Skip to content

Commit 2b3f951

Browse files
AbirdcflyAbirdcfly
committed
feat: add auth
Signed-off-by: Abirdcfly <[email protected]>
1 parent 97ff9bf commit 2b3f951

File tree

9 files changed

+1411
-19
lines changed

9 files changed

+1411
-19
lines changed

‎cmd/depository/main.go‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,11 @@ import (
2323
"fmt"
2424
"os"
2525

26+
"github.com/bestchains/bc-explorer/pkg/auth"
2627
"github.com/bestchains/bc-explorer/pkg/network"
2728
"github.com/bestchains/bc-saas/pkg/contracts"
2829
handler "github.com/bestchains/bc-saas/pkg/handlers"
29-
listener "github.com/bestchains/bc-saas/pkg/listener"
30+
"github.com/bestchains/bc-saas/pkg/listener"
3031
"github.com/bestchains/bc-saas/pkg/models"
3132
"github.com/go-pg/pg/v10"
3233
"github.com/go-pg/pg/v10/orm"
@@ -37,15 +38,15 @@ import (
3738
)
3839

3940
var (
40-
profile = flag.String("profile", "./network.json", "profile to connect with blockchain network")
41-
contract = flag.String("contract", "depository", "contract name")
42-
addr = flag.String("addr", ":9999", "used to listen and serve http requests")
43-
db = flag.String("db", "pg", "which database to use, default is pg(postgresql)")
44-
dsn = flag.String("dsn", "postgres://bestchains:[email protected]:5432/bc-saas?sslmode=disable", "database connection string")
41+
profile = flag.String("profile", "./network.json", "profile to connect with blockchain network")
42+
contract = flag.String("contract", "depository", "contract name")
43+
addr = flag.String("addr", ":9999", "used to listen and serve http requests")
44+
db = flag.String("db", "pg", "which database to use, default is pg(postgresql)")
45+
dsn = flag.String("dsn", "postgres://bestchains:[email protected]:5432/bc-saas?sslmode=disable", "database connection string")
46+
authMethod = flag.String("auth", "none", "user authentication method, none, oidc or kubernetes")
4547
)
4648

4749
func main() {
48-
klog.InitFlags(nil)
4950
flag.Parse()
5051

5152
if err := run(); err != nil {
@@ -89,6 +90,10 @@ func run() error {
8990
app.Use(logger.New(logger.Config{
9091
Format: "[${ip}]:${port} ${status} - ${method} ${path}\n",
9192
}))
93+
app.Use(auth.New(context.TODO(), auth.Config{
94+
AuthMethod: *authMethod,
95+
SkipAuthorize: true,
96+
}))
9297
depository := app.Group("depository")
9398

9499
// hyperledger handlers

‎deploy/deploy.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: bc-saas
5+
namespace: baas-system
6+
spec:
7+
replicas: 1
8+
selector:
9+
matchLabels:
10+
app: bc-saas
11+
template:
12+
metadata:
13+
labels:
14+
app: bc-saas
15+
spec:
16+
serviceAccountName: bc-saas
17+
volumes:
18+
- name: network-json
19+
secret:
20+
secretName: bc-saas-secret
21+
- name: oidc-server-ca
22+
secret:
23+
defaultMode: 420
24+
items:
25+
- key: ca.crt
26+
path: ca.pem
27+
secretName: oidc-server-root-secret
28+
containers:
29+
- name: depository
30+
image: hyperledgerk8s/bc-saas:6b0ed39
31+
command:
32+
- depository
33+
args:
34+
- -v=5
35+
- -profile=/opt/depository/network.json
36+
- -contract=depository
37+
- -auth=oidc
38+
ports:
39+
- containerPort: 9999
40+
env:
41+
- name: OIDC_CA_FILE
42+
value: "/etc/oidc/oidc-server/ca.pem"
43+
- name: OIDC_CLIENT_ID
44+
valueFrom:
45+
secretKeyRef:
46+
key: oidc.client-id
47+
name: kube-oidc-proxy-config
48+
- name: OIDC_ISSUER_URL
49+
valueFrom:
50+
secretKeyRef:
51+
key: oidc.issuer-url
52+
name: kube-oidc-proxy-config
53+
- name: OIDC_USERNAME_CLAIM
54+
valueFrom:
55+
secretKeyRef:
56+
key: oidc.username-claim
57+
name: kube-oidc-proxy-config
58+
- name: OIDC_GROUPS_CLAIM
59+
valueFrom:
60+
secretKeyRef:
61+
key: oidc.group-claim
62+
name: kube-oidc-proxy-config
63+
volumeMounts:
64+
- name: network-json
65+
mountPath: /opt/depository
66+
- mountPath: /etc/oidc/oidc-server
67+
name: oidc-server-ca
68+
readOnly: true

‎deploy/network.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"id": "network-sample3",
3+
"platform": "bestchains",
4+
"fabProfile": {
5+
"channel": "channelid",
6+
"organization": "org1",
7+
"user": {
8+
"name": "org1admin",
9+
"key": {
10+
"pem": "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgnaTsH8cPOcV0Vgvn\nx4Z1hIUpV1Kg2kjzu1x3E7oM59mhRANCAAQ9Mjwd16DmSeyEiZV5kQ04tUFrJMxk\nslTDmBrc1vFkPqzMH1LGCsn2w8gKwcisboz8eC7mJPfS8eR9wK4w/aQx\n-----END PRIVATE KEY-----\n"
11+
},
12+
"cert": {
13+
"pem": "-----BEGIN CERTIFICATE-----\nMIIDDzCCAregAwIBAgIUV0lIiC3NNUr+69cVUy8v6i0gxm0wCgYIKoZIzj0EAwIw\nXzELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK\nEwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRAwDgYDVQQDEwdvcmcxLWNh\nMB4XDTIzMDQxODA1MzcwMFoXDTI0MDQxNzA1NDQwMFowJDEOMAwGA1UECxMFYWRt\naW4xEjAQBgNVBAMTCW9yZzFhZG1pbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA\nBD0yPB3XoOZJ7ISJlXmRDTi1QWskzGSyVMOYGtzW8WQ+rMwfUsYKyfbDyArByKxu\njPx4LuYk99Lx5H3ArjD9pDGjggGKMIIBhjAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T\nAQH/BAIwADAdBgNVHQ4EFgQUprvedopkGRfeYsxHLI8Cp3hoZawwHwYDVR0jBBgw\nFoAUO++ESe8aFTNvD982WCOyKxTgST0wLgYDVR0RBCcwJYIjY29udHJvbGxlci1t\nYW5hZ2VyLTVmZDhmYzc1NGMtOXRzZjkwgfUGCCoDBAUGBwgBBIHoeyJhdHRycyI6\neyJoZi5BZmZpbGlhdGlvbiI6IiIsImhmLkVucm9sbG1lbnRJRCI6Im9yZzFhZG1p\nbiIsImhmLkdlbkNSTCI6InRydWUiLCJoZi5JbnRlcm1lZGlhdGVDQSI6InRydWUi\nLCJoZi5SZWdpc3RyYXIuUm9sZXMiOiIqIiwiaGYuUmVnaXN0cmFyRGVsZWdhdGVS\nb2xlcyI6IioiLCJoZi5SZXZva2VyIjoiKiIsImhmLlR5cGUiOiJhZG1pbiIsImhm\nLmhmLlJlZ2lzdHJhci5BdHRyaWJ1dGVzIjoiKiJ9fTAKBggqhkjOPQQDAgNGADBD\nAiBpB13OjDKI/qU7/QI8L8c1KnCNJkdcD0BOcwpwKsOqMAIfEXsg0dMLjOsU1Jm0\noUCQNrlRW9wlT/oxbStXppcFNg==\n-----END CERTIFICATE-----\n"
14+
}
15+
},
16+
"endpoint": {
17+
"url": "grpcs://org1-org1peer1-peer.172.18.0.4.nip.io:443",
18+
"tlsCACerts": {
19+
"pem": "-----BEGIN CERTIFICATE-----\nMIICBzCCAa6gAwIBAgIUMBMS27QPxyLtVrHtGIBJcwquF00wCgYIKoZIzj0EAwIw\nYjELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK\nEwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRMwEQYDVQQDEwpvcmcxLXRs\nc2NhMB4XDTIzMDQxODA1MzcwMFoXDTM4MDQxNDA1MzcwMFowYjELMAkGA1UEBhMC\nVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBlcmxlZGdl\ncjEPMA0GA1UECxMGRmFicmljMRMwEQYDVQQDEwpvcmcxLXRsc2NhMFkwEwYHKoZI\nzj0CAQYIKoZIzj0DAQcDQgAElsbFDQe/QFwZoRBrbLp6zQTyxD+SGDhi/7hshCd/\ncMNYADqusdjHSIorTiTegS9/69iUz5ROeFurcSfHxGI4gaNCMEAwDgYDVR0PAQH/\nBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKlocv/Ghk9Nkq6/zzov\nubxlHrw0MAoGCCqGSM49BAMCA0cAMEQCIHoYm+ccgYhqvXng8yXDvedqS1wsJPmX\n9Y1P9Z/44i6zAiBtke6JqTrixv9yorq5JtBGs12qU/lsWig7nwKFSdQKsA==\n-----END CERTIFICATE-----\n"
20+
}
21+
}
22+
}
23+
}

‎deploy/oidc-secret.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
if use `oidc` auth, you need create secret `kube-oidc-proxy-config` and `oidc-server-root-secret`, the data is same with `u4a-system`.
2+
```bash
3+
kubectl get secret kube-oidc-proxy-config -n u4a-system -o json \
4+
| jq 'del(.metadata["namespace","creationTimestamp","resourceVersion","selfLink","uid"])' \
5+
| kubectl apply -n baas-system -f -
6+
7+
kubectl get secret oidc-server-root-secret -n u4a-system -o json \
8+
| jq 'del(.metadata["namespace","creationTimestamp","resourceVersion","selfLink","uid"])' \
9+
| kubectl apply -n baas-system -f -
10+
```

‎deploy/rbac.yaml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: bc-saas
5+
namespace: baas-system
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRole
9+
metadata:
10+
name: bc-saas
11+
rules:
12+
- apiGroups:
13+
- authentication.k8s.io
14+
resources:
15+
- tokenreviews
16+
verbs:
17+
- create
18+
- apiGroups:
19+
- ""
20+
resources:
21+
- pods
22+
- pods/log
23+
- persistentvolumeclaims
24+
- persistentvolumes
25+
- services
26+
- endpoints
27+
- events
28+
- configmaps
29+
- secrets
30+
- nodes
31+
- serviceaccounts
32+
verbs:
33+
- get
34+
- list
35+
- watch
36+
- apiGroups:
37+
- "batch"
38+
resources:
39+
- jobs
40+
verbs:
41+
- get
42+
- list
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
- daemonsets
49+
- replicasets
50+
- statefulsets
51+
verbs:
52+
- get
53+
- list
54+
- watch
55+
- apiGroups:
56+
- monitoring.coreos.com
57+
resources:
58+
- servicemonitors
59+
verbs:
60+
- get
61+
- apiGroups:
62+
- ibp.com
63+
resources:
64+
- ibpcas.ibp.com
65+
- ibppeers.ibp.com
66+
- ibporderers.ibp.com
67+
- ibpconsoles.ibp.com
68+
- organizations.ibp.com
69+
- federations.ibp.com
70+
- networks.ibp.com
71+
- proposals.ibp.com
72+
- votes.ibp.com
73+
- channels.ibp.com
74+
- chaincodebuilds.ibp.com
75+
- ibpcas
76+
- ibppeers
77+
- ibporderers
78+
- ibpconsoles
79+
- organizations
80+
- federations
81+
- networks
82+
- proposals
83+
- votes
84+
- channels
85+
- chaincodebuilds
86+
- ibpcas/finalizers
87+
- ibppeers/finalizers
88+
- ibporderers/finalizers
89+
- ibpconsoles/finalizers
90+
- organizations/finalizers
91+
- federations/finalizers
92+
- networks/finalizers
93+
- proposals/finalizers
94+
- votes/finalizers
95+
- channels/finalizers
96+
- chaincodebuilds/finalizers
97+
- ibpcas/status
98+
- ibppeers/status
99+
- ibporderers/status
100+
- ibpconsoles/status
101+
- organizations/status
102+
- federations/status
103+
- networks/status
104+
- proposals/status
105+
- votes/status
106+
- channels/status
107+
- chaincodebuilds/status
108+
- chaincodes
109+
- chaincodes/status
110+
- endorsepolicies
111+
- endorsepolicies/status
112+
verbs:
113+
- get
114+
- list
115+
- watch
116+
- apiGroups:
117+
- iam.tenxcloud.com
118+
resources:
119+
- users.iam.tenxcloud.com
120+
- users
121+
verbs:
122+
- get
123+
- list
124+
- watch
125+
- apiGroups:
126+
- tekton.dev
127+
resources:
128+
- pipelineruns
129+
- taskruns
130+
verbs:
131+
- get
132+
- list
133+
- watch
134+
---
135+
apiVersion: rbac.authorization.k8s.io/v1
136+
kind: ClusterRoleBinding
137+
metadata:
138+
name: bc-saas
139+
roleRef:
140+
apiGroup: rbac.authorization.k8s.io
141+
kind: ClusterRole
142+
name: bc-saas
143+
subjects:
144+
- kind: ServiceAccount
145+
name: bc-saas
146+
namespace: baas-system

‎deploy/secret.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
data:
3+
# cat networ.json | base64
4+
network.json: ewogICJpZCI6ICJuZXR3b3JrLXNhbXBsZTMiLAogICJwbGF0Zm9ybSI6ICJiZXN0Y2hhaW5zIiwKICAiZmFiUHJvZmlsZSI6IHsKICAgICJjaGFubmVsIjogImNoYW5uZWxpZCIsCiAgICAib3JnYW5pemF0aW9uIjogIm9yZzEiLAogICAgInVzZXIiOiB7CiAgICAgICJuYW1lIjogIm9yZzFhZG1pbiIsCiAgICAgICJrZXkiOiB7CiAgICAgICAgInBlbSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZ25hVHNIOGNQT2NWMFZndm5cbng0WjFoSVVwVjFLZzJranp1MXgzRTdvTTU5bWhSQU5DQUFROU1qd2QxNkRtU2V5RWlaVjVrUTA0dFVGckpNeGtcbnNsVERtQnJjMXZGa1Bxek1IMUxHQ3NuMnc4Z0t3Y2lzYm96OGVDN21KUGZTOGVSOXdLNHcvYVF4XG4tLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tXG4iCiAgICAgIH0sCiAgICAgICJjZXJ0IjogewogICAgICAgICJwZW0iOiAiLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlERHpDQ0FyZWdBd0lCQWdJVVYwbElpQzNOTlVyKzY5Y1ZVeTh2NmkwZ3htMHdDZ1lJS29aSXpqMEVBd0l3XG5YekVMTUFrR0ExVUVCaE1DVlZNeEZ6QVZCZ05WQkFnVERrNXZjblJvSUVOaGNtOXNhVzVoTVJRd0VnWURWUVFLXG5Fd3RJZVhCbGNteGxaR2RsY2pFUE1BMEdBMVVFQ3hNR1JtRmljbWxqTVJBd0RnWURWUVFERXdkdmNtY3hMV05oXG5NQjRYRFRJek1EUXhPREExTXpjd01Gb1hEVEkwTURReE56QTFORFF3TUZvd0pERU9NQXdHQTFVRUN4TUZZV1J0XG5hVzR4RWpBUUJnTlZCQU1UQ1c5eVp6RmhaRzFwYmpCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBXG5CRDB5UEIzWG9PWko3SVNKbFhtUkRUaTFRV3NrekdTeVZNT1lHdHpXOFdRK3JNd2ZVc1lLeWZiRHlBckJ5S3h1XG5qUHg0THVZazk5THg1SDNBcmpEOXBER2pnZ0dLTUlJQmhqQU9CZ05WSFE4QkFmOEVCQU1DQjRBd0RBWURWUjBUXG5BUUgvQkFJd0FEQWRCZ05WSFE0RUZnUVVwcnZlZG9wa0dSZmVZc3hITEk4Q3AzaG9aYXd3SHdZRFZSMGpCQmd3XG5Gb0FVTysrRVNlOGFGVE52RDk4MldDT3lLeFRnU1Qwd0xnWURWUjBSQkNjd0pZSWpZMjl1ZEhKdmJHeGxjaTF0XG5ZVzVoWjJWeUxUVm1aRGhtWXpjMU5HTXRPWFJ6Wmprd2dmVUdDQ29EQkFVR0J3Z0JCSUhvZXlKaGRIUnljeUk2XG5leUpvWmk1QlptWnBiR2xoZEdsdmJpSTZJaUlzSW1obUxrVnVjbTlzYkcxbGJuUkpSQ0k2SW05eVp6RmhaRzFwXG5iaUlzSW1obUxrZGxia05TVENJNkluUnlkV1VpTENKb1ppNUpiblJsY20xbFpHbGhkR1ZEUVNJNkluUnlkV1VpXG5MQ0pvWmk1U1pXZHBjM1J5WVhJdVVtOXNaWE1pT2lJcUlpd2lhR1l1VW1WbmFYTjBjbUZ5UkdWc1pXZGhkR1ZTXG5iMnhsY3lJNklpb2lMQ0pvWmk1U1pYWnZhMlZ5SWpvaUtpSXNJbWhtTGxSNWNHVWlPaUpoWkcxcGJpSXNJbWhtXG5MbWhtTGxKbFoybHpkSEpoY2k1QmRIUnlhV0oxZEdWeklqb2lLaUo5ZlRBS0JnZ3Foa2pPUFFRREFnTkdBREJEXG5BaUJwQjEzT2pES0kvcVU3L1FJOEw4YzFLbkNOSmtkY0QwQk9jd3B3S3NPcU1BSWZFWHNnMGRNTGpPc1UxSm0wXG5vVUNRTnJsUlc5d2xUL294YlN0WHBwY0ZOZz09XG4tLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tXG4iCiAgICAgIH0KICAgIH0sCiAgICAiZW5kcG9pbnQiOiB7CiAgICAgICJ1cmwiOiAiZ3JwY3M6Ly9vcmcxLW9yZzFwZWVyMS1wZWVyLjE3Mi4xOC4wLjQubmlwLmlvOjQ0MyIsCiAgICAgICJ0bHNDQUNlcnRzIjogewogICAgICAgICJwZW0iOiAiLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlDQnpDQ0FhNmdBd0lCQWdJVU1CTVMyN1FQeHlMdFZySHRHSUJKY3dxdUYwMHdDZ1lJS29aSXpqMEVBd0l3XG5ZakVMTUFrR0ExVUVCaE1DVlZNeEZ6QVZCZ05WQkFnVERrNXZjblJvSUVOaGNtOXNhVzVoTVJRd0VnWURWUVFLXG5Fd3RJZVhCbGNteGxaR2RsY2pFUE1BMEdBMVVFQ3hNR1JtRmljbWxqTVJNd0VRWURWUVFERXdwdmNtY3hMWFJzXG5jMk5oTUI0WERUSXpNRFF4T0RBMU16Y3dNRm9YRFRNNE1EUXhOREExTXpjd01Gb3dZakVMTUFrR0ExVUVCaE1DXG5WVk14RnpBVkJnTlZCQWdURGs1dmNuUm9JRU5oY205c2FXNWhNUlF3RWdZRFZRUUtFd3RJZVhCbGNteGxaR2RsXG5jakVQTUEwR0ExVUVDeE1HUm1GaWNtbGpNUk13RVFZRFZRUURFd3B2Y21jeExYUnNjMk5oTUZrd0V3WUhLb1pJXG56ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVsc2JGRFFlL1FGd1pvUkJyYkxwNnpRVHl4RCtTR0RoaS83aHNoQ2QvXG5jTU5ZQURxdXNkakhTSW9yVGlUZWdTOS82OWlVejVST2VGdXJjU2ZIeEdJNGdhTkNNRUF3RGdZRFZSMFBBUUgvXG5CQVFEQWdFR01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZLbG9jdi9HaGs5TmtxNi96em92XG51YnhsSHJ3ME1Bb0dDQ3FHU000OUJBTUNBMGNBTUVRQ0lIb1ltK2NjZ1locXZYbmc4eVhEdmVkcVMxd3NKUG1YXG45WTFQOVovNDRpNnpBaUJ0a2U2SnFUcml4djl5b3JxNUp0QkdzMTJxVS9sc1dpZzdud0tGU2RRS3NBPT1cbi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS1cbiIKICAgICAgfQogICAgfQogIH0KfQo=
5+
kind: Secret
6+
metadata:
7+
name: bc-saas-secret
8+
namespace: baas-system

‎deploy/service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: bc-saas-service
5+
namespace: baas-system
6+
spec:
7+
selector:
8+
app: bc-saas
9+
ports:
10+
- protocol: TCP
11+
port: 9999
12+
targetPort: 9999

0 commit comments

Comments
 (0)