Skip to content

Commit 32473b0

Browse files
isegall-daisegall-da
authored
support no-auth mode in k8s (#2603)
Signed-off-by: Itai Segall <[email protected]>
1 parent f03e4a5 commit 32473b0

File tree

26 files changed

+525
-230
lines changed

26 files changed

+525
-230
lines changed

‎apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/runbook/ValidatorPreflightIntegrationTest.scala‎

Lines changed: 181 additions & 110 deletions
Large diffs are not rendered by default.

‎apps/app/src/test/scala/org/lfdecentralizedtrust/splice/util/FrontendLoginUtil.scala‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,12 @@ trait FrontendLoginUtil extends WithAuth0Support { self: FrontendTestCommon =>
3434
}
3535
currentUrl should startWith(url)
3636
}
37+
loginOnceConfirmedToBeAtUrl(ledgerApiUser)
38+
}
39+
40+
protected def loginOnceConfirmedToBeAtUrl(
41+
ledgerApiUser: String
42+
)(implicit webDriver: WebDriver) = {
3743
eventually(timeUntilSuccess = 5.seconds) {
3844
if (find(id("logout-button")).isDefined) {
3945
eventuallyClickOn(id("logout-button"))

‎cluster/expected/canton-network/expected.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1838,6 +1838,7 @@
18381838
},
18391839
"contactPoint": "[email protected]",
18401840
"disableAllocateLedgerApiUserParty": true,
1841+
"disableAuth": false,
18411842
"enablePostgresMetrics": true,
18421843
"failOnAppVersionMismatch": true,
18431844
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",
@@ -2657,6 +2658,7 @@
26572658
},
26582659
"contactPoint": "[email protected]",
26592660
"disableAllocateLedgerApiUserParty": true,
2661+
"disableAuth": false,
26602662
"enablePostgresMetrics": true,
26612663
"failOnAppVersionMismatch": true,
26622664
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",

‎cluster/expected/splitwell/expected.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,7 @@
548548
"hostname": "mock.global.canton.network.digitalasset.com",
549549
"name": "cn-mocknet"
550550
},
551+
"disableAuth": false,
551552
"enableHealthProbes": true,
552553
"enablePostgresMetrics": true,
553554
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",
@@ -913,6 +914,7 @@
913914
"name": "cn-mocknet"
914915
},
915916
"contactPoint": "[email protected]",
917+
"disableAuth": false,
916918
"enablePostgresMetrics": true,
917919
"failOnAppVersionMismatch": true,
918920
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",

‎cluster/expected/validator-runbook/expected.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,7 @@
440440
"hostname": "mock.global.canton.network.digitalasset.com",
441441
"name": "cn-mocknet"
442442
},
443+
"disableAuth": false,
443444
"enableHealthProbes": true,
444445
"enablePostgresMetrics": true,
445446
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",

‎cluster/expected/validator1/expected.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -591,6 +591,7 @@
591591
"hostname": "mock.global.canton.network.digitalasset.com",
592592
"name": "cn-mocknet"
593593
},
594+
"disableAuth": false,
594595
"enableHealthProbes": true,
595596
"enablePostgresMetrics": true,
596597
"extraVolumeMounts": [
@@ -901,6 +902,7 @@
901902
"name": "cn-mocknet"
902903
},
903904
"contactPoint": "[email protected]",
905+
"disableAuth": false,
904906
"enablePostgresMetrics": true,
905907
"failOnAppVersionMismatch": true,
906908
"imageRepo": "us-central1-docker.pkg.dev/da-cn-shared/ghcr/digital-asset/decentralized-canton-sync-dev/docker",

‎cluster/helm/splice-participant/templates/participant.yaml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,6 @@ spec:
4444
value: {{ .Values.persistence.port | quote }}
4545
- name: CANTON_PARTICIPANT_POSTGRES_SCHEMA
4646
value: {{ .Values.persistence.schema }}
47-
- name: CANTON_PARTICIPANT_ADMIN_USER_NAME
48-
valueFrom: {{ .Values.participantAdminUserNameFrom | toYaml | nindent 12 }}
49-
- name: AUTH_JWKS_URL
50-
value: {{ .Values.auth.jwksUrl }}
51-
- name: AUTH_TARGET_AUDIENCE
52-
value: {{ .Values.auth.targetAudience }}
5347
- name: CANTON_PARTICIPANT_POSTGRES_PASSWORD
5448
valueFrom:
5549
secretKeyRef:
@@ -73,6 +67,20 @@ spec:
7367
}
7468
}
7569
{{- end }}
70+
{{- if .Values.disableAuth }}
71+
- name: CANTON_PARTICIPANT_ADMIN_USER_NAME
72+
value: ledger-api-user
73+
- name: ADDITIONAL_CONFIG_DISABLE_AUTH
74+
value: |
75+
canton.participants.participant.ledger-api.auth-services=[]
76+
{{- else }}
77+
- name: CANTON_PARTICIPANT_ADMIN_USER_NAME
78+
valueFrom: {{ .Values.participantAdminUserNameFrom | toYaml | nindent 12 }}
79+
- name: AUTH_JWKS_URL
80+
value: {{ .Values.auth.jwksUrl }}
81+
- name: AUTH_TARGET_AUDIENCE
82+
value: {{ .Values.auth.targetAudience }}
83+
{{- end }}
7684
{{- include "splice-util-lib.additional-env-vars" .Values.additionalEnvVars | indent 8}}
7785
{{- include "splice-util-lib.log-level" .Values | indent 8}}
7886
ports:

‎cluster/helm/splice-participant/tests/participant_test.yaml‎

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,22 @@ tests:
104104
content:
105105
# We don't really care about the name of the env var but helm unittest wants it
106106
name: ADDITIONAL_CONFIG_SPLICE_PARTICIPANT_CRYPTO_PROVIDER_KMS
107-
value: "canton.participants.participant.crypto {\n provider = kms\n kms = {\n extra-canton-key = mock_value\n map-canton-key = {\n first-map-entry = first_map_value\n recursive-map-entry = {\n recursive-map = recursive_value\n }\n second-map-entry = second_map_value\n }\n region = mock_region\n type = awwws\n }\n} \n"
107+
value: |
108+
canton.participants.participant.crypto {
109+
provider = kms
110+
kms = {
111+
extra-canton-key = mock_value
112+
map-canton-key = {
113+
first-map-entry = first_map_value
114+
recursive-map-entry = {
115+
recursive-map = recursive_value
116+
}
117+
second-map-entry = second_map_value
118+
}
119+
region = mock_region
120+
type = awwws
121+
}
122+
}
108123
# Secret configured via Helm with valueFrom
109124
- contains:
110125
path: spec.template.spec.containers[0].env
@@ -166,3 +181,30 @@ tests:
166181
persistentVolumeClaim:
167182
claimName: claim_name
168183
- name: empty-dir-volume
184+
- it: "defaults to auth"
185+
documentSelector:
186+
path: kind
187+
value: Deployment
188+
asserts:
189+
- notExists:
190+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='CANTON_PARTICIPANT_ADMIN_USER_NAME')].value
191+
- notExists:
192+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='ADDITIONAL_CONFIG_DISABLE_AUTH')].value
193+
- it: "supports disabling auth"
194+
set:
195+
disableAuth: true
196+
documentSelector:
197+
path: kind
198+
value: Deployment
199+
asserts:
200+
- equal:
201+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='CANTON_PARTICIPANT_ADMIN_USER_NAME')].value
202+
value: ledger-api-user
203+
- equal:
204+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='ADDITIONAL_CONFIG_DISABLE_AUTH')].value
205+
value: |
206+
canton.participants.participant.ledger-api.auth-services=[]
207+
- notExists:
208+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='AUTH_JWKS_URL')].value
209+
- notExists:
210+
path: spec.template.spec.containers[?(@.name=='participant')].env[?(@.name=='AUTH_TARGET_AUDIENCE')].value

‎cluster/helm/splice-participant/values-template.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,6 @@ persistence:
4444
# tolerations:
4545

4646
extraInitContainers: []
47+
48+
# set to true to disable auth (this is highly insecure)
49+
disableAuth: false

‎cluster/helm/splice-participant/values.schema.json‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
"$schema": "http://json-schema.org/schema#",
33
"type": "object",
44
"required": [
5-
"auth",
65
"defaultJvmOptions",
76
"imageRepo",
87
"participantAdminUserNameFrom",
@@ -100,6 +99,21 @@
10099
}
101100
}
102101
},
102+
"disableAuth": {
103+
"type": "boolean"
104+
},
105+
"if": {
106+
"properties": {
107+
"disableAuth": {
108+
"const": "true"
109+
}
110+
}
111+
},
112+
"then": {
113+
"required": [
114+
"auth"
115+
]
116+
},
103117
"metrics": {
104118
"type": "object",
105119
"properties": {

0 commit comments

Comments
 (0)