Skip to content

Commit 5d38843

Browse files
easyCZeasyCZ
committed
[openfga] Deploy when experimental.webapp.openfga.enabled is true
1 parent 2e04733 commit 5d38843

File tree

8 files changed

+229
-0
lines changed

8 files changed

+229
-0
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
/install/installer/pkg/components/proxy @gitpod-io/engineering-webapp
5252
/install/installer/pkg/components/refresh-credential @gitpod-io/engineering-workspace
5353
/install/installer/pkg/components/registry-facade @gitpod-io/engineering-workspace
54+
/install/installer/pkg/components/openfga @gitpod-io/engineering-webapp
5455
/install/installer/pkg/components/public-api-server @gitpod-io/engineering-webapp
5556
/install/installer/pkg/components/iam @gitpod-io/engineering-webapp
5657
/install/installer/pkg/components/iam-api @gitpod-io/engineering-webapp

‎dev/preview/workflow/preview/deploy-gitpod.sh

+5
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,11 @@ yq w -i "${INSTALLER_CONFIG_PATH}" "experimental.webapp.server.stripeConfig" "st
450450
# IAM
451451
#
452452

453+
#
454+
# OpenFGA
455+
#
456+
yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.openfga.enabled "true"
457+
453458
# copy secret from werft's space
454459
kubectl --kubeconfig "${DEV_KUBE_PATH}" --context "${DEV_KUBE_CONTEXT}" -n werft get secret preview-envs-oidc-clients-config-secret -o yaml > preview-envs-oidc-clients-config-secret.secret.yaml
455460
yq d -i preview-envs-oidc-clients-config-secret.secret.yaml metadata.name

‎install/installer/pkg/components/components-webapp/components.go

+2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"github.com/gitpod-io/gitpod/installer/pkg/components/iam"
1313
"github.com/gitpod-io/gitpod/installer/pkg/components/migrations"
1414
"github.com/gitpod-io/gitpod/installer/pkg/components/minio"
15+
"github.com/gitpod-io/gitpod/installer/pkg/components/openfga"
1516
"github.com/gitpod-io/gitpod/installer/pkg/components/proxy"
1617
public_api_server "github.com/gitpod-io/gitpod/installer/pkg/components/public-api-server"
1718
"github.com/gitpod-io/gitpod/installer/pkg/components/rabbitmq"
@@ -37,6 +38,7 @@ var Objects = common.CompositeRenderFunc(
3738
public_api_server.Objects,
3839
usage.Objects,
3940
toxiproxy.Objects,
41+
openfga.Objects,
4042
)
4143

4244
var Helm = common.CompositeHelmFunc(

‎install/installer/pkg/components/openfga/constants.go

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
const (
8+
Component = "openfga"
9+
10+
ContainerHTTPPort = 8080
11+
ContainerHTTPName = "http"
12+
13+
ContainerGRPCPort = 8081
14+
ContainerGRPCName = "grpc"
15+
16+
ContainerPlaygroundPort = 3000
17+
ContainerPlaygroundName = "playground"
18+
19+
RegistryRepo = "registry.hub.docker.com"
20+
RegistryImage = "openfga/openfga"
21+
ImageTag = "v0.3.1"
22+
23+
ContainerName = "openfga"
24+
)

‎install/installer/pkg/components/openfga/deployment.go

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/cluster"
9+
"github.com/gitpod-io/gitpod/installer/pkg/common"
10+
11+
appsv1 "k8s.io/api/apps/v1"
12+
corev1 "k8s.io/api/core/v1"
13+
"k8s.io/apimachinery/pkg/api/resource"
14+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15+
"k8s.io/apimachinery/pkg/runtime"
16+
"k8s.io/apimachinery/pkg/util/intstr"
17+
"k8s.io/utils/pointer"
18+
)
19+
20+
func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
21+
labels := common.CustomizeLabel(ctx, Component, common.TypeMetaDeployment)
22+
23+
return []runtime.Object{
24+
&appsv1.Deployment{
25+
TypeMeta: common.TypeMetaDeployment,
26+
ObjectMeta: metav1.ObjectMeta{
27+
Name: Component,
28+
Namespace: ctx.Namespace,
29+
Labels: labels,
30+
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment),
31+
},
32+
Spec: appsv1.DeploymentSpec{
33+
Selector: &metav1.LabelSelector{MatchLabels: common.DefaultLabels(Component)},
34+
Replicas: common.Replicas(ctx, Component),
35+
Strategy: common.DeploymentStrategy,
36+
Template: corev1.PodTemplateSpec{
37+
ObjectMeta: metav1.ObjectMeta{
38+
Name: Component,
39+
Namespace: ctx.Namespace,
40+
Labels: labels,
41+
Annotations: common.CustomizeAnnotation(ctx, Component, common.TypeMetaDeployment),
42+
},
43+
Spec: corev1.PodSpec{
44+
Affinity: common.NodeAffinity(cluster.AffinityLabelMeta),
45+
PriorityClassName: common.SystemNodeCritical,
46+
ServiceAccountName: Component,
47+
EnableServiceLinks: pointer.Bool(false),
48+
DNSPolicy: "ClusterFirst",
49+
RestartPolicy: "Always",
50+
TerminationGracePeriodSeconds: pointer.Int64(30),
51+
SecurityContext: &corev1.PodSecurityContext{
52+
RunAsNonRoot: pointer.Bool(false),
53+
},
54+
Containers: []corev1.Container{{
55+
Name: ContainerName,
56+
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, RegistryRepo), RegistryImage, ImageTag),
57+
ImagePullPolicy: corev1.PullIfNotPresent,
58+
Args: []string{
59+
"run",
60+
"--log-format=json",
61+
},
62+
Env: common.CustomizeEnvvar(ctx, Component, common.MergeEnv(
63+
common.DefaultEnv(&ctx.Config),
64+
)),
65+
Ports: []corev1.ContainerPort{
66+
{
67+
ContainerPort: ContainerGRPCPort,
68+
Name: ContainerGRPCName,
69+
Protocol: *common.TCPProtocol,
70+
},
71+
{
72+
ContainerPort: ContainerHTTPPort,
73+
Name: ContainerHTTPName,
74+
Protocol: *common.TCPProtocol,
75+
},
76+
{
77+
ContainerPort: ContainerPlaygroundPort,
78+
Name: ContainerPlaygroundName,
79+
Protocol: *common.TCPProtocol,
80+
},
81+
},
82+
Resources: common.ResourceRequirements(ctx, Component, ContainerName, corev1.ResourceRequirements{
83+
Requests: corev1.ResourceList{
84+
"cpu": resource.MustParse("1m"),
85+
"memory": resource.MustParse("30Mi"),
86+
},
87+
}),
88+
SecurityContext: &corev1.SecurityContext{
89+
RunAsGroup: pointer.Int64(65532),
90+
RunAsNonRoot: pointer.Bool(true),
91+
RunAsUser: pointer.Int64(65532),
92+
},
93+
LivenessProbe: &corev1.Probe{
94+
ProbeHandler: corev1.ProbeHandler{
95+
HTTPGet: &corev1.HTTPGetAction{
96+
Path: "/healthz",
97+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
98+
Scheme: corev1.URISchemeHTTP,
99+
},
100+
},
101+
FailureThreshold: 3,
102+
SuccessThreshold: 1,
103+
TimeoutSeconds: 1,
104+
},
105+
ReadinessProbe: &corev1.Probe{
106+
ProbeHandler: corev1.ProbeHandler{
107+
HTTPGet: &corev1.HTTPGetAction{
108+
Path: "/healthz",
109+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
110+
Scheme: corev1.URISchemeHTTP,
111+
},
112+
},
113+
FailureThreshold: 3,
114+
SuccessThreshold: 1,
115+
TimeoutSeconds: 1,
116+
},
117+
}},
118+
},
119+
},
120+
},
121+
},
122+
}, nil
123+
}

‎install/installer/pkg/components/openfga/objects.go

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Copyright (c) 2023 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/common"
9+
"github.com/gitpod-io/gitpod/installer/pkg/config/v1/experimental"
10+
"k8s.io/apimachinery/pkg/runtime"
11+
)
12+
13+
func Objects(ctx *common.RenderContext) ([]runtime.Object, error) {
14+
15+
openFGAConfig := getExperimentalOpenFGAConfig(ctx)
16+
if openFGAConfig == nil {
17+
return nil, nil
18+
}
19+
20+
return common.CompositeRenderFunc(
21+
deployment,
22+
service,
23+
common.DefaultServiceAccount(Component),
24+
)(ctx)
25+
}
26+
27+
func getExperimentalWebAppConfig(ctx *common.RenderContext) *experimental.WebAppConfig {
28+
var experimentalCfg *experimental.Config
29+
_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
30+
experimentalCfg = ucfg
31+
return nil
32+
})
33+
34+
if experimentalCfg == nil || experimentalCfg.WebApp == nil {
35+
return nil
36+
}
37+
38+
return experimentalCfg.WebApp
39+
}
40+
41+
func getExperimentalOpenFGAConfig(ctx *common.RenderContext) *experimental.OpenFGAConfig {
42+
webappCfg := getExperimentalWebAppConfig(ctx)
43+
44+
if webappCfg == nil || webappCfg.OpenFGA == nil {
45+
return nil
46+
}
47+
48+
return webappCfg.OpenFGA
49+
}

‎install/installer/pkg/components/openfga/service.go

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright (c) 2022 Gitpod GmbH. All rights reserved.
2+
/// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package openfga
6+
7+
import (
8+
"github.com/gitpod-io/gitpod/installer/pkg/common"
9+
"k8s.io/apimachinery/pkg/runtime"
10+
)
11+
12+
func service(ctx *common.RenderContext) ([]runtime.Object, error) {
13+
return common.GenerateService(Component, []common.ServicePort{
14+
{
15+
Name: ContainerHTTPName,
16+
ContainerPort: ContainerHTTPPort,
17+
ServicePort: ContainerHTTPPort,
18+
},
19+
})(ctx)
20+
}

‎install/installer/pkg/config/v1/experimental/experimental.go

+5
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,10 @@ type IAMConfig struct {
188188
OIDCClientsSecretName string `json:"oidsClientsConfigSecret,omitempty"`
189189
}
190190

191+
type OpenFGAConfig struct {
192+
Enabled bool `json:"enabled"`
193+
}
194+
191195
type WebAppConfig struct {
192196
PublicAPI *PublicAPIConfig `json:"publicApi,omitempty"`
193197
Server *ServerConfig `json:"server,omitempty"`
@@ -203,6 +207,7 @@ type WebAppConfig struct {
203207
SlowDatabase bool `json:"slowDatabase,omitempty"`
204208
IAM *IAMConfig `json:"iam,omitempty"`
205209
WithoutWorkspaceComponents bool `json:"withoutWorkspaceComponents,omitempty"`
210+
OpenFGA *OpenFGAConfig `json:"openfga,omitempty"`
206211
}
207212

208213
type WorkspaceDefaults struct {

0 commit comments

Comments
 (0)