listeners: + - name: envoy-local-graph-proxy + address: + socket_address: + address: 0.0.0.0 + port_value: 6000 + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: envoy-local-graph-proxy + codec_type: AUTO + upgrade_configs: + - upgrade_type: websocket + route_config: + name: local_route + virtual_hosts: + - name: graph_backend + domains: + - "*" + routes: + - match: + prefix: "/graphql/ws" + route: + cluster: graph-upstream + timeout: 0s + host_rewrite_literal: {{ .Values.authenticatedWorkflows.envoy.graphAddress | quote }} + upgrade_configs: + - upgrade_type: websocket + enabled: true + typed_per_filter_config: + envoy.filters.http.ext_authz: + "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + disabled: false + - match: + prefix: "/" + route: + cluster: graph-upstream + timeout: 30s + host_rewrite_literal: {{ .Values.authenticatedWorkflows.envoy.graphAddress | quote }} + typed_per_filter_config: + envoy.filters.http.ext_authz: + "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + disabled: false + http_filters: + # Add the Pod service account token to send to auth broker + - name: envoy.filters.http.lua + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua + default_source_code: + inline_string: | + function envoy_on_request(request_handle) + local token_path = "/var/run/secrets/kubernetes.io/serviceaccount/token" + + request_handle:logInfo("lua: reading Kubernetes service account token") + + if io == nil or io.open == nil then + request_handle:logErr("lua: io.open is not available in this Envoy Lua runtime") + return + end + + local ok, file_or_err = pcall(io.open, token_path, "r") + + if not ok then + request_handle:logErr("lua: io.open raised error: " .. tostring(file_or_err)) + return + end + + local f = file_or_err + + if f == nil then + request_handle:logErr("lua: failed to open service account token file: " .. token_path) + return + end + + local token = f:read("*a") + f:close() + + if token == nil or token == "" then + request_handle:logErr("lua: service account token file was empty") + return + end + + token = string.gsub(token, "%s+$", "") + + request_handle:headers():replace( + "k8s-pod-service-account-token", + token + ) + + request_handle:logInfo("lua: added k8s-pod-service-account-token header") + end + + # Request access token from auth-broker + - name: envoy.filters.http.ext_authz + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz + transport_api_version: V3 + + allowed_headers: + patterns: + - exact: "k8s-pod-service-account-token" + - exact: "content-type" + - exact: "authorization" + - exact: "host" + + http_service: + server_uri: + uri: {{ .Values.authenticatedWorkflows.envoy.authBrokerServerUri | quote }} + cluster: auth-broker + timeout: 5s + authorization_response: + allowed_upstream_headers: + patterns: + - exact: "authorization" + + # Remove pod service token so that it is not sent outside the cluster to the GraphQL server + - name: envoy.filters.http.lua + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua + default_source_code: + inline_string: | + function envoy_on_request(request_handle) + request_handle:headers():remove("k8s-pod-service-account-token") + end + + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + + clusters: + - name: graph-upstream + connect_timeout: 5s + type: LOGICAL_DNS + lb_policy: ROUND_ROBIN + load_assignment: + cluster_name: graph-upstream + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: {{ .Values.authenticatedWorkflows.envoy.graphAddress | quote }} + port_value: {{ .Values.authenticatedWorkflows.envoy.graphPort }} + {{- if .Values.authenticatedWorkflows.envoy.tls.enabled }} + transport_socket: + name: envoy.transport_sockets.tls + typed_config: + "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + sni: {{ .Values.authenticatedWorkflows.envoy.graphAddress | quote }} + {{- end }} + + - name: auth-broker + connect_timeout: 5s + type: STRICT_DNS + lb_policy: ROUND_ROBIN + load_assignment: + cluster_name: auth-broker + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: {{ .Values.authenticatedWorkflows.envoy.authBrokerServerSocketAddress | quote }} + port_value: {{ .Values.authenticatedWorkflows.envoy.authBrokerServerSocketPort }} + ENVOYEOF + volumeMounts: + - name: workflows-envoy-config + mountPath: /etc/envoy + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + + - name: workflows-auth-envoy-validate + image: envoyproxy/envoy:distroless-v1.39.0 + resources: + requests: + cpu: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).cpu | default "25m" }} + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).memory | default "32Mi" }} + limits: + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).limits).memory | default "64Mi" }} + command: + - /usr/local/bin/envoy + args: + - --mode + - validate + - -c + - /etc/envoy/envoy.yaml + - --log-level + - info + volumeMounts: + - name: workflows-envoy-config + mountPath: /etc/envoy + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + + - name: workflows-auth-envoy + image: envoyproxy/envoy:distroless-v1.39.0 + resources: + requests: + cpu: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).cpu | default "25m" }} + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).requests).memory | default "32Mi" }} + limits: + memory: {{ ((.Values.authenticatedWorkflows.envoy.resources).limits).memory | default "64Mi" }} + restartPolicy: Always + args: + - "-c" + - "/etc/envoy/envoy.yaml" + - "--log-level" + - "{{ .Values.authenticatedWorkflows.envoy.logLevel | default "warn" }}" + startupProbe: + tcpSocket: + port: 6000 + initialDelaySeconds: 1 + periodSeconds: 1 + failureThreshold: 30 + timeoutSeconds: 1 + volumeMounts: + - name: workflows-envoy-config + mountPath: /etc/envoy + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + + - name: set-graph-url-on-containers + match: + any: + - resources: + kinds: + - Pod + operations: + - CREATE + selector: + matchExpressions: + - key: workflows.argoproj.io/workflow + operator: Exists + + preconditions: + all: + - key: "{{ `{{ request.object.metadata.annotations.\"workflows.diamond.ac.uk/authenticated\" || '' }}` }}" + operator: Equals + value: "true" + + mutate: + foreach: + - list: "request.object.spec.containers" + preconditions: + all: + # do not patch the Argo workflows "wait" container + - key: "{{ "{{ element.name }}" }}" + operator: NotEquals + value: wait + patchStrategicMerge: + spec: + containers: + - (name): "{{ "{{ element.name }}" }}" + env: + - name: GRAPH_URL + value: "http://127.0.0.1:6000/graphql" + - name: GRAPH_URL_WS + value: "http://127.0.0.1:6000/graphql/ws" +{{- end }} \ No newline at end of file diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/chainsaw-test.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/chainsaw-test.yaml new file mode 100644 index 000000000..f687d69f8 --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/chainsaw-test.yaml @@ -0,0 +1,113 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: envoy-authz-service-account-token +spec: + namespace: envoy-authz-chainsaw + timeouts: + cleanup: 90s + delete: 30s + assert: 300s + concurrent: false + steps: + - name: test envoy policy works + try: + - apply: + file: fake-graph.yaml + + - assert: + file: fake-graph.yaml + + - apply: + file: fake-auth-broker.yaml + + - assert: + file: fake-auth-broker.yaml + + - script: + content: | + set -eu + pwd + : "${CHART_DIR:=../../}" + + helm template chainsaw-envoy-auth "$CHART_DIR" \ + --namespace "$NAMESPACE" \ + --values values-chainsaw.yaml \ + | yq 'select(.kind == "ClusterPolicy" and .metadata.name == "chainsaw-envoy-auth-inject-envoy-sidecar")' | kubectl apply -f - + + kubectl wait \ + --for=condition=Ready \ + clusterpolicy/chainsaw-envoy-auth-inject-envoy-sidecar \ + --timeout=60s + + - apply: + file: pod.yaml + + - assert: + file: pod-mutated.yaml + + - assert: + file: pod-succeeded.yaml + + - script: + content: | + set -eu + + echo "Checking fake-auth-broker logs" + + LOGS="$(kubectl logs \ + --namespace "$NAMESPACE" \ + -l app=fake-auth-broker \ + -c fake-auth-broker)" + + echo "$LOGS" | grep -Fq 'TOKEN_PRESENT true' + + - script: + content: | + set -eu + + echo "Checking fake-graph logs" + + LOGS="$(kubectl logs \ + --namespace "$NAMESPACE" \ + -l app=fake-graph \ + -c fake-graph)" + + echo "$LOGS" | grep -Fq 'TOKEN_HAS_AUTH_HEADER true' || { + echo "Expected TOKEN_HAS_AUTH_HEADER true in fake-graph logs" + echo "$LOGS" + exit 1 + } + + echo "$LOGS" | grep -Fq 'TOKEN_LEAKED false' || { + echo "Expected TOKEN_PRESENT false in fake-graph logs" + echo "$LOGS" + exit 1 + } + + catch: + - describe: + apiVersion: v1 + kind: Pod + name: envoy-auth-test + + - podLogs: + name: envoy-auth-test + container: workflows-auth-envoy + + - podLogs: + name: envoy-auth-test + container: main + + - podLogs: + selector: app=fake-auth-broker + container: fake-auth-broker + + - podLogs: + selector: app=fake-graph + container: fake-graph + + finally: + - script: + content: | + kubectl delete clusterpolicy chainsaw-envoy-auth-inject-envoy-sidecar --ignore-not-found diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/fake-auth-broker.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/fake-auth-broker.yaml new file mode 100644 index 000000000..ec95ea008 --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/fake-auth-broker.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: fake-auth-broker +data: + server.py: | + from http.server import BaseHTTPRequestHandler, HTTPServer + + class Handler(BaseHTTPRequestHandler): + def do_POST(self): + token = self.headers.get("k8s-pod-service-account-token") + token_present = bool(token) + print(f"TOKEN_PRESENT {str(token_present).lower()}", flush=True) + + if token_present: + self.send_response(200) + self.send_header("authorization", "Bearer fake-auth-broker-token") + self.end_headers() + self.wfile.write(b"ok") + else: + self.send_response(403) + self.end_headers() + self.wfile.write(b"missing or invalid token") + + HTTPServer(("0.0.0.0", 8080), Handler).serve_forever() +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fake-auth-broker +spec: + replicas: 1 + selector: + matchLabels: + app: fake-auth-broker + template: + metadata: + labels: + app: fake-auth-broker + spec: + terminationGracePeriodSeconds: 1 + containers: + - name: fake-auth-broker + image: python:3.14-alpine + command: + - python + - /app/server.py + ports: + - containerPort: 8080 + volumeMounts: + - name: app + mountPath: /app + volumes: + - name: app + configMap: + name: fake-auth-broker +--- +apiVersion: v1 +kind: Service +metadata: + name: fake-auth-broker +spec: + selector: + app: fake-auth-broker + ports: + - name: http + port: 8080 + targetPort: 8080 diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/fake-graph.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/fake-graph.yaml new file mode 100644 index 000000000..070888161 --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/fake-graph.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: fake-graph +data: + server.py: | + from http.server import BaseHTTPRequestHandler, HTTPServer + + class Handler(BaseHTTPRequestHandler): + def do_POST(self): + has_expected_auth_header = self.headers.get("authorization") == "Bearer fake-auth-broker-token" + print(f"TOKEN_HAS_AUTH_HEADER {str(has_expected_auth_header).lower()}", flush=True) + leaked = self.headers.get("k8s-pod-service-account-token") is not None + print(f"TOKEN_LEAKED {str(leaked).lower()}", flush=True) + + if has_expected_auth_header and not leaked: + body = b'{"data":{"workflowTemplates":{"nodes":[{"name":"mock-template"}]}}}' + self.send_response(200) + self.send_header("content-type", "application/json") + self.send_header("content-length", str(len(body))) + self.end_headers() + self.wfile.write(body) + else: + self.send_response(500) + self.end_headers() + self.wfile.write(b"invalid token or headers") + return + + HTTPServer(("0.0.0.0", 8080), Handler).serve_forever() +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fake-graph +spec: + replicas: 1 + selector: + matchLabels: + app: fake-graph + template: + metadata: + labels: + app: fake-graph + spec: + terminationGracePeriodSeconds: 1 + containers: + - name: fake-graph + image: python:3.14-alpine + command: + - python + - /app/server.py + ports: + - containerPort: 8080 + volumeMounts: + - name: app + mountPath: /app + volumes: + - name: app + configMap: + name: fake-graph +--- +apiVersion: v1 +kind: Service +metadata: + name: fake-graph +spec: + selector: + app: fake-graph + ports: + - name: http + port: 8080 + targetPort: 8080 diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/pod-mutated.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/pod-mutated.yaml new file mode 100644 index 000000000..7e4d32a6e --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/pod-mutated.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Pod +metadata: + name: envoy-auth-test + labels: + workflows.argoproj.io/workflow: envoy-auth-test + annotations: + workflows.diamond.ac.uk/authenticated: "true" + +spec: + initContainers: + - name: "workflows-auth-init" + - name: "workflows-auth-envoy-validate" + - name: "workflows-auth-envoy" + + containers: + - name: main + env: + - name: GRAPH_URL + value: "http://127.0.0.1:6000/graphql" + - name: GRAPH_URL_WS + value: "http://127.0.0.1:6000/graphql/ws" diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/pod-succeeded.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/pod-succeeded.yaml new file mode 100644 index 000000000..1bde90a11 --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/pod-succeeded.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Pod +metadata: + name: envoy-auth-test +status: + phase: Succeeded diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/pod.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/pod.yaml new file mode 100644 index 000000000..edd53e7d4 --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/pod.yaml @@ -0,0 +1,37 @@ +apiVersion: v1 +kind: Pod +metadata: + name: envoy-auth-test + labels: + workflows.argoproj.io/workflow: envoy-auth-test + annotations: + workflows.diamond.ac.uk/authenticated: "true" +spec: + restartPolicy: Never + terminationGracePeriodSeconds: 1 + + containers: + - name: main + image: curlimages/curl:8.12.1 + command: + - sh + - -c + args: + - | + set -eu + + echo "GRAPH_URL=${GRAPH_URL}" + + RESPONSE="$(curl -v \ + --fail \ + --silent \ + --show-error \ + --connect-timeout 5 \ + -X POST \ + "${GRAPH_URL}" \ + -H 'Content-Type: application/json' \ + --data '{"query":"query WorkflowTemplates { workflowTemplates { nodes { name } } }"}')" + + echo "${RESPONSE}" + + echo "${RESPONSE}" | grep -q '"workflowTemplates"' diff --git a/charts/workflows/test-policy/inject-envoy-sidecar/values-chainsaw.yaml b/charts/workflows/test-policy/inject-envoy-sidecar/values-chainsaw.yaml new file mode 100644 index 000000000..39d38ba5b --- /dev/null +++ b/charts/workflows/test-policy/inject-envoy-sidecar/values-chainsaw.yaml @@ -0,0 +1,13 @@ +authenticatedWorkflows: + authDaemon: + enabled: false + envoy: + enabled: true + authBrokerServerUri: http://fake-auth-broker.envoy-authz-chainsaw.svc.cluster.local:8080 + authBrokerServerSocketAddress: fake-auth-broker.envoy-authz-chainsaw.svc.cluster.local + authBrokerServerSocketPort: 8080 + graphAddress: fake-graph.envoy-authz-chainsaw.svc.cluster.local + graphPort: 8080 + tls: + enabled: false + logLevel: warn diff --git a/charts/workflows/values.yaml b/charts/workflows/values.yaml index 319c28d48..f4bf75099 100644 --- a/charts/workflows/values.yaml +++ b/charts/workflows/values.yaml @@ -277,6 +277,20 @@ s3mock: allowTriggerUid: false authenticatedWorkflows: + # Enable auth-daemon based authentication method # TODO: switch on these chainsaw tests when switching this to true # charts/workflows/test-policy/authdaemon/chainsaw-test.yaml - enabled: false + authDaemon: + enabled: false + # Enables auth-broker + Envoy sidecar injection + # Requires the auth-broker service to be deployed in the auth-broker namespace + envoy: + enabled: false + authBrokerServerUri: http://auth-broker.auth-broker.svc.cluster.local:8080 + authBrokerServerSocketAddress: auth-broker.auth-broker.svc.cluster.local + authBrokerServerSocketPort: 8080 + graphAddress: graph.diamond.ac.uk + graphPort: 443 + tls: + enabled: true + logLevel: warn