diff --git a/pkg/auth/sso/casdoor.go b/pkg/auth/sso/casdoor.go index 287bcd853..03487105f 100644 --- a/pkg/auth/sso/casdoor.go +++ b/pkg/auth/sso/casdoor.go @@ -129,7 +129,7 @@ func NewCasdoorClient() (*CasdoorClient, error) { Application: "service-auth", CallbackURL: conf.GlobalConfig.CallbackURL, } - if conf.GlobalConfig.Kubeconfig != "" { + if conf.GlobalConfig.SSOEndpoint != "" { client.Endpoint = conf.GlobalConfig.SSOEndpoint } diff --git a/pkg/auth/utils/cors.go b/pkg/utils/httpserver/cors.go similarity index 98% rename from pkg/auth/utils/cors.go rename to pkg/utils/httpserver/cors.go index 25c593444..6005af0d0 100644 --- a/pkg/auth/utils/cors.go +++ b/pkg/utils/httpserver/cors.go @@ -12,7 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. -package utils +package httpserver import "github.com/emicklei/go-restful" diff --git a/pkg/utils/httpserver/go_restful.go b/pkg/utils/httpserver/go_restful.go index f0bc75977..ca1634ea3 100644 --- a/pkg/utils/httpserver/go_restful.go +++ b/pkg/utils/httpserver/go_restful.go @@ -18,7 +18,6 @@ import ( "net/http" "github.com/emicklei/go-restful" - "github.com/labring/sealos/pkg/auth/utils" "github.com/labring/sealos/pkg/utils/logger" ) @@ -32,7 +31,7 @@ func GoRestful(registerFunc func(*restful.WebService), addr string) error { container.Add(webService) //cors - utils.Cors(container) + Cors(container) server := &http.Server{Addr: addr, Handler: container} logger.Info("start listening on addr", addr) diff --git a/service/auth/.gitignore b/service/auth/.gitignore index da8471b46..13c93a410 100644 --- a/service/auth/.gitignore +++ b/service/auth/.gitignore @@ -1 +1,2 @@ -conf/auth.yaml \ No newline at end of file +conf/auth.yaml +service-auth \ No newline at end of file diff --git a/service/auth/Dockerfile b/service/auth/Dockerfile index 673e90443..d8676d876 100644 --- a/service/auth/Dockerfile +++ b/service/auth/Dockerfile @@ -12,35 +12,11 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Build the manager binary -FROM golang:1.18 as builder - -ENV GO111MODULE=on \ - GOPROXY=https://goproxy.cn,direct - -WORKDIR /workspace -# Copy the Go Modules manifests -COPY go.mod go.mod -COPY go.sum go.sum -#TODO: 1. Copy parent repo code to let build run -#TODO: 2. make build binary from parent makefile. -# cache deps before building and copying source so that we don't need to re-download as much -# and so that source changes don't invalidate our downloaded layer -RUN go mod download - -# Copy the go source -COPY main.go main.go -COPY api/ api/ -COPY conf/ conf/ - -# Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -o service-auth main.go - # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details FROM gcr.io/distroless/static:nonroot WORKDIR / -COPY --from=builder= /workspace/service-auth . +COPY /workspace/service-auth . USER 65532:65532 ENTRYPOINT ["/service-auth", "-config", "/auth.yaml"] \ No newline at end of file diff --git a/service/auth/Makefile b/service/auth/Makefile index 74875def7..5b12f932d 100644 --- a/service/auth/Makefile +++ b/service/auth/Makefile @@ -1,6 +1,7 @@ +SERVICE_NAME=service-auth # Image URL to use all building/pushing image targets -IMG ?= service-auth:latest +IMG ?= $(SERVICE_NAME):latest # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set) ifeq (,$(shell go env GOBIN)) @@ -9,11 +10,13 @@ else GOBIN=$(shell go env GOBIN) endif -# Setting SHELL to bash allows bash commands to be executed by recipes. -# This is a requirement for 'setup-envtest.sh' in the test target. -# Options are set to exit when a recipe line exits non-zero or a piped command fails. -SHELL = /usr/bin/env bash -o pipefail -.SHELLFLAGS = -ec +# only support linux, non cgo +PLATFORMS ?= linux_arm64 linux_amd64 +GOOS=linux +CGO_ENABLED=0 +GOARCH=$(shell go env GOARCH) + +GO_BUILD_FLAGS=-trimpath -ldflags "-s -w" .PHONY: all all: build @@ -37,30 +40,28 @@ help: ## Display this help. ##@ Build +.PHONY: clean +clean: + rm -f $(SERVICE_NAME) + .PHONY: build -build: ## Build manager binary. - go build -o bin/manager main.go +build: clean ## Build service-auth binary. + CGO_ENABLED=$(CGO_ENABLED) GOOS=$(GOOS) GOARCH=$(ARCH) go build $(GO_BUILD_FLAGS) -o $(SERVICE_NAME) main.go .PHONY: run -run: ## Run a controller from your host. - go run ./main.go +run: ## Run a dev service from host. + go run ./main.go -conf ./conf/auth.yml .PHONY: docker-build -docker-build: test ## Build docker image with the manager. - docker build -t ${IMG} . - -.PHONY: docker-push -docker-push: ## Push docker image with the manager. - docker push localhost:5000/${IMG} +docker-build: ## Build docker image with the service-auth. + sudo docker build -t $(IMG) . ##@ Deployment -ifndef ignore-not-found - ignore-not-found = false -endif - -.PHONY: install -install: ## Install CRDs into the K8s cluster specified in ~/.kube/config. - sealos run +.PHONY: docker-push +docker-push: ## Push docker image. + echo "To be done." +#TODO: add support of docker push +#TODO: add support of sealos apply diff --git a/service/auth/README.md b/service/auth/README.md index 946607f78..91e0b3d73 100644 --- a/service/auth/README.md +++ b/service/auth/README.md @@ -8,18 +8,77 @@ Users can easily add oauth2 providers to login. ## Start -@see: depoy Kubefile +### Step by step installation and run +1. A Running `sealos kubernetes` cluster with admin access. + ```shell + sealos run labring/kubernetes:v1.24.0 labring/calico:v3.22.1 --masters xxx --nodes xxx -p/-pk + ``` +2. Cluster must have `helm` and `openebs` installed as base requirement. + ```shell + sealos run labring/helm:v3.8.2 + sealos run labring/openebs:v1.9.0 + ``` +3. Apply auth's requirement: `casdoor.yaml` + ```shell + kubectl apply -f pkg/auth/conf/casdoor.yaml + ``` +4. Apply auth's service `auth.yaml`, *must change 3rd login types and keys.* + ```shell + kubectl apply -f deploy/manifests/auth.yaml + ``` +5. Open browser head to `http://ip*:30007/login` ## UML Graph -// TODO: Add UML graph +```mermaid +sequenceDiagram + participant uf as User/Frontend + participant sa as Service-Auth + participant caf as Casdoor/Frontend + participant ca as Casdoor + participant op as OAuth-Provider + uf->>sa: click login button|redirect + sa->>ca: request login page|redirect + ca->>ca: check all oauth providers config + ca->>caf: show login page + par password login + caf->>ca: input username and password + ca->>caf: redirect page with code&state + and oauth login + caf->>ca: do oauth login + ca->>op: redirect to oauth provider's page + op->>caf: redirect to casdoor's page + ca->>caf: redirect page with code&state + end + caf->>uf: redirect login page with code&state + uf->>sa: request `kubeconfig` using code&state + sa->>ca: request user_info by code&state + ca->>sa: response user_info + sa->>sa: generate `kubeconfig` + sa->>uf: response kubeconfig +``` +## Development -## Devolpment +1. `service/auth` is the entry point for api service, any routes and config check should be done here. +2. `pkg/auth` is the base implementing of auth service. + 1. It's duty to start all auth service's internal needed backend, like `mysql`,`openebs`,`casdoor` etc. + 2. It should provide sdk access to auth service and manage all information up to date, not aware of api calls and/or sdk calls. -// TODO: Add pre-requirements and runtime dependencies. +Since the `go.work` workspace structure, currently we cannot build docker under `service/auth` dir, so we build binary using makefile and then package it to docker image. +### Troubleshooting + +1. Callback urls cannot auto update at mysql db level. + +## RoadMap + +1. Combine service-auth with cluster images like below: + ```shell + sealos apply -f deploy/Kubefile + ``` +2. Add support for more third-party login methods ## License