awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-16 05:13:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update k8s auth impl to be able to test ca, tokenReviewerjwt locally

Browse Source
This commit is contained in:
Tuan Dang
2024-05-14 11:42:26 -07:00
parent c45dae4137
commit cd910a2fac
12 changed files with 598 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/hooks/api/identities/constants.tsx
+2 -1
View File
@@ -2,5 +2,6 @@ import { IdentityAuthMethod } from "./enums";
export const identityAuthToNameMap: { [I in IdentityAuthMethod]: string } = {
[IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth",
[IdentityAuthMethod.AWS_AUTH]: "AWS Auth"
[IdentityAuthMethod.AWS_AUTH]: "AWS Auth",
[IdentityAuthMethod.KUBERNETES_AUTH]: "Kubernetes Auth"
};
frontend/src/hooks/api/identities/enums.tsx
+2 -1
View File
@@ -1,4 +1,5 @@
export enum IdentityAuthMethod {
UNIVERSAL_AUTH = "universal-auth",
AWS_AUTH = "aws-auth"
AWS_AUTH = "aws-auth",
KUBERNETES_AUTH = "kubernetes-auth"
}
frontend/src/hooks/api/identities/index.tsx
+4 -2
View File
@@ -2,6 +2,7 @@ export { identityAuthToNameMap } from "./constants";
export { IdentityAuthMethod } from "./enums";
export {
useAddIdentityAwsAuth,
useAddIdentityKubernetesAuth,
useAddIdentityUniversalAuth,
useCreateIdentity,
useCreateIdentityUniversalAuthClientSecret,
@@ -9,10 +10,11 @@ export {
useRevokeIdentityUniversalAuthClientSecret,
useUpdateIdentity,
useUpdateIdentityAwsAuth,
useUpdateIdentityUniversalAuth
} from "./mutations";
useUpdateIdentityKubernetesAuth,
useUpdateIdentityUniversalAuth} from "./mutations";
export {
useGetIdentityAwsAuth,
useGetIdentityKubernetesAuth,
useGetIdentityUniversalAuth,
useGetIdentityUniversalAuthClientSecrets
} from "./queries";
frontend/src/hooks/api/identities/mutations.tsx
+89 -2
View File
@@ -6,6 +6,7 @@ import { organizationKeys } from "../organization/queries";
import { identitiesKeys } from "./queries";
import {
AddIdentityAwsAuthDTO,
AddIdentityKubernetesAuthDTO,
AddIdentityUniversalAuthDTO,
ClientSecretData,
CreateIdentityDTO,
@@ -15,11 +16,12 @@ import {
DeleteIdentityUniversalAuthClientSecretDTO,
Identity,
IdentityAwsAuth,
IdentityKubernetesAuth,
IdentityUniversalAuth,
UpdateIdentityAwsAuthDTO,
UpdateIdentityDTO,
UpdateIdentityUniversalAuthDTO
} from "./types";
UpdateIdentityKubernetesAuthDTO,
UpdateIdentityUniversalAuthDTO} from "./types";
export const useCreateIdentity = () => {
const queryClient = useQueryClient();
@@ -243,3 +245,88 @@ export const useUpdateIdentityAwsAuth = () => {
}
});
};
// --- K8s auth (TODO: add cert and token reviewer JWT fields)
export const useAddIdentityKubernetesAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityKubernetesAuth, {}, AddIdentityKubernetesAuthDTO>({
mutationFn: async ({
identityId,
kubernetesHost,
tokenReviewerJwt,
allowedNames,
allowedNamespaces,
allowedAudience,
caCert,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}) => {
const {
data: { identityKubernetesAuth }
} = await apiRequest.post<{ identityKubernetesAuth: IdentityKubernetesAuth }>(
`/api/v1/auth/kubernetes-auth/identities/${identityId}`,
{
kubernetesHost,
tokenReviewerJwt,
allowedNames,
allowedNamespaces,
allowedAudience,
caCert,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}
);
return identityKubernetesAuth;
},
onSuccess: (_, { organizationId }) => {
queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
}
});
};
export const useUpdateIdentityKubernetesAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityKubernetesAuth, {}, UpdateIdentityKubernetesAuthDTO>({
mutationFn: async ({
identityId,
kubernetesHost,
tokenReviewerJwt,
allowedNamespaces,
allowedNames,
allowedAudience,
caCert,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}) => {
const {
data: { identityKubernetesAuth }
} = await apiRequest.patch<{ identityKubernetesAuth: IdentityKubernetesAuth }>(
`/api/v1/auth/kubernetes-auth/identities/${identityId}`,
{
kubernetesHost,
tokenReviewerJwt,
allowedNames,
allowedNamespaces,
allowedAudience,
caCert,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}
);
return identityKubernetesAuth;
},
onSuccess: (_, { organizationId }) => {
queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
}
});
};
frontend/src/hooks/api/identities/queries.tsx
+23 -2
View File
@@ -2,14 +2,20 @@ import { useQuery } from "@tanstack/react-query";
import { apiRequest } from "@app/config/request";
import { ClientSecretData, IdentityAwsAuth, IdentityUniversalAuth } from "./types";
import {
ClientSecretData,
IdentityAwsAuth,
IdentityKubernetesAuth,
IdentityUniversalAuth} from "./types";
export const identitiesKeys = {
getIdentityUniversalAuth: (identityId: string) =>
[{ identityId }, "identity-universal-auth"] as const,
getIdentityUniversalAuthClientSecrets: (identityId: string) =>
[{ identityId }, "identity-universal-auth-client-secrets"] as const,
getIdentityAwsAuth: (identityId: string) => [{ identityId }, "identity-aws-auth"] as const
getIdentityAwsAuth: (identityId: string) => [{ identityId }, "identity-aws-auth"] as const,
getIdentityKubernetesAuth: (identityId: string) =>
[{ identityId }, "identity-kubernetes-auth"] as const
};
export const useGetIdentityUniversalAuth = (identityId: string) => {
@@ -56,3 +62,18 @@ export const useGetIdentityAwsAuth = (identityId: string) => {
}
});
};
export const useGetIdentityKubernetesAuth = (identityId: string) => {
return useQuery({
enabled: Boolean(identityId),
queryKey: identitiesKeys.getIdentityKubernetesAuth(identityId),
queryFn: async () => {
const {
data: { identityKubernetesAuth }
} = await apiRequest.get<{ identityKubernetesAuth: IdentityKubernetesAuth }>(
`/api/v1/auth/kubernetes-auth/identities/${identityId}`
);
return identityKubernetesAuth;
}
});
};
frontend/src/hooks/api/identities/types.ts
+48
View File
@@ -153,6 +153,54 @@ export type UpdateIdentityAwsAuthDTO = {
}[];
};
export type IdentityKubernetesAuth = {
identityId: string;
kubernetesHost: string;
tokenReviewerJwt: string;
allowedNamespaces: string;
allowedNames: string;
allowedAudience: string;
caCert: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
accessTokenNumUsesLimit: number;
accessTokenTrustedIps: IdentityTrustedIp[];
};
export type AddIdentityKubernetesAuthDTO = {
organizationId: string;
identityId: string;
kubernetesHost: string;
tokenReviewerJwt: string;
allowedNamespaces: string;
allowedNames: string;
allowedAudience: string;
caCert: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
accessTokenNumUsesLimit: number;
accessTokenTrustedIps: {
ipAddress: string;
}[];
};
export type UpdateIdentityKubernetesAuthDTO = {
organizationId: string;
identityId: string;
kubernetesHost?: string;
tokenReviewerJwt?: string;
allowedNamespaces?: string;
allowedNames?: string;
allowedAudience?: string;
caCert?: string;
accessTokenTTL?: number;
accessTokenMaxTTL?: number;
accessTokenNumUsesLimit?: number;
accessTokenTrustedIps?: {
ipAddress: string;
}[];
};
export type CreateIdentityUniversalAuthClientSecretDTO = {
identityId: string;
description?: string;