{"id":17604301,"url":"https://github.com/mintel/dex-k8s-ingress-watcher","last_synced_at":"2025-04-30T10:09:34.076Z","repository":{"id":41986489,"uuid":"142129541","full_name":"mintel/dex-k8s-ingress-watcher","owner":"mintel","description":"Monitor kubernetes ingresses and modify the staticClients list in Dex dynamically","archived":false,"fork":false,"pushed_at":"2022-04-20T12:45:49.000Z","size":5619,"stargazers_count":5,"open_issues_count":1,"forks_count":4,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-02-25T06:43:27.785Z","etag":null,"topics":["authentication","dex","grpc","ingress","kubernetes","staticclients"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mintel.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-07-24T08:35:14.000Z","updated_at":"2024-01-31T09:30:55.000Z","dependencies_parsed_at":"2022-08-12T01:30:46.062Z","dependency_job_id":null,"html_url":"https://github.com/mintel/dex-k8s-ingress-watcher","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mintel%2Fdex-k8s-ingress-watcher","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mintel%2Fdex-k8s-ingress-watcher/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mintel%2Fdex-k8s-ingress-watcher/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mintel%2Fdex-k8s-ingress-watcher/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mintel","download_url":"https://codeload.github.com/mintel/dex-k8s-ingress-watcher/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242635331,"owners_count":20161437,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","dex","grpc","ingress","kubernetes","staticclients"],"created_at":"2024-10-22T14:08:45.867Z","updated_at":"2025-03-09T02:30:41.966Z","avatar_url":"https://github.com/mintel.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview\n\nIt's fairly common to deploy internal services in clusters which are exposed via an Ingress. They can typically be authenticated via Dex, but the process of adding new `staticClients` is a manual one.\n\nThis is a helper tool to automatically configure `staticClient` entries in [CoreOS Dex](https://github.com/dexidp/dex).\n\nIt does this by running *in-cluster*, and monitoring for annotations on Ingress, ConfigMap or Secret resources.\n\nThe annotations on the resources define attributes of the `staticClient`, and modifications are made to Dex via gRPC.\n\nBy default only the `Ingress` resources are watched - this is the most common pattern. Optionally `ConfigMap` and/or `Secret` resources can be monitored.\n\nThe use of a `Secret` can also be useful since you can keep the `staticClient` `client-secret` truely secret, at least if you are using something like [SealedSecrets](https://github.com/bitnami-labs/sealed-secrets).\n\n## Building\n\n```\nmake build\n```\n\n## Running\n\nThe application supports being run in, and out of cluster.\n\nIf run outside of a cluster, it will look for `$HOME/.kube/config`\n\n### Examples\n\n_default with only ingress watcher_\n```\n./bin/dex-k8s-ingress-watcher serve --dex-grpc-address localhost:5557                      \n```\n\n_with configmap and secret watcher_\n```\n./bin/dex-k8s-ingress-watcher serve --dex-grpc-address --ingress-controller --configmap-controller --secret-controller localhost:5557\n```\n\n_disable ingress watcher_\n```\n./bin/dex-k8s-ingress-watcher serve --dex-grpc-address --no-ingress-controller --configmap-controller --secret-controller localhost:5557\n```\n\n### RBAC Notes\n\nThe clusterrole in the [example deployment directory](https://github.com/mintel/dex-k8s-ingress-watcher/blob/master/hack/deployment/clusterrole.yaml) is configured to support all controllers _( Ingress, ConfigMaps and Secrets )_\n\nMake sure to remove the ones that you don't plan to use to limit access to those resources if not required, this is particularly true for _Secrets_\n\n# Resource Configuration\n\n`dex-k8s-ingress-watcher` monitors for the creation and deletion of Ingress, ConfigMap and Secrets events\nin your kubernetes cluster.\n\n* all **Ingresses** in **all-namespaces** are watched , if the required annotations are present in the resource then the _Dex client_ is created/deleted\n* **ConfigMap** and **Secrets** in **all-namespaces** are watched only if they have a **specific label** applied to them, if the required annotations are present in the resource then the _Dex client_ is created/deleted\u003cbr\u003e\n  _mintel.com/dex-k8s-ingress-watcher: enabled_\u003cbr\u003e\n\tThis is done to avoid watching a big number of secrets / configmaps where only a very small subset will be used\n\nThe event-handlers check for specific annotations, which are used to pass on information\nrelated to the creation of `staticClient` entries in Dex via gRPC.\n\n## Annotations\n\nAnnotations are the same for every type of resource\n\n```\napiVersion: extensions/v1beta1\nkind: Ingress\nmetadata:\n  annotations:\n    mintel.com/dex-k8s-ingress-watcher-client-id: my-app\n    mintel.com/dex-k8s-ingress-watcher-client-name: My Application\n    mintel.com/dex-k8s-ingress-watcher-secret: a-secret\n    mintel.com/dex-k8s-ingress-watcher-redirect-uri: https://myapp.example.com/oauth/callback\n```\n\nSuch an annotation would generate in Dex the following `staticClient`\n\n```\nstaticClients:\n- id: my-app\n  name: My Application\n  secret: a-secret\n  redirectURIs:\n  - 'https://myapp.example.com/oauth/callback'\n```\n\nNote that `mintel.com/dex-k8s-ingress-watcher-client-name` is optional ( default to the same as _client-id_) , and the rest are required.\n\nMultiple Redirect-uris can be set using a _comma separated_ string\n```\nmintel.com/dex-k8s-ingress-watcher-redirect-uri: https://myapp.example.com/oauth/callback,https://myapp.example.com/oauth/callbackV2\n```\n\n## Running in Kubernetes\n\nExample manifests can be found in the [deployment directory](https://github.com/mintel/dex-k8s-ingress-watcher/blob/master/hack/deployment/).\n\n**These are not production ready**\n* They do not run Dex on SSL\n* They grant access to the serviceaccount to all configmaps and secrets on the cluster (this may not be what you want).\n\nWe run this application as a sidecar to Dex itself - that way it can talk over gRPC via localhost.\n\nIn this example, Dex is running on `127.0.0.1` with gRPC exposed on port `5557`.\n\n### Example sidecar configuration:\n\n```\n  - name: dex-k8s-ingress-watcher\n    command:\n    - /app/bin/dex-k8s-ingress-watcher\n    - serve\n    - --incluster\n    - --ingress-controller\n    - --configmap-controller\n    - --secret-controller\n    - --dex-grpc-address\n    - 127.0.0.1:5557\n    image: mintel/dex-k8s-ingress-watcher:latest\n    imagePullPolicy: IfNotPresent\n    resources:\n      limits:\n        cpu: 50m\n        memory: 64Mi\n      requests:\n        cpu: 20m\n        memory: 32Mi\n```\n\n## Authenticated client application configuration\n\nAn application wishing to authenticate via Dex can typically run an OpenID proxy service as a\nsidecar container.\n\nA good example is [keycloak-proxy](https://github.com/gambol99/keycloak-proxy)\n\nExample sidecar configuration:\n\n```\n- name: proxy\n  image: quay.io/gambol99/keycloak-proxy:v2.1.1\n  imagePullPolicy: Always\n  resources:\n    limits:\n      cpu: 100m\n      memory: 128Mi \n    requests:\n      cpu: 50m\n      memory: 64Mi\n  args:\n    - --verbose=true\n    - --listen=:3000\n    - --upstream-url=http://0.0.0.0:8000\n    - --discovery-url=https://dex.example.com/.well-known/openid-configuration\n    - --client-id=my-app\n    - --skip-upstream-tls-verify\n    - --redirection-url=https://myapp.example.com\n    - --secure-cookie=false\n    - --client-secret=a-secret\n    - --enable-authorization-header\n    - --skip-openid-provider-tls-verify\n    - --add-claims=groups\n    - --scopes=groups\n    - --add-claims=groups\n    - --resources=uri=/*\n```\n\nKey points to note:\n- Your Ingress and Service must point at the keycloak proxy port, i.e `3000` in this example\n- Proxy has an `upstream-url` which is the application you want to product (running on same host, different port)\n- `client-secret` must match the `mintel.com/dex-k8s-ingress-watcher-secret` annotation\n- `client-id` must match the `mintel.com/dex-k8s-ingress-watcher-client-id` annotation\n- `keycloak` lets you protect by `resources=uri` option, restricting by groups returned by Dex if required\n\nMay want to look at injecting this automatically oneday using k8s webhooks:\n\n- https://github.com/istio/istio/tree/master/pilot/pkg/kube/inject\n\n\n# TODO\n\n- This should really be a CRD.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmintel%2Fdex-k8s-ingress-watcher","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmintel%2Fdex-k8s-ingress-watcher","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmintel%2Fdex-k8s-ingress-watcher/lists"}