Skip to content

Commit 4459280

Browse files
mosoriobgithub-actions[bot]
mosoriob
and
github-actions[bot]
authored
feat: support both jwt and webhook authentication hasura (#88)
* add: auth values * feat: add Hasura authentication webhook support * update Helm documentation * fix: dump * update Helm documentation * dump * fix: improve values * update Helm documentation --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent cacbd41 commit 4459280

File tree

4 files changed

+111
-9
lines changed

4 files changed

+111
-9
lines changed

‎charts/mint/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 3.4.6-pre2
18+
version: 3.4.6-pre3
1919
# This is the version number of the application being deployed. This version number should be
2020
# incremented each time you make changes to the application. Versions are not expected to
2121
# follow Semantic Versioning. They should reflect the version the application is using.

‎charts/mint/README.md‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# MINT
22

3-
![Version: 3.4.6-pre2](https://img.shields.io/badge/Version-3.4.6--pre2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square)
3+
![Version: 3.4.6-pre3](https://img.shields.io/badge/Version-3.4.6--pre3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.3](https://img.shields.io/badge/AppVersion-1.16.3-informational?style=flat-square)
44

55
A Helm chart for MINT
66

@@ -107,6 +107,16 @@ A Helm chart for MINT
107107
| components.ensemble_manager.serviceAccountName | string | `"default"` | Service account name for Ensemble Manager, used to run jobs |
108108
| components.ensemble_manager.strategy | object | `{"type":"Recreate"}` | Ensemble Manager deployment strategy (Recreate or RollingUpdate) |
109109
| components.ensemble_manager.strategy.type | string | `"Recreate"` | Type of deployment strategy |
110+
| components.hasura.auth | object | `{"jwt":{"claims":{"namespace":"https://hasura.io/jwt/claims"}},"type":"jwt","webhook":{"config":{"tapisJwksUri":"https://tacc.tapis.io/v3/tenants/tacc","tapisTokenIssuer":"https://tacc.tapis.io/v3/tokens"},"service":{"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/in-for-disaster-analytics/hasura-tapis-auth-webhook","tag":"latest"},"resources":{}}}}` | Authentication configuration for Hasura |
111+
| components.hasura.auth.jwt.claims | object | `{"namespace":"https://hasura.io/jwt/claims"}` | JWT claims configuration |
112+
| components.hasura.auth.type | string | `"jwt"` | Authentication type (jwt or webhook) |
113+
| components.hasura.auth.webhook.config.tapisJwksUri | string | `"https://tacc.tapis.io/v3/tenants/tacc"` | JWKS URI for Tapis authentication |
114+
| components.hasura.auth.webhook.config.tapisTokenIssuer | string | `"https://tacc.tapis.io/v3/tokens"` | Token issuer for Tapis authentication |
115+
| components.hasura.auth.webhook.service | object | `{"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/in-for-disaster-analytics/hasura-tapis-auth-webhook","tag":"latest"},"resources":{}}` | Webhook service configuration |
116+
| components.hasura.auth.webhook.service.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for auth webhook |
117+
| components.hasura.auth.webhook.service.image.repository | string | `"ghcr.io/in-for-disaster-analytics/hasura-tapis-auth-webhook"` | Docker image repository for auth webhook |
118+
| components.hasura.auth.webhook.service.image.tag | string | `"latest"` | Docker image tag for auth webhook |
119+
| components.hasura.auth.webhook.service.resources | object | `{}` | Resource specifications for auth webhook |
110120
| components.hasura.enabled | bool | `true` | Enable or disable Hasura |
111121
| components.hasura.environment.enable_console | bool | `true` | Enable or disable Hasura console |
112122
| components.hasura.environment.enable_dev_mode | bool | `false` | Enable or disable Hasura dev mode |
@@ -286,7 +296,7 @@ A Helm chart for MINT
286296
| secrets.external_services.s3.access_key | string | `"CHANGEME"` | Access key for S3. Used by Ensemble Manager to upload data |
287297
| secrets.external_services.s3.secret_key | string | `"CHANGEME"` | Secret key for S3 |
288298
| secrets.hasura.admin_secret | string | `"CHANGEME"` | Admin secret for Hasura used to access the console |
289-
| secrets.hasura.jwt_secret | string | `"{\"type\": \"RS256\", \"key\": \"-----BEGIN CERTIFICATE-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmyQQ56WKKsVCUs8n9swlv5DV7st7UUdvNoDSnwovdU2vinQQ686//vRqlUJ5vpyI7r75qTXCPkXUitDhPvGEMfChnb9tuWdymSyZmMmT+34oaYo/2bGSZjTlLRVfRJjUnFYeWoVLoXVKJolyDWtU6bXbFNnUyysb/6YIpg5sSwxkLs/9yl6HsWdFconxPJO6KmMPSjcOc0fZermNq+cOEvj1OqRhVkxDqBebreI+zcgrJHNSN8d6cxTmfVQl1jIPHvxE5oN7qUdfYmK4D+SOlj8FlkUvwis+3Ix2AQsvNoOD1OzuqUOd/FpXBnEGaeTq9EMwDxplNqltR/qT3/poUwIDAQAB\\n-----END CERTIFICATE-----\", \"allowed_skew\": 2}"` | JWT verification secret for Hasura |
299+
| secrets.hasura.jwt_secret | string | `"{\"type\": \"RS256\", \"key\": \"-----BEGIN CERTIFICATE-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmyQQ56WKKsVCUs8n9swlv5DV7st7UUdvNoDSnwovdU2vinQQ686//vRqlUJ5vpyI7r75qTXCPkXUitDhPvGEMfChnb9tuWdymSyZmMmT+34oaYo/2bGSZjTlLRVfRJjUnFYeWoVLoXVKJolyDWtU6bXbFNnUyysb/6YIpg5sSwxkLs/9yl6HsWdFconxPJO6KmMPSjcOc0fZermNq+cOEvj1OqRhVkxDqBebreI+zcgrJHNSN8d6cxTmfVQl1jIPHvxE5oN7qUdfYmK4D+SOlj8FlkUvwis+3Ix2AQsvNoOD1OzuqUOd/FpXBnEGaeTq9EMwDxplNqltR/qT3/poUwIDAQAB\\n-----END CERTIFICATE-----\", \"allowed_skew\": 2}"` | JWT verification secret for Hasura (only used when auth.type is jwt) |
290300
| securityContext | object | `{}` | |
291301
| service | object | `{"port":80,"type":"ClusterIP"}` | Service configuration |
292302
| service.port | int | `80` | Port number for the service |

‎charts/mint/templates/hasura.yaml‎

Lines changed: 72 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,66 @@ spec:
2424
selector:
2525
app: {{ include "mint.prefix" . }}-hasura
2626
---
27+
{{- if eq .Values.components.hasura.auth.type "webhook" }}
28+
apiVersion: v1
29+
kind: Service
30+
metadata:
31+
name: {{ include "mint.prefix" . }}-hasura-auth-webhook
32+
namespace: {{ .Release.Namespace }}
33+
labels:
34+
{{- include "helm.labels" . | nindent 4 }}
35+
spec:
36+
type: ClusterIP
37+
ports:
38+
- port: 3000
39+
targetPort: 3000
40+
protocol: TCP
41+
name: http
42+
selector:
43+
app: {{ include "mint.prefix" . }}-hasura-auth-webhook
44+
---
45+
apiVersion: apps/v1
46+
kind: Deployment
47+
metadata:
48+
name: {{ include "mint.prefix" . }}-hasura-auth-webhook
49+
namespace: {{ .Release.Namespace }}
50+
spec:
51+
replicas: 1
52+
selector:
53+
matchLabels:
54+
app: {{ include "mint.prefix" . }}-hasura-auth-webhook
55+
template:
56+
metadata:
57+
labels:
58+
app: {{ include "mint.prefix" . }}-hasura-auth-webhook
59+
spec:
60+
containers:
61+
- name: auth-webhook
62+
{{- with .Values.components.hasura.auth.webhook.service }}
63+
image: "{{ .image.repository }}:{{ .image.tag }}"
64+
imagePullPolicy: {{ .image.pullPolicy }}
65+
resources:
66+
{{- toYaml .resources | nindent 12 }}
67+
{{- end }}
68+
env:
69+
- name: TAPIS_JWKS_URI
70+
value: {{ .Values.components.hasura.auth.webhook.config.tapisJwksUri }}
71+
- name: TAPIS_TOKEN_ISSUER
72+
value: {{ .Values.components.hasura.auth.webhook.config.tapisTokenIssuer }}
73+
ports:
74+
- name: http
75+
containerPort: 3000
76+
protocol: TCP
77+
livenessProbe:
78+
httpGet:
79+
path: /health
80+
port: http
81+
readinessProbe:
82+
httpGet:
83+
path: /health
84+
port: http
85+
{{- end }}
86+
---
2787
apiVersion: apps/v1
2888
kind: Deployment
2989
metadata:
@@ -57,8 +117,20 @@ spec:
57117
value: "{{ .environment.enable_console }}"
58118
- name: HASURA_GRAPHQL_DEV_MODE
59119
value: "{{ .environment.enable_dev_mode }}"
120+
{{- if eq .auth.type "webhook" }}
121+
- name: HASURA_GRAPHQL_AUTH_HOOK
122+
value: "http://{{ include "mint.prefix" $ }}-hasura-auth-webhook:3000/auth-webhook"
123+
- name: HASURA_GRAPHQL_AUTH_HOOK_MODE
124+
value: "POST"
125+
{{- else }}
60126
- name: HASURA_GRAPHQL_UNAUTHORIZED_ROLE
61127
value: "{{ .environment.unauthorized_role }}"
128+
- name: HASURA_GRAPHQL_JWT_SECRET
129+
valueFrom:
130+
secretKeyRef:
131+
name: {{ include "mint.prefix" $ }}-hasura-secrets
132+
key: jwt_secret
133+
{{- end }}
62134
{{- end }}
63135
- name: HASURA_GRAPHQL_DATABASE_URL
64136
valueFrom:
@@ -70,11 +142,6 @@ spec:
70142
secretKeyRef:
71143
name: {{ include "mint.prefix" . }}-hasura-secrets
72144
key: admin_secret
73-
- name: HASURA_GRAPHQL_JWT_SECRET
74-
valueFrom:
75-
secretKeyRef:
76-
name: {{ include "mint.prefix" . }}-hasura-secrets
77-
key: jwt_secret
78145
- name: DB_HOST
79146
value: {{ include "mint.prefix" $ }}-hasura
80147
ports:

‎charts/mint/values.yaml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,31 @@ components:
249249
enable_dev_mode: false
250250
# -- Unauthorized role for Hasura
251251
unauthorized_role: anonymous
252+
# -- Authentication configuration for Hasura
253+
auth:
254+
# -- Authentication type (jwt or webhook)
255+
type: jwt
256+
jwt:
257+
# -- JWT claims configuration
258+
claims:
259+
namespace: "https://hasura.io/jwt/claims"
260+
webhook:
261+
# -- Webhook service configuration
262+
service:
263+
image:
264+
# -- Docker image repository for auth webhook
265+
repository: ghcr.io/in-for-disaster-analytics/hasura-tapis-auth-webhook
266+
# -- Docker image tag for auth webhook
267+
tag: latest
268+
# -- Image pull policy for auth webhook
269+
pullPolicy: IfNotPresent
270+
# -- Resource specifications for auth webhook
271+
resources: {}
272+
config:
273+
# -- JWKS URI for Tapis authentication
274+
tapisJwksUri: "https://tacc.tapis.io/v3/tenants/tacc"
275+
# -- Token issuer for Tapis authentication
276+
tapisTokenIssuer: "https://tacc.tapis.io/v3/tokens"
252277
ingress:
253278
# -- Enable or disable ingress for Hasura
254279
enabled: true
@@ -541,7 +566,7 @@ secrets:
541566
# -- Url for S3
542567
endpoint: example.com
543568
hasura:
544-
# -- JWT verification secret for Hasura
569+
# -- JWT verification secret for Hasura (only used when auth.type is jwt)
545570
jwt_secret: '{"type": "RS256", "key": "-----BEGIN CERTIFICATE-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmyQQ56WKKsVCUs8n9swlv5DV7st7UUdvNoDSnwovdU2vinQQ686//vRqlUJ5vpyI7r75qTXCPkXUitDhPvGEMfChnb9tuWdymSyZmMmT+34oaYo/2bGSZjTlLRVfRJjUnFYeWoVLoXVKJolyDWtU6bXbFNnUyysb/6YIpg5sSwxkLs/9yl6HsWdFconxPJO6KmMPSjcOc0fZermNq+cOEvj1OqRhVkxDqBebreI+zcgrJHNSN8d6cxTmfVQl1jIPHvxE5oN7qUdfYmK4D+SOlj8FlkUvwis+3Ix2AQsvNoOD1OzuqUOd/FpXBnEGaeTq9EMwDxplNqltR/qT3/poUwIDAQAB\n-----END CERTIFICATE-----", "allowed_skew": 2}'
546571
# -- Admin secret for Hasura used to access the console
547572
admin_secret: CHANGEME

0 commit comments

Comments
 (0)