Merge pull request rossoctl#1072 from pavelanni/feature/1063-auto-create-configmaps

feat(api): auto-create AuthBridge ConfigMaps for new namespaces

Author: pdettori

kagenti/backend/app/core/constants.py

@@ -134,3 +134,166 @@
 
 # Environment variable name for the agent endpoint (the agent card URL for the agent)
 AGENT_ENDPOINT = "AGENT_ENDPOINT"
+
+# Default Keycloak in-cluster URL (used by AuthBridge ConfigMaps)
+DEFAULT_KEYCLOAK_INTERNAL_URL = "http://keycloak-service.keycloak.svc:8080"
+DEFAULT_KEYCLOAK_REALM = "kagenti"
+
+# Default spiffe-helper configuration for AuthBridge sidecars
+DEFAULT_SPIFFE_HELPER_CONF = (
+    'agent_address = "/spiffe-workload-api/spire-agent.sock"\n'
+    'cmd = ""\n'
+    'cmd_args = ""\n'
+    'svid_file_name = "/opt/svid.pem"\n'
+    'svid_key_file_name = "/opt/svid_key.pem"\n'
+    'svid_bundle_file_name = "/opt/svid_bundle.pem"\n'
+    'jwt_svids = [{jwt_audience="kagenti", jwt_svid_file_name="/opt/jwt_svid.token"}]\n'
+    "jwt_svid_file_mode = 0644\n"
+    "include_federated_domains = true\n"
+)
+
+# Default envoy-config for AuthBridge sidecars.
+# Matches the Helm chart template in charts/kagenti/templates/agent-namespaces.yaml.
+DEFAULT_ENVOY_YAML = """\
+admin:
+  address:
+    socket_address:
+      protocol: TCP
+      address: 127.0.0.1
+      port_value: 9901
+
+static_resources:
+  listeners:
+  - name: outbound_listener
+    address:
+      socket_address:
+        protocol: TCP
+        address: 0.0.0.0
+        port_value: 15123
+    listener_filters:
+    - name: envoy.filters.listener.original_dst
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst
+    - name: envoy.filters.listener.tls_inspector
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+    filter_chains:
+    - filter_chain_match:
+        transport_protocol: tls
+      filters:
+      - name: envoy.filters.network.tcp_proxy
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          stat_prefix: outbound_tls_passthrough
+          cluster: original_destination
+    - filter_chain_match:
+        transport_protocol: raw_buffer
+      filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: outbound_http
+          codec_type: AUTO
+          route_config:
+            name: outbound_routes
+            virtual_hosts:
+            - name: catch_all
+              domains: ["*"]
+              routes:
+              - match:
+                  prefix: "/"
+                route:
+                  cluster: original_destination
+                  timeout: 300s
+          http_filters:
+          - name: envoy.filters.http.ext_proc
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+              grpc_service:
+                envoy_grpc:
+                  cluster_name: ext_proc_cluster
+                timeout: 300s
+              processing_mode:
+                request_header_mode: SEND
+                response_header_mode: SKIP
+                request_body_mode: NONE
+                response_body_mode: NONE
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+
+  - name: inbound_listener
+    address:
+      socket_address:
+        protocol: TCP
+        address: 0.0.0.0
+        port_value: 15124
+    listener_filters:
+    - name: envoy.filters.listener.original_dst
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: inbound_http
+          codec_type: AUTO
+          route_config:
+            name: inbound_routes
+            virtual_hosts:
+            - name: local_app
+              domains: ["*"]
+              routes:
+              - match:
+                  prefix: "/"
+                route:
+                  cluster: original_destination
+                  timeout: 300s
+          http_filters:
+          - name: envoy.filters.http.lua
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
+              inline_code: |
+                function envoy_on_request(request_handle)
+                  request_handle:headers():add("x-authbridge-direction", "inbound")
+                end
+          - name: envoy.filters.http.ext_proc
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+              grpc_service:
+                envoy_grpc:
+                  cluster_name: ext_proc_cluster
+                timeout: 300s
+              processing_mode:
+                request_header_mode: SEND
+                response_header_mode: SKIP
+                request_body_mode: NONE
+                response_body_mode: NONE
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+
+  clusters:
+  - name: original_destination
+    connect_timeout: 30s
+    type: ORIGINAL_DST
+    lb_policy: CLUSTER_PROVIDED
+    original_dst_lb_config:
+      use_http_header: false
+
+  - name: ext_proc_cluster
+    connect_timeout: 5s
+    type: STATIC
+    lb_policy: ROUND_ROBIN
+    http2_protocol_options: {}
+    load_assignment:
+      cluster_name: ext_proc_cluster
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: 127.0.0.1
+                port_value: 9090
+"""

kagenti/backend/app/routers/agents.py

@@ -63,6 +63,11 @@
     # SPIRE identity constants
     KAGENTI_SPIRE_LABEL,
     KAGENTI_SPIRE_ENABLED_VALUE,
+    # AuthBridge ConfigMap defaults
+    DEFAULT_KEYCLOAK_INTERNAL_URL,
+    DEFAULT_KEYCLOAK_REALM,
+    DEFAULT_SPIFFE_HELPER_CONF,
+    DEFAULT_ENVOY_YAML,
 )
 from app.core.config import settings
 from app.models.responses import (
@@ -1811,6 +1816,58 @@ async def get_shipwright_build_info(
         raise HTTPException(status_code=e.status, detail=str(e.reason))
 
 
+def _ensure_authbridge_configmaps(
+    kube: KubernetesService,
+    namespace: str,
+    spire_enabled: bool = False,
+) -> None:
+    """Ensure the 3 ConfigMaps required by AuthBridge sidecars exist.
+
+    Creates each ConfigMap only if it does not already exist, so user
+    customizations (e.g. pointing at a different Keycloak server) are
+    preserved on subsequent agent deploys.
+
+    The ConfigMaps match what the Helm chart creates in
+    charts/kagenti/templates/agent-namespaces.yaml:
+      - authbridge-config: Keycloak URLs for go-processor / client-registration
+      - envoy-config: Envoy proxy listeners and ext-proc integration
+      - spiffe-helper-config: SPIFFE workload API socket paths and SVID output
+    """
+    keycloak_url = settings.keycloak_url or DEFAULT_KEYCLOAK_INTERNAL_URL
+    realm = settings.effective_keycloak_realm or DEFAULT_KEYCLOAK_REALM
+    # ISSUER must use the public/external URL because it must match the
+    # "iss" claim in JWT tokens issued by Keycloak (split-horizon DNS).
+    issuer = f"{settings.effective_keycloak_url}/realms/{realm}"
+
+    # 1. authbridge-config
+    kube.ensure_configmap(
+        namespace=namespace,
+        name="authbridge-config",
+        data={
+            "KEYCLOAK_URL": keycloak_url,
+            "KEYCLOAK_REALM": realm,
+            "ISSUER": issuer,
+            "SPIRE_ENABLED": "true" if spire_enabled else "false",
+        },
+    )
+
+    # 2. envoy-config
+    kube.ensure_configmap(
+        namespace=namespace,
+        name="envoy-config",
+        data={"envoy.yaml": DEFAULT_ENVOY_YAML},
+    )
+
+    # 3. spiffe-helper-config
+    kube.ensure_configmap(
+        namespace=namespace,
+        name="spiffe-helper-config",
+        data={"helper.conf": DEFAULT_SPIFFE_HELPER_CONF},
+    )
+
+    logger.info(f"Ensured AuthBridge ConfigMaps in namespace '{namespace}'")
+
+
 def _build_agent_shipwright_build_manifest(
     request: CreateAgentRequest, clone_secret_name: Optional[str] = None
 ) -> dict:
@@ -2373,6 +2430,14 @@ async def create_agent(
             # SPIFFE identity uses the workload name, not the ReplicaSet hash.
             kube.ensure_service_account(namespace=request.namespace, name=request.name)
 
+            # Ensure AuthBridge ConfigMaps exist in the target namespace
+            if request.authBridgeEnabled:
+                _ensure_authbridge_configmaps(
+                    kube=kube,
+                    namespace=request.namespace,
+                    spire_enabled=request.spireEnabled,
+                )
+
             # Create workload based on workloadType
             if request.workloadType == WORKLOAD_TYPE_DEPLOYMENT:
                 workload_manifest = _build_deployment_manifest(
@@ -2761,6 +2826,14 @@ async def finalize_shipwright_build(
         # SPIFFE identity uses the workload name, not the ReplicaSet hash.
         kube.ensure_service_account(namespace=namespace, name=name)
 
+        # Ensure AuthBridge ConfigMaps exist in the target namespace
+        if final_auth_bridge:
+            _ensure_authbridge_configmaps(
+                kube=kube,
+                namespace=namespace,
+                spire_enabled=final_spire_enabled,
+            )
+
         # Create workload based on workloadType
         if final_workload_type == WORKLOAD_TYPE_DEPLOYMENT:
             workload_manifest = _build_deployment_manifest(

kagenti/backend/app/services/kubernetes.py

@@ -228,6 +228,37 @@ def ensure_service_account(self, namespace: str, name: str) -> None:
                 logger.error(f"Error checking ServiceAccount '{name}' in {namespace}: {e}")
                 raise
 
+    # -------------------------------------------------------------------------
+    # ConfigMap Operations
+    # -------------------------------------------------------------------------
+
+    def ensure_configmap(
+        self, namespace: str, name: str, data: dict, labels: Optional[dict] = None
+    ) -> None:
+        """Create a ConfigMap if it does not already exist.
+
+        This is idempotent — if the ConfigMap already exists it is left unchanged
+        so that user customizations are preserved.
+        """
+        try:
+            self.core_api.read_namespaced_config_map(name=name, namespace=namespace)
+            logger.debug(f"ConfigMap '{name}' already exists in {namespace}")
+        except ApiException as e:
+            if e.status == 404:
+                cm = kubernetes.client.V1ConfigMap(
+                    metadata=kubernetes.client.V1ObjectMeta(
+                        name=name,
+                        namespace=namespace,
+                        labels=labels or {"kagenti.io/managed-by": "kagenti-api"},
+                    ),
+                    data=data,
+                )
+                self.core_api.create_namespaced_config_map(namespace=namespace, body=cm)
+                logger.info(f"Created ConfigMap '{name}' in {namespace}")
+            else:
+                logger.error(f"Error checking ConfigMap '{name}' in {namespace}: {e}")
+                raise
+
     # -------------------------------------------------------------------------
     # Deployment Operations
     # -------------------------------------------------------------------------