🚀(redis) add Redis instance to dev and staging

Necessary to support more that one SATOSA worker.
2024-04-29 22:28:18 +02:00
parent b50126675a
commit 78a1b549fc
12 changed files with 75 additions and 12 deletions
@@ -118,7 +118,7 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 	bin/pylint --diff-only=origin/main
 .PHONY: lint-pylint

-test: ## run project tests
+test: run ## run project tests
 	@$(MAKE) test-back
 .PHONY: test

@@ -6,7 +6,7 @@ docker_build(
    'localhost:5001/oidc2fer:latest',
    context='.',
    dockerfile='./Dockerfile',
-    only=['./src/satosa', './docker'],
+    only=['./src/satosa', './docker', './env.d'],
    target = 'development',
    live_update=[
        sync('./src/satosa', '/app'),
@@ -10,6 +10,10 @@ services:
    environment:
      PYLINTHOME: /app/.pylint.d
      BASE_URL: https://satosa.traefik.me
+      GUNICORN_CMD_ARGS: --workers=2
+      TEST_E2E: 1
+      #TEST_E2E_AC: 1
+      OIDC_DB_URI: redis://redis/0
      CLIENT_DB_JSON: |
        {
          "oidc-test-client": {
@@ -29,6 +33,8 @@ services:
      - env.d/development/satosa
    volumes:
      - ./src/satosa:/app
+    depends_on:
+      - redis

  oidc-test-client:
    build: docker/oidc-test-client
@@ -51,10 +57,16 @@ services:
    environment:
      OIDC_ROOT_URL: https://oidc-test-client.traefik.me
      OIDC_PROVIDER: https://satosa.traefik.me
+      #OIDC_PROVIDER: https://oidc2fer.127.0.0.1.nip.io
      #OIDC_PROVIDER: https://oidc2fer-staging.beta.numerique.gouv.fr
      OIDC_CLIENT_ID: oidc-test-client
      OIDC_CLIENT_SECRET: oidc-test-secret
      OIDC_SCOPES: openid,uid,given_name,usual_name,email
+    extra_hosts:
+      - "oidc2fer.127.0.0.1.nip.io:host-gateway"
+
+  redis:
+    image: redis:7.2.4

  nginx:
    image: nginx:1.25
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 #
 # The container user (see USER in the Dockerfile) is an un-privileged user that
 # does not exists and is not created during the build phase (see Dockerfile).
@@ -39,5 +39,11 @@ printenv SAML2_BACKEND_KEY > /tmp/backend.key
 printenv OIDC_FRONTEND_KEY > /tmp/frontend.key
 printenv CLIENT_DB_JSON > /tmp/client_db.json

+# Redis database number must be specified
+if [[ ! $OIDC_DB_URI =~ /[0-9]+$ ]]; then
+    echo "🐳(entrypoint) adding db id to OIDC_DB_URI"
+    export OIDC_DB_URI=$OIDC_DB_URI/0
+fi
+
 echo "🐳(entrypoint) running your command: ${*}"
 exec "$@"
@@ -28,7 +28,7 @@ app.config.update(

 client = Client(client_authn_method=CLIENT_AUTHN_METHOD)

-provider_info = client.provider_config("https://satosa.traefik.me")
+provider_info = client.provider_config(os.environ["OIDC_PROVIDER"])

 info = {
    "client_id": os.environ["OIDC_CLIENT_ID"],
@@ -4,10 +4,10 @@ image:
  tag: "latest"

 satosa:
-  replicas: 1
+  replicas: 2
  envVars:
    BASE_URL: https://oidc2fer.127.0.0.1.nip.io
-    GUNICORN_CMD_ARGS: --workers=1
+    GUNICORN_CMD_ARGS: --workers=3
    CLIENT_DB_JSON: |-
      {
        "oidc-test-client": {
@@ -16,14 +16,17 @@ satosa:
            "code"
          ],
          "redirect_uris": [
-            "https://oidc-test-client.traefik.me:8443/auth/callback"
+            "https://oidc-test-client.traefik.me/redirect_uri",
+            "https://oidc-test-client.traefik.me:8443/redirect_uri"
          ],
-          "client_secret": "oidc-test-secret"
+          "client_secret": "oidc-test-secret",
+          "token_endpoint_auth_method": "client_secret_post"
        }
      }
    SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
    SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
    OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
+    OIDC_DB_URI: "redis://:pass@redis-master:6379"
    STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"

 ingress:
@@ -4,13 +4,17 @@ image:
  tag: "pr-8"

 satosa:
-  replicas: 1
+  replicas: 2
  envVars:
    BASE_URL: https://oidc2fer-staging.beta.numerique.gouv.fr
-    GUNICORN_CMD_ARGS: --workers=1
+    GUNICORN_CMD_ARGS: --workers=3
    SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
    SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
    OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
+    OIDC_DB_URI:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
    STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"
    CLIENT_DB_JSON: {{ .Values.CLIENT_DB_JSON | toYaml | indent 8 }}

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: extra
+description: A Helm chart to add some manifests to oidc2fer
+type: application
+version: 0.1.0
@@ -0,0 +1,7 @@
+apiVersion: core.libre.sh/v1alpha1
+kind: Redis
+metadata:
+  name: redis
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  disableAuth: false
@@ -1,4 +1,24 @@
+repositories:
+- name: bitnami
+  url: registry-1.docker.io/bitnamicharts
+  oci: true
+
 releases:
+  - name: redis
+    installed: {{ eq .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: bitnami/redis
+    version: 18.19.2
+    values:
+      - auth:
+          password: pass
+        architecture: standalone
+
+  - name: extra
+    installed: {{ ne .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: ./extra
+
  - name: oidc2fer
    version: 0.0.1 # {{ .Values.version }}
    namespace: {{ .Namespace }}
@@ -19,7 +19,7 @@ config:
  #
  # This configuration is optional.
  # By default, the in-memory storage is used.
-  # db_uri: mongodb://db.example.com
+  db_uri: !ENV OIDC_DB_URI

  # Where to store clients.
  #
@@ -43,7 +43,12 @@ config:
      - uid
      - given_name
      - usual_name
-    id_token_lifetime: 3600
+
+    # Set code/token lifetimes as short as possible
+    authorization_code_lifetime: 60
+    access_token_lifetime: 60
+    id_token_lifetime: 60
+
    extra_scopes:
      uid:
      - uid
@@ -25,6 +25,7 @@ requires-python = ">=3.11"
 dependencies = [
    "SATOSA==8.4.0",
    "gunicorn==22.0.0",
+    "redis==5.0.4",
 ]

 [project.urls]