Skip to content

Commit 09cb77d

Browse files
easyCZeasyCZ
committed
[openfga] Deploy when experimental.webapp.openfga.enabled is true
1 parent 2e04733 commit 09cb77d

File tree

8 files changed

+231
-0
lines changed

8 files changed

+231
-0
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
/install/installer/pkg/components/proxy @gitpod-io/engineering-webapp
5252
/install/installer/pkg/components/refresh-credential @gitpod-io/engineering-workspace
5353
/install/installer/pkg/components/registry-facade @gitpod-io/engineering-workspace
54+
/install/installer/pkg/components/openfga @gitpod-io/engineering-webapp
5455
/install/installer/pkg/components/public-api-server @gitpod-io/engineering-webapp
5556
/install/installer/pkg/components/iam @gitpod-io/engineering-webapp
5657
/install/installer/pkg/components/iam-api @gitpod-io/engineering-webapp

‎dev/preview/workflow/preview/deploy-gitpod.sh

+5
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,11 @@ yq w -i "${INSTALLER_CONFIG_PATH}" "experimental.webapp.server.stripeConfig" "st
450450
# IAM
451451
#
452452

453+
#
454+
# OpenFGA
455+
#
456+
yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.openfga.enabled "true"
457+
453458
# copy secret from werft's space
454459
kubectl --kubeconfig "${DEV_KUBE_PATH}" --context "${DEV_KUBE_CONTEXT}" -n werft get secret preview-envs-oidc-clients-config-secret -o yaml > preview-envs-oidc-clients-config-secret.secret.yaml
455460
yq d -i preview-envs-oidc-clients-config-secret.secret.yaml metadata.name

‎install/installer/pkg/components/components-webapp/components.go

+2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"github.com/gitpod-io/gitpod/installer/pkg/components/iam"
1313
"github.com/gitpod-io/gitpod/installer/pkg/components/migrations"
1414
"github.com/gitpod-io/gitpod/installer/pkg/components/minio"
15+
"github.com/gitpod-io/gitpod/installer/pkg/components/openfga"
1516
"github.com/gitpod-io/gitpod/installer/pkg/components/proxy"
1617
public_api_server "github.com/gitpod-io/gitpod/installer/pkg/components/public-api-server"
1718
"github.com/gitpod-io/gitpod/installer/pkg/components/rabbitmq"
@@ -37,6 +38,7 @@ var Objects = common.CompositeRenderFunc(
3738
public_api_server.Objects,
3839
usage.Objects,
3940
toxiproxy.Objects,
41+
openfga.Objects,
4042
)
4143

4244
var Helm = common.CompositeHelmFunc(

‎install/installer/pkg/components/openfga/constants.go

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
const (
8+
Component = "openfga"
9+
10+
ContainerHTTPPort = 8080
11+
ContainerHTTPName = "http"
12+
13+
ContainerGRPCPort = 8081
14+
ContainerGRPCName = "grpc"
15+
16+
ContainerPlaygroundPort = 3000
17+
ContainerPlaygroundName = "playground"
18+
19+
RegistryRepo = "registry.hub.docker.com/library"
20+
RegistryImage = "openfga/openfga"
21+
ImageTag = "v0.3.1"
22+
23+
ContainerName = "openfga"
24+
)

‎install/installer/pkg/components/openfga/deployment.go

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/cluster"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
11+
appsv1 "k8s.io/api/apps/v1"
12+
corev1 "k8s.io/api/core/v1"
13+
"k8s.io/apimachinery/pkg/api/resource"
14+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15+
"k8s.io/apimachinery/pkg/runtime"
16+
"k8s.io/apimachinery/pkg/util/intstr"
17+
"k8s.io/utils/pointer"
18+
)
19+
20+
func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
21+
labels := common.CustomizeLabel(ctx, Component, common.TypeMetaDeployment)
22+
23+
return []runtime.Object{
24+
&appsv1.Deployment{
25+
TypeMeta: common.TypeMetaDeployment,
26+
ObjectMeta: metav1.ObjectMeta{
27+
Name: Component,
28+
Namespace: ctx.Namespace,
29+
Labels: labels,
30+
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment),
31+
},
32+
Spec: appsv1.DeploymentSpec{
33+
Selector: &metav1.LabelSelector{MatchLabels: common.DefaultLabels(Component)},
34+
Replicas: common.Replicas(ctx, Component),
35+
Strategy: common.DeploymentStrategy,
36+
Template: corev1.PodTemplateSpec{
37+
ObjectMeta: metav1.ObjectMeta{
38+
Name: Component,
39+
Namespace: ctx.Namespace,
40+
Labels: labels,
41+
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment),
42+
},
43+
Spec: corev1.PodSpec{
44+
Affinity: common.NodeAffinity(cluster.AffinityLabelMeta),
45+
PriorityClassName: common.SystemNodeCritical,
46+
ServiceAccountName: Component,
47+
EnableServiceLinks: pointer.Bool(false),
48+
DNSPolicy: "ClusterFirst",
49+
RestartPolicy: "Always",
50+
TerminationGracePeriodSeconds: pointer.Int64(30),
51+
SecurityContext: &corev1.PodSecurityContext{
52+
RunAsNonRoot: pointer.Bool(false),
53+
},
54+
Containers: []corev1.Container{{
55+
Name: ContainerName,
56+
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, RegistryRepo), RegistryImage, ImageTag),
57+
ImagePullPolicy: corev1.PullIfNotPresent,
58+
Args: []string{
59+
"run",
60+
"--log-format=json",
61+
},
62+
Env: common.CustomizeEnvvar(ctx, Component, common.MergeEnv(
63+
common.DefaultEnv(&ctx.Config),
64+
common.DatabaseEnv(&ctx.Config),
65+
[]corev1.EnvVar{
66+
{
67+
Name: "OPENFGA_DATASTORE_ENGINE",
68+
Value: "mysql",
69+
},
70+
// The following configuration relies on the common.DatabaseEnv variables
71+
{
72+
Name: "OPENFGA_DATASTORE_URI",
73+
Value: "$(DB_USERNAME):$(DB_PASSWORD)@tcp($(DB_HOST):$(DB_PORT))/openfga?parseTime=true",
74+
},
75+
},
76+
)),
77+
Ports: []corev1.ContainerPort{
78+
{
79+
ContainerPort: ContainerGRPCPort,
80+
Name: ContainerGRPCName,
81+
Protocol: *common.TCPProtocol,
82+
},
83+
{
84+
ContainerPort: ContainerHTTPPort,
85+
Name: ContainerHTTPName,
86+
Protocol: *common.TCPProtocol,
87+
},
88+
{
89+
ContainerPort: ContainerPlaygroundPort,
90+
Name: ContainerPlaygroundName,
91+
Protocol: *common.TCPProtocol,
92+
},
93+
},
94+
Resources: common.ResourceRequirements(ctx, Component, ContainerName, corev1.ResourceRequirements{
95+
Requests: corev1.ResourceList{
96+
"cpu": resource.MustParse("1m"),
97+
"memory": resource.MustParse("30Mi"),
98+
},
99+
}),
100+
SecurityContext: &corev1.SecurityContext{
101+
RunAsGroup: pointer.Int64(65532),
102+
RunAsNonRoot: pointer.Bool(true),
103+
RunAsUser: pointer.Int64(65532),
104+
},
105+
LivenessProbe: &corev1.Probe{
106+
ProbeHandler: corev1.ProbeHandler{
107+
HTTPGet: &corev1.HTTPGetAction{
108+
Path: "/healthz",
109+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
110+
Scheme: corev1.URISchemeHTTP,
111+
},
112+
},
113+
FailureThreshold: 3,
114+
SuccessThreshold: 1,
115+
TimeoutSeconds: 1,
116+
},
117+
ReadinessProbe: &corev1.Probe{
118+
ProbeHandler: corev1.ProbeHandler{
119+
HTTPGet: &corev1.HTTPGetAction{
120+
Path: "/healthz",
121+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
122+
Scheme: corev1.URISchemeHTTP,
123+
},
124+
},
125+
FailureThreshold: 3,
126+
SuccessThreshold: 1,
127+
TimeoutSeconds: 1,
128+
},
129+
}},
130+
},
131+
},
132+
},
133+
},
134+
}, nil
135+
}

‎install/installer/pkg/components/openfga/objects.go

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright (c) 2023 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/common"
9+
"github.com/gitpod-io/gitpod/installer/pkg/config/v1/experimental"
10+
"k8s.io/apimachinery/pkg/runtime"
11+
)
12+
13+
func Objects(ctx *common.RenderContext) ([]runtime.Object, error) {
14+
15+
cfg := getExperimentalWebAppConfig(ctx)
16+
if cfg == nil || cfg.OpenFGA == nil || !cfg.OpenFGA.Enabled {
17+
return nil, nil
18+
}
19+
20+
return common.CompositeRenderFunc(
21+
deployment,
22+
service,
23+
common.DefaultServiceAccount(Component),
24+
)(ctx)
25+
}
26+
27+
func getExperimentalWebAppConfig(ctx *common.RenderContext) *experimental.WebAppConfig {
28+
var experimentalCfg *experimental.Config
29+
_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
30+
experimentalCfg = ucfg
31+
return nil
32+
})
33+
34+
if experimentalCfg == nil || experimentalCfg.WebApp == nil {
35+
return nil
36+
}
37+
38+
return experimentalCfg.WebApp
39+
}

‎install/installer/pkg/components/openfga/service.go

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright (c) 2022 Gitpod GmbH. All rights reserved.
2+
/// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/common"
9+
"k8s.io/apimachinery/pkg/runtime"
10+
)
11+
12+
func service(ctx *common.RenderContext) ([]runtime.Object, error) {
13+
return common.GenerateService(Component, []common.ServicePort{
14+
{
15+
Name: ContainerHTTPName,
16+
ContainerPort: ContainerHTTPPort,
17+
ServicePort: ContainerHTTPPort,
18+
},
19+
})(ctx)
20+
}

‎install/installer/pkg/config/v1/experimental/experimental.go

+5
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,10 @@ type IAMConfig struct {
188188
OIDCClientsSecretName string `json:"oidsClientsConfigSecret,omitempty"`
189189
}
190190

191+
type OpenFGAConfig struct {
192+
Enabled bool `json:"enabled"`
193+
}
194+
191195
type WebAppConfig struct {
192196
PublicAPI *PublicAPIConfig `json:"publicApi,omitempty"`
193197
Server *ServerConfig `json:"server,omitempty"`
@@ -203,6 +207,7 @@ type WebAppConfig struct {
203207
SlowDatabase bool `json:"slowDatabase,omitempty"`
204208
IAM *IAMConfig `json:"iam,omitempty"`
205209
WithoutWorkspaceComponents bool `json:"withoutWorkspaceComponents,omitempty"`
210+
OpenFGA *OpenFGAConfig `json:"openfga,omitempty"`
206211
}
207212

208213
type WorkspaceDefaults struct {

0 commit comments

Comments
 (0)