Skip to content

Commit 424fb97

Browse files
ddelnanoddelnano
committed
Upgrade hydra and kratos to most recent releases
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 1c39c87 commit 424fb97

File tree

26 files changed

+530
-634
lines changed

26 files changed

+530
-634
lines changed

‎go.mod‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@ require (
2222
github.com/fatih/color v1.14.1
2323
github.com/gdamore/tcell v1.3.0
2424
github.com/getsentry/sentry-go v0.20.0
25-
github.com/go-openapi/runtime v0.19.26
26-
github.com/go-openapi/strfmt v0.21.3
2725
github.com/gofrs/uuid v4.0.0+incompatible
2826
github.com/gogo/protobuf v1.3.2
2927
github.com/golang-migrate/migrate v3.5.4+incompatible
@@ -50,8 +48,8 @@ require (
5048
github.com/olekukonko/tablewriter v0.0.5
5149
github.com/olivere/elastic/v7 v7.0.12
5250
github.com/ory/dockertest/v3 v3.8.1
53-
github.com/ory/hydra-client-go v1.9.2
54-
github.com/ory/kratos-client-go v0.10.1
51+
github.com/ory/hydra-client-go/v2 v2.2.0
52+
github.com/ory/kratos-client-go v1.3.8
5553
github.com/phayes/freeport v0.0.0-20171002181615-b8543db493a5
5654
github.com/prometheus/client_golang v1.14.0
5755
github.com/prometheus/client_model v0.3.0
@@ -68,7 +66,7 @@ require (
6866
github.com/spf13/cobra v1.6.1
6967
github.com/spf13/pflag v1.0.5
7068
github.com/spf13/viper v1.8.1
71-
github.com/stretchr/testify v1.8.4
69+
github.com/stretchr/testify v1.10.0
7270
github.com/txn2/txeh v1.2.1
7371
github.com/vbauerster/mpb/v4 v4.11.0
7472
github.com/zenazn/goji v0.9.1-0.20160507202103-64eb34159fe5
@@ -80,7 +78,7 @@ require (
8078
golang.org/x/exp v0.0.0-20230307190834-24139beb5833
8179
golang.org/x/mod v0.20.0
8280
golang.org/x/net v0.36.0
83-
golang.org/x/oauth2 v0.6.0
81+
golang.org/x/oauth2 v0.21.0
8482
golang.org/x/sync v0.11.0
8583
golang.org/x/sys v0.30.0
8684
golang.org/x/term v0.29.0
@@ -151,14 +149,9 @@ require (
151149
github.com/go-errors/errors v1.4.2 // indirect
152150
github.com/go-logr/logr v1.2.3 // indirect
153151
github.com/go-logr/stdr v1.2.2 // indirect
154-
github.com/go-openapi/analysis v0.21.4 // indirect
155-
github.com/go-openapi/errors v0.20.3 // indirect
156152
github.com/go-openapi/jsonpointer v0.19.6 // indirect
157153
github.com/go-openapi/jsonreference v0.20.2 // indirect
158-
github.com/go-openapi/loads v0.21.2 // indirect
159-
github.com/go-openapi/spec v0.20.8 // indirect
160154
github.com/go-openapi/swag v0.22.3 // indirect
161-
github.com/go-openapi/validate v0.22.1 // indirect
162155
github.com/goccy/go-json v0.10.2 // indirect
163156
github.com/goccy/go-yaml v1.9.8 // indirect
164157
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
@@ -244,7 +237,6 @@ require (
244237
github.com/spf13/jwalterweatherman v1.1.0 // indirect
245238
github.com/src-d/gcfg v1.4.0 // indirect
246239
github.com/subosito/gotenv v1.2.0 // indirect
247-
github.com/tidwall/pretty v1.2.0 // indirect
248240
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
249241
github.com/xanzy/ssh-agent v0.2.1 // indirect
250242
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
@@ -256,7 +248,6 @@ require (
256248
go.etcd.io/etcd/client/v2 v2.305.8 // indirect
257249
go.etcd.io/etcd/pkg/v3 v3.5.8 // indirect
258250
go.etcd.io/etcd/raft/v3 v3.5.8 // indirect
259-
go.mongodb.org/mongo-driver v1.11.3 // indirect
260251
go.opencensus.io v0.24.0 // indirect
261252
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0 // indirect
262253
go.opentelemetry.io/otel v1.14.0 // indirect
@@ -276,7 +267,7 @@ require (
276267
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
277268
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
278269
google.golang.org/appengine v1.6.7 // indirect
279-
google.golang.org/protobuf v1.29.1 // indirect
270+
google.golang.org/protobuf v1.31.0 // indirect
280271
gopkg.in/inf.v0 v0.9.1 // indirect
281272
gopkg.in/ini.v1 v1.67.0 // indirect
282273
gopkg.in/launchdarkly/go-jsonstream.v1 v1.0.1 // indirect

‎go.sum‎

Lines changed: 12 additions & 156 deletions
Large diffs are not rendered by default.

‎go_deps.bzl‎

Lines changed: 25 additions & 207 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎k8s/cloud/base/kustomization.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ resources:
3434
- artifact_tracker_deployment.yaml
3535
- artifact_tracker_service.yaml
3636
- artifact_config.yaml
37-
- ory_service_config.yaml
3837
- indexer_config.yaml
3938
- indexer_deployment.yaml
4039
- script_bundles_config.yaml

‎k8s/cloud/base/ory_auth/hydra/hydra_deployment.yaml‎

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,17 @@ spec:
2626
- name: migrate
2727
args:
2828
- migrate
29-
- -c
30-
- /etc/config/hydra/hydra.yml
3129
- sql
30+
- up
3231
- -e
32+
- -c
33+
- /etc/config/hydra/hydra.yml
3334
- --yes
3435
envFrom:
3536
- configMapRef:
3637
name: pl-db-config
38+
- configMapRef:
39+
name: pl-ory-service-config
3740
env:
3841
- name: PL_POSTGRES_USERNAME
3942
valueFrom:
@@ -55,13 +58,12 @@ spec:
5558
secretKeyRef:
5659
name: pl-hydra-secrets
5760
key: SECRETS_SYSTEM
58-
- name: HYDRA_DATABASE
59-
value: hydra
6061
- name: DSN
6162
# yamllint disable-line rule:line-length
62-
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_POSTGRES_DB)?sslmode=disable&max_conns=20&max_idle_conns=4
63+
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_HYDRA_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
6364
imagePullPolicy: IfNotPresent
64-
image: oryd/hydra:v1.9.2-sqlite@sha256:61771c706934e1ffd66f86700a28a294ce4ed150fbf30cc131710924271a5871
65+
# yamllint disable-line rule:line-length
66+
image: ghcr.io/pixie-io/hydra:2.3.0-pl1@sha256:9f0b31b1ca13d22bf14abf0c83251333b9a957a9ade39e3c723a963b84402572
6567
volumeMounts:
6668
- mountPath: /etc/config/hydra
6769
name: config
@@ -77,7 +79,8 @@ spec:
7779
containers:
7880
- name: server
7981
imagePullPolicy: IfNotPresent
80-
image: oryd/hydra:v1.9.2-sqlite@sha256:61771c706934e1ffd66f86700a28a294ce4ed150fbf30cc131710924271a5871
82+
# yamllint disable-line rule:line-length
83+
image: ghcr.io/pixie-io/hydra:2.3.0-pl1@sha256:9f0b31b1ca13d22bf14abf0c83251333b9a957a9ade39e3c723a963b84402572
8184
args:
8285
- serve
8386
- -c
@@ -86,6 +89,8 @@ spec:
8689
envFrom:
8790
- configMapRef:
8891
name: pl-db-config
92+
- configMapRef:
93+
name: pl-ory-service-config
8994
- configMapRef:
9095
name: pl-domain-config
9196
env:
@@ -111,11 +116,17 @@ spec:
111116
key: SECRETS_SYSTEM
112117
- name: DSN
113118
# yamllint disable-line rule:line-length
114-
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_POSTGRES_DB)?sslmode=disable&max_conns=20&max_idle_conns=4
119+
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_HYDRA_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
120+
- name: SERVE_TLS_ENABLED
121+
value: "true"
115122
- name: SERVE_TLS_CERT_PATH
116123
value: /certs/server.crt
117124
- name: SERVE_TLS_KEY_PATH
118125
value: /certs/server.key
126+
- name: SERVE_PUBLIC_CORS_ALLOWED_ORIGINS_0
127+
value: https://$(PL_DOMAIN_NAME)
128+
- name: SERVE_PUBLIC_CORS_ALLOWED_ORIGINS_1
129+
value: https://work.$(PL_DOMAIN_NAME)
119130
- name: PL_WORK_DOMAIN
120131
value: work.$(PL_DOMAIN_NAME)
121132
- name: PL_OAUTH_DOMAIN
@@ -132,6 +143,10 @@ spec:
132143
value: $(HYDRA_URL)
133144
- name: URLS_SELF_ISSUER
134145
value: $(HYDRA_URL)
146+
# admin is not exposed to Pixie clients. Requests to this endpoint originate
147+
# from Pixie services.
148+
- name: URLS_SELF_ADMIN
149+
value: $(PL_HYDRA_ADMIN_HOST)
135150
ports:
136151
- containerPort: 4444
137152
- containerPort: 4445
@@ -153,7 +168,8 @@ spec:
153168
type: RuntimeDefault
154169
- name: client-create-or-update
155170
imagePullPolicy: IfNotPresent
156-
image: oryd/hydra:v1.9.2-alpine@sha256:faa6ca02e77e0a08f66bfa7470a5e06d80e6e68c9c35410c65a4ea7b501aea61
171+
# yamllint disable-line rule:line-length
172+
image: ghcr.io/pixie-io/hydra:2.3.0-alpine-pl1@sha256:8e09f1a6882d37387411dc8ee1647cc3c40ba42c7f74d9a711b0fa1f483a6dba
157173
command: ['sh', '-c', 'set -x;
158174
URL="https://localhost:4445/health/ready";
159175
until [
@@ -163,22 +179,30 @@ spec:
163179
echo "waiting for ${URL}";
164180
sleep 2;
165181
done;
166-
CMD="hydra clients update auth-code-client";
167-
hydra clients get auth-code-client
182+
CMD="hydra update oauth2-client auth-code-client";
183+
hydra get client auth-code-client
168184
--endpoint=https://localhost:4445
169185
--skip-tls-verify;
170186
if [ $? -ne 0 ]; then
171187
echo "Creating client";
172-
CMD="hydra clients create --id auth-code-client";
188+
CMD="hydra create oauth2-client --id auth-code-client";
173189
fi;
174190
${CMD}
175191
--endpoint https://localhost:4445
176192
--secret "${HYDRA_CLIENT_SECRET}"
177-
--grant-types authorization_code,refresh_token,implicit
178-
--response-types code,id_token,token
179-
--scope openid,offline,notifications,gist,vizier
180-
--callbacks "https://${PL_DOMAIN_NAME}/oauth/auth/callback"
181-
--callbacks "https://work.${PL_DOMAIN_NAME}/auth/callback"
193+
--grant-type authorization_code
194+
--grant-type refresh_token
195+
--grant-type implicit
196+
--response-type code
197+
--response-type id_token
198+
--response-type token
199+
--scope openid
200+
--scope offline
201+
--scope notifications
202+
--scope gist
203+
--scope vizier
204+
--redirect-uri "https://${PL_DOMAIN_NAME}/oauth/auth/callback"
205+
--redirect-uri "https://work.${PL_DOMAIN_NAME}/auth/callback"
182206
--skip-tls-verify;
183207
sleep infinity;
184208
']

‎k8s/cloud/base/ory_auth/kratos/kratos_deployment.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ spec:
3434
envFrom:
3535
- configMapRef:
3636
name: pl-db-config
37+
- configMapRef:
38+
name: pl-ory-service-config
3739
env:
3840
- name: PL_POSTGRES_USERNAME
3941
valueFrom:
@@ -47,9 +49,10 @@ spec:
4749
key: PL_POSTGRES_PASSWORD
4850
- name: DSN
4951
# yamllint disable-line rule:line-length
50-
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_POSTGRES_DB)?sslmode=disable&max_conns=20&max_idle_conns=4
52+
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_KRATOS_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
5153
imagePullPolicy: IfNotPresent
52-
image: oryd/kratos:v0.10.1@sha256:fdcfac3da3b64e619af553451607e1ab00160e59860bb19ec145cdc6f6f9c41d
54+
# yamllint disable-line rule:line-length
55+
image: ghcr.io/pixie-io/kratos:1.3.1-pl1@sha256:3edbd266d68e9fac5e188478704e3f302962310a3685eec65890101e966c7bad
5356
resources: {}
5457
securityContext:
5558
allowPrivilegeEscalation: false
@@ -75,6 +78,8 @@ spec:
7578
name: pl-db-config
7679
- configMapRef:
7780
name: pl-domain-config
81+
- configMapRef:
82+
name: pl-ory-service-config
7883
env:
7984
- name: PL_POSTGRES_USERNAME
8085
valueFrom:
@@ -88,7 +93,7 @@ spec:
8893
key: PL_POSTGRES_PASSWORD
8994
- name: DSN
9095
# yamllint disable-line rule:line-length
91-
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_POSTGRES_DB)?sslmode=disable&max_conns=20&max_idle_conns=4
96+
value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_KRATOS_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
9297
- name: SERVE_PUBLIC_TLS_CERT_PATH
9398
value: /certs/server.crt
9499
- name: SERVE_PUBLIC_TLS_KEY_PATH
@@ -135,7 +140,8 @@ spec:
135140
- name: SELFSERVICE_FLOWS_ERROR_UI_URL
136141
value: https://$(PL_WORK_DOMAIN)/auth/password/error
137142
imagePullPolicy: IfNotPresent
138-
image: oryd/kratos:v0.10.1@sha256:fdcfac3da3b64e619af553451607e1ab00160e59860bb19ec145cdc6f6f9c41d
143+
# yamllint disable-line rule:line-length
144+
image: ghcr.io/pixie-io/kratos:1.3.1-pl1@sha256:3edbd266d68e9fac5e188478704e3f302962310a3685eec65890101e966c7bad
139145
ports:
140146
- containerPort: 4433
141147
- containerPort: 4434

‎k8s/cloud/dev/kustomization.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ patches:
2929
- path: auth_deployment_patch.yaml
3030
- path: db_config.yaml
3131
- path: indexer_config.yaml
32-
- path: ory_service_config.yaml
3332
- path: script_bundles_config.yaml
3433
- path: proxy_envoy.yaml
3534
- path: service_config.yaml

‎k8s/cloud/dev/ory_service_config.yaml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

k8s/cloud/base/ory_service_config.yaml renamed to k8s/cloud_deps/base/ory_service_config.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,5 @@ data:
1212
# Kratos only support http at the moment.
1313
PL_KRATOS_PUBLIC_HOST: https://kratos.plc.svc.cluster.local:4433
1414
PL_KRATOS_ADMIN_HOST: https://kratos.plc.svc.cluster.local:4434
15+
PL_HYDRA_DATABASE: hydra
16+
PL_KRATOS_DATABASE: kratos

‎k8s/cloud_deps/dev/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@ resources:
99
- kibana
1010
- nats
1111
- postgres
12+
- ory_service_config.yaml

0 commit comments

Comments
 (0)