Merge #28

28: OIDC configuration r=unleashed a=eloycoto

Quite big change PR here, the main thing, a new JWT auth plugin that will check
the JWT token is valid, etc..

Also added a new keycloak in the compose to validate that all is working as
expected.

To test that all is working:

1) Get the JWT token:

```
export KEYCLOAK_REALM="http://localhost:8080/auth/realms/ostia"

ACCESS_TOKEN=$(curl -k \
  -H "Host: keycloak:8080" \
  -d "username=jane" \
  -d "password=p" \
  -d "grant_type=password" \
  -d "client_id=admin-cli" \
  $KEYCLOAK_REALM/protocol/openid-connect/token -s | jq -r .access_token)
echo $ACCESS_TOKEN

echo "ACCESS_TOKEN decoded:"

jq -R 'split(".") | .[1] | @base64d | fromjson' <<< "$ACCESS_TOKEN"
```

2) Made the request to envoy:

```
INGRESS_PORT=$(docker inspect compose_ingress_1 | jq -r '.[0].NetworkSettings.Ports."80/tcp"[0].HostPort')
curl -v http://127.0.0.1:$INGRESS_PORT/ \
  -H "Host: web" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"
```


Major things about this PR:

-> Cluster has been refactored to a custom function.
-> Also added support for TLS clusters.
-> targets are now http uri, because is easy to know if TLS or not.
-> OIDC discovery is using libcurl. In the near future tokio request will be
used, but asyn issues in all config load make it difficult to add.
-> Some fixes regarding wasm plugin.
-> A few makefiles changes.


Co-authored-by: Eloy Coto <[email protected]>

.gitignore

@@ -8,3 +8,4 @@
 # Wasm filter
 /wasm_filter/target
 
+/compose/control-plane/static/*

Cargo.toml

@@ -35,6 +35,9 @@ anyhow = "^1"
 warp = "0.2.5"
 ring = "0.16.15"
 data-encoding = "2.3.0"
+url= "2.1.1"
+
+curl = "0.4.34"
 
 [build-dependencies]
 tonic-build = "^0"

Makefile

@@ -51,6 +51,10 @@ up: $(up-deps) ## Start docker-compose containers
 stop: ## Stop docker-compose containers
 	$(DOCKER_COMPOSE) stop
 
+.PHONY: build
+build: ## Build containers
+	$(DOCKER_COMPOSE) build
+
 status: ## Status of docker-compose containers
 	$(DOCKER_COMPOSE) ps
 

build.rs

@@ -15,6 +15,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             "./protos/envoyproxy/data-plane-api/envoy/extensions/filters/http/router/v3/router.proto",
             "./protos/envoyproxy/data-plane-api/envoy/extensions/filters/http/wasm/v3/wasm.proto",
             "./protos/envoyproxy/data-plane-api/envoy/extensions/wasm/v3/wasm.proto",
+            "./protos/envoyproxy/data-plane-api/envoy/extensions/filters/http/jwt_authn/v3/config.proto",
+            "./protos/envoyproxy/data-plane-api/envoy/extensions/transport_sockets/tls/v3/tls.proto",
         ],
         &[
             "./protos/envoyproxy/data-plane-api/",

compose/control-plane/Dockerfile

@@ -3,6 +3,7 @@ FROM rust AS build
 RUN export DEBIAN_FRONTEND=noninteractive \
  && apt-get update -y \
  && apt-get -y dist-upgrade \
+ && apt-get install libcurl4 -y \
  && rustup component add rustfmt
 
 WORKDIR /usr/src/gateway-ng-controller
@@ -20,6 +21,11 @@ RUN cargo build --release
 
 FROM debian
 
+RUN export DEBIAN_FRONTEND=noninteractive \
+ && apt-get update -y \
+ && apt-get -y dist-upgrade \
+ && apt-get install libcurl4 curl -y
+
 WORKDIR /home/app/bin
 ENV PATH="/home/app/bin:${PATH}"
 

compose/control-plane/config.json

@@ -3,7 +3,8 @@
     "id": 1,
     "hosts": ["web", "web.app"],
     "policies": [],
-    "target_domain": "web.app:80",
+    "target_domain": "http://web.app:80",
+    "oidc_issuer": "http://keycloak:8080/auth/realms/ostia",
     "proxy_rules": [
       {
         "pattern": "/",

compose/docker-compose.yaml

@@ -48,6 +48,7 @@ services:
     image: control-plane
     volumes:
       - ./control-plane/config.json:/home/app/bin/log.json:z,ro
+      - ./control-plane/static:/home/app/bin/static:z,ro
     expose:
       - "5000"
       - "5001"
@@ -59,6 +60,20 @@ services:
       control-plane:
         aliases:
           - ${CONTROL_PLANE_DOCKER:-control-plane-main}
+  keycloak:
+    image: jboss/keycloak
+    environment:
+      KEYCLOAK_USER: admin
+      KEYCLOAK_PASSWORD: p
+      KEYCLOAK_IMPORT: /tmp/import-realm.json -Dkeycloak.profile.feature.upload_scripts=enabled
+    volumes:
+      - ./keycloak-realm.json:/tmp/import-realm.json:z,ro
+    ports:
+      - "8080:8080"
+    networks:
+      control-plane:
+        aliases:
+          - keycloak
 
 networks:
   control-plane: