From 6e75e010c29969e9a4db6bf90421b0611c6e7881 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Piotr=20Ms=CC=81cichowski?= Date: Fri, 2 Aug 2019 11:06:26 +0200 Subject: [PATCH 1/3] Design documents --- README.md | 14 +------------- docs/README.md | 22 ++++++++++++++++++++++ docs/assets/synchronization-mode.svg | 2 ++ docs/assets/workflow.svg | 2 ++ 4 files changed, 27 insertions(+), 13 deletions(-) create mode 100644 docs/README.md create mode 100644 docs/assets/synchronization-mode.svg create mode 100644 docs/assets/workflow.svg diff --git a/README.md b/README.md index 83458ee..ad88777 100644 --- a/README.md +++ b/README.md @@ -7,16 +7,4 @@ The project is based on [Kubebuilder](https://github.com/kubernetes-sigs/kubebui # Design -The controller listens for Custom Resource which defines client registration request. Once Custom resource is created, the controller register oauth2 client in hydra using hydra's REST API. -Client Id, Client Secret and Identifier of the client in hydra are be stored in the kubernetes as a secret and referenced in the applied CR. -Reference is used to identify in which kubernetes secret are stored mentioned properties. Secret iscreated in the same namespace of applied CR. -By default controller should be deployed in the same pod as hydra. Service discovery will come in place in the future. - - -## Synchronization mode - -Additionally, controller supports synchronization mode, where it tries to register all clients in hydra. -Synchronization is an optional mode, enabled via config, which is meant for use cases where hydra is deployed with in memory storage. -If hydra pod is restarted for some reason then it does not have client in its storage. With synchronization mode the controller makes sure that hydra has up to date clients. -Synchronization is done by making POST request to hydra with payload describing all client information including clientID,clientSecret and Identifier of last applied client. -If client exists in hydra storage 409 is returned which is considered as ok and synchronization continues with other clients. \ No newline at end of file +Take a look at [Design Readme](./docs/README.md) \ No newline at end of file diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000..98c22ad --- /dev/null +++ b/docs/README.md @@ -0,0 +1,22 @@ +# Design + + +## Controller design + +The controller listens for Custom Resource which defines client registration request. Once Custom resource is created, the controller register oauth2 client in hydra using hydra's REST API. +Client Id, Client Secret and Identifier of the client in hydra are be stored in the kubernetes as a secret and referenced in the applied CR. +Reference is used to identify in which kubernetes secret are stored mentioned properties. Secret iscreated in the same namespace of applied CR. +By default controller should be deployed in the same pod as hydra. Service discovery will come in place in the future. + + +It is represented in the diagram ![diagram](./assets/workflow.svg) + +## Synchronization mode + +Additionally, controller supports synchronization mode, where it tries to register all clients in hydra. +Synchronization is an optional mode, enabled via config, which is meant for use cases where hydra is deployed with in memory storage. +If hydra pod is restarted for some reason then it does not have client in its storage. With synchronization mode the controller makes sure that hydra has up to date clients. +Synchronization is done by making POST request to hydra with payload describing all client information including clientID,clientSecret and Identifier of last applied client. +If client exists in hydra storage 409 is returned which is considered as ok and synchronization continues with other clients. + +![diagram](./assets/synchronization-mode.svg) \ No newline at end of file diff --git a/docs/assets/synchronization-mode.svg b/docs/assets/synchronization-mode.svg new file mode 100644 index 0000000..0e5ca58 --- /dev/null +++ b/docs/assets/synchronization-mode.svg @@ -0,0 +1,2 @@ + +
POST /clients
POST /clients
Hydra
Hydra
Cron Job
Cron Job
Response
201 or 409
Response <br>201 or 409
yes
yes
no
no
Fetch all CRs + their secrets
Fetch all CRs + their secrets
K8s
K8s \ No newline at end of file diff --git a/docs/assets/workflow.svg b/docs/assets/workflow.svg new file mode 100644 index 0000000..42c87fc --- /dev/null +++ b/docs/assets/workflow.svg @@ -0,0 +1,2 @@ + +
Create  Client Request CR
Create  Client Request CR
Notify about  CR
Notify about  CR
CRUD Oauth2 client in Hydra
CRUD Oauth2 client in Hydra
Kubernetes
Kubernetes
Hydra Maester
Hydra Maester
Hydra
Hydra
Developer
Developer
Validate CR
Validate CR
Validate CR
Validate CR
Create secret with
 ID,clientID, client secret 
[Not supported by viewer] \ No newline at end of file From d6159003d1430fe87599c2dfc1c1383f39237c15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Piotr=20Ms=CC=81cichowski?= Date: Fri, 2 Aug 2019 11:11:45 +0200 Subject: [PATCH 2/3] Design documents --- docs/assets/workflow.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/assets/workflow.svg b/docs/assets/workflow.svg index 42c87fc..c0c5fc3 100644 --- a/docs/assets/workflow.svg +++ b/docs/assets/workflow.svg @@ -1,2 +1,2 @@ -
Create  Client Request CR
Create  Client Request CR
Notify about  CR
Notify about  CR
CRUD Oauth2 client in Hydra
CRUD Oauth2 client in Hydra
Kubernetes
Kubernetes
Hydra Maester
Hydra Maester
Hydra
Hydra
Developer
Developer
Validate CR
Validate CR
Validate CR
Validate CR
Create secret with
 ID,clientID, client secret 
[Not supported by viewer] \ No newline at end of file +
Create  Client Request CR
Create  Client Request CR
Notify about  CR
Notify about  CR
CRUD Oauth2 client in Hydra
CRUD Oauth2 client in Hydra
Kubernetes
Kubernetes
Hydra Maester
Hydra Maester
Hydra
Hydra
Developer
Developer
Validate CR
Validate CR
Validate CR
Validate CR
Create secret with
 ID,clientID, client secret 
[Not supported by viewer] \ No newline at end of file From d4d0d02176e7f3e0fbbf72be14d446ba1e0d9ad4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Piotr=20Ms=CC=81cichowski?= Date: Fri, 2 Aug 2019 11:12:44 +0200 Subject: [PATCH 3/3] Design documents --- docs/README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/README.md b/docs/README.md index 98c22ad..b60ef48 100644 --- a/docs/README.md +++ b/docs/README.md @@ -9,7 +9,9 @@ Reference is used to identify in which kubernetes secret are stored mentioned pr By default controller should be deployed in the same pod as hydra. Service discovery will come in place in the future. -It is represented in the diagram ![diagram](./assets/workflow.svg) +It is represented in the diagram + +![diagram](./assets/workflow.svg) ## Synchronization mode