Skip to content

Commit fcca480

Browse files
thokra-navthokra-nav
authored
Merge pull request #200 from nais/nais-api-proto
Use nais-api instead of teams backend
2 parents 54bf62d + 4ed0afb commit fcca480

15 files changed

+3104
-150
lines changed

‎Makefile

+22
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ K8S_VERSION := 1.27.1
66
LAST_COMMIT = $(shell git rev-parse --short HEAD)
77
VERSION ?= $(DATE)-$(LAST_COMMIT)
88
LDFLAGS := -X github.com/nais/deploy/pkg/version.Revision=$(LAST_COMMIT) -X github.com/nais/deploy/pkg/version.Date=$(DATE) -X github.com/nais/deploy/pkg/version.BuildUnixTime=$(BUILDTIME)
9+
NAIS_API_COMMIT_SHA := 0f2590f0befcdc5473474007174bb4a5d0b1f97e
10+
NAIS_API_TARGET_DIR=pkg/naisapi/protoapi
911
arch := $(shell uname -m | sed s/aarch64/arm64/ | sed s/x86_64/amd64/)
1012
os := $(shell uname -s | tr '[:upper:]' '[:lower:]')
1113
testbin_dir := ./.testbin/
@@ -88,3 +90,23 @@ hookd-alpine:
8890

8991
deploy-alpine:
9092
go build -a -installsuffix cgo -o bin/deploy -ldflags "-s $(LDFLAGS)" ./cmd/deploy/
93+
94+
generate-nais-api:
95+
mkdir -p ./$(NAIS_API_TARGET_DIR)
96+
wget -O ./$(NAIS_API_TARGET_DIR)/teams.proto https://raw.githubusercontent.com/nais/api/$(NAIS_API_COMMIT_SHA)/pkg/protoapi/schema/teams.proto
97+
wget -O ./$(NAIS_API_TARGET_DIR)/users.proto https://raw.githubusercontent.com/nais/api/$(NAIS_API_COMMIT_SHA)/pkg/protoapi/schema/users.proto
98+
wget -O ./$(NAIS_API_TARGET_DIR)/pagination.proto https://raw.githubusercontent.com/nais/api/$(NAIS_API_COMMIT_SHA)/pkg/protoapi/schema/pagination.proto
99+
$(PROTOC) \
100+
--proto_path=$(NAIS_API_TARGET_DIR) \
101+
--go_opt=Mpagination.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
102+
--go_opt=Musers.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
103+
--go_opt=Mteams.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
104+
--go_opt=paths=source_relative \
105+
--go_out=$(NAIS_API_TARGET_DIR) \
106+
--go-grpc_opt=Mpagination.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
107+
--go-grpc_opt=Musers.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
108+
--go-grpc_opt=Mteams.proto=github.com/nais/deploy/$(NAIS_API_TARGET_DIR) \
109+
--go-grpc_opt=paths=source_relative \
110+
--go-grpc_out=$(NAIS_API_TARGET_DIR) \
111+
$(NAIS_API_TARGET_DIR)/*.proto
112+
rm -f $(NAIS_API_TARGET_DIR)/*.proto

‎charts/hookd/Feature.yaml

+5-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
dependencies:
22
- allOf:
3-
- teams-backend
3+
- nais-api
44
environmentKinds:
55
- management
66
values:
@@ -61,13 +61,12 @@ values:
6161
displayName: Ingress URL
6262
computed:
6363
template: '"{{ subdomain . "deploy" }}"'
64-
teamsAPIKey:
65-
displayName: "teams api key"
66-
computed:
67-
template: "{{.Management.hookd_teams_api_key | quote}}"
68-
description: "API key used for teams integration"
6964
frontendPreSharedKey:
7065
displayName: "console-backend pre-shared key"
7166
computed:
7267
template: "{{.Management.hookd_frontend_pre_shared_key | quote}}"
7368
description: "The pre-shared key used to authenticate the console-backend"
69+
naisAPI.insecure:
70+
displayName: Insecure connection to NAIS API
71+
config:
72+
type: bool

‎charts/hookd/templates/netpol.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@ spec:
2525
kubernetes.io/metadata.name: nais-system
2626
podSelector:
2727
matchLabels:
28-
app.kubernetes.io/instance: teams-backend
29-
app.kubernetes.io/name: teams-backend
28+
app: nais-api
3029
podSelector:
3130
matchLabels:
3231
{{- include "hookd.selectorLabels" . | nindent 6 }}

‎charts/hookd/templates/secret.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@ stringData:
2525
HOOKD_LOG_LINK_FORMATTER: "{{ .Values.logLinkFormatter }}"
2626
HOOKD_OAUTH_ENABLED: "true"
2727
HOOKD_PROVISION_KEY: "{{ .Values.provisionKey }}"
28-
HOOKD_TEAMS_API_KEY: "{{ .Values.teamsAPIKey }}"
29-
HOOKD_TEAMS_URL: "{{ .Values.teamsURL }}"
28+
HOOKD_NAIS_API_ADDRESS: "{{ .Values.naisAPI.address }}"
29+
HOOKD_NAIS_API_INSECURE_CONNECTION: "{{ .Values.naisAPI.insecureConnection }}"

‎charts/hookd/values.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -44,5 +44,6 @@ frontendPreSharedKey: # mapped by fasit
4444

4545
imagePullSecrets: []
4646

47-
teamsAPIKey: # mapped by fasit
48-
teamsURL: "http://teams-backend/query"
47+
naisAPI:
48+
address: "nais-api:3001"
49+
insecureConnection: "false"

‎cmd/hookd/main.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ import (
3131
"github.com/nais/deploy/pkg/hookd/logproxy"
3232
"github.com/nais/deploy/pkg/hookd/middleware"
3333
"github.com/nais/deploy/pkg/logging"
34+
"github.com/nais/deploy/pkg/naisapi"
3435
"github.com/nais/deploy/pkg/pb"
35-
"github.com/nais/deploy/pkg/teams"
3636
"github.com/nais/deploy/pkg/version"
3737
)
3838

@@ -179,8 +179,11 @@ func startGrpcServer(cfg config.Config, db database.DeploymentStore, apikeys dat
179179
return nil, nil, fmt.Errorf("unable to set up github validator: %w", err)
180180
}
181181

182-
teamsClient := teams.New(cfg.TeamsURL, cfg.TeamsAPIKey)
183-
authInterceptor := auth_interceptor.NewServerInterceptor(apikeys, ghValidator, teamsClient)
182+
apiClient, err := naisapi.NewClient(cfg.NaisAPIAddress, cfg.NaisAPIInsecureConnection)
183+
if err != nil {
184+
return nil, nil, fmt.Errorf("unable to set up nais-api client: %w", err)
185+
}
186+
authInterceptor := auth_interceptor.NewServerInterceptor(apikeys, ghValidator, apiClient)
184187

185188
interceptor.Add(pb.Deploy_ServiceDesc.ServiceName, authInterceptor)
186189
log.Infof("Authentication enabled for deployment requests")

‎pkg/hookd/config/config.go

+22-22
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,24 @@ type GRPC struct {
1616
}
1717

1818
type Config struct {
19-
BaseURL string `json:"base-url"`
20-
DatabaseConnectTimeout time.Duration `json:"database-connect-timeout"`
21-
DatabaseEncryptionKey string `json:"database-encryption-key"`
22-
DatabaseURL string `json:"database-url"`
23-
DeploydKeys []string `json:"deployd-keys"`
24-
FrontendKeys []string `json:"frontend-keys"`
25-
GRPC GRPC `json:"grpc"`
26-
GoogleAllowedDomains []string `json:"google-allowed-domains"`
27-
GoogleClientId string `json:"google-client-id"`
28-
GoogleClusterProjects []string `json:"google-cluster-projects"`
29-
ListenAddress string `json:"listen-address"`
30-
LogFormat string `json:"log-format"`
31-
LogLevel string `json:"log-level"`
32-
LogLinkFormatter string `json:"log-link-formatter"`
33-
MetricsPath string `json:"metrics-path"`
34-
ProvisionKey string `json:"provision-key"`
35-
TeamsAPIKey string `json:"teams-api-key"`
36-
TeamsURL string `json:"teams-url"`
19+
BaseURL string `json:"base-url"`
20+
DatabaseConnectTimeout time.Duration `json:"database-connect-timeout"`
21+
DatabaseEncryptionKey string `json:"database-encryption-key"`
22+
DatabaseURL string `json:"database-url"`
23+
DeploydKeys []string `json:"deployd-keys"`
24+
FrontendKeys []string `json:"frontend-keys"`
25+
GRPC GRPC `json:"grpc"`
26+
GoogleAllowedDomains []string `json:"google-allowed-domains"`
27+
GoogleClientId string `json:"google-client-id"`
28+
GoogleClusterProjects []string `json:"google-cluster-projects"`
29+
ListenAddress string `json:"listen-address"`
30+
LogFormat string `json:"log-format"`
31+
LogLevel string `json:"log-level"`
32+
LogLinkFormatter string `json:"log-link-formatter"`
33+
MetricsPath string `json:"metrics-path"`
34+
ProvisionKey string `json:"provision-key"`
35+
NaisAPIAddress string `json:"nais-api-address"`
36+
NaisAPIInsecureConnection bool `json:"nais-api-insecure-connection"`
3737
}
3838

3939
const (
@@ -56,8 +56,8 @@ const (
5656
LogLinkFormatter = "log-link-formatter"
5757
MetricsPath = "metrics-path"
5858
ProvisionKey = "provision-key"
59-
TeamsAPIKey = "teams-api-key"
60-
TeamsURL = "teams-url"
59+
NaisAPIAddress = "nais-api-address"
60+
NaisAPIInsecureConnection = "nais-api-insecure-connection"
6161
)
6262

6363
// Bind environment variables provided by the NAIS platform
@@ -99,8 +99,8 @@ func Initialize() *Config {
9999
flag.StringSlice(GoogleAllowedDomains, []string{}, "Allowed Google Domains")
100100
flag.StringSlice(GoogleClusterProjects, []string{}, "Mapping cluster to google project: cluster1=project1,cluster2=project2")
101101

102-
flag.String(TeamsAPIKey, "", "Teams API Key")
103-
flag.String(TeamsURL, "http://localhost:3000/query", "Teams URL")
102+
flag.Bool(NaisAPIInsecureConnection, false, "Insecure connection to API server")
103+
flag.String(NaisAPIAddress, "localhost:3001", "NAIS API target")
104104

105105
return &Config{}
106106
}

‎pkg/naisapi/naisapi.go

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package naisapi
2+
3+
import (
4+
"context"
5+
"fmt"
6+
7+
"github.com/nais/deploy/pkg/naisapi/protoapi"
8+
log "github.com/sirupsen/logrus"
9+
"google.golang.org/grpc"
10+
"google.golang.org/grpc/credentials/insecure"
11+
)
12+
13+
type Client struct {
14+
client protoapi.TeamsClient
15+
}
16+
17+
func NewClient(target string, insecureConnection bool) (*Client, error) {
18+
opts := []grpc.DialOption{}
19+
if insecureConnection {
20+
opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
21+
}
22+
23+
gclient, err := grpc.Dial(target, opts...)
24+
if err != nil {
25+
return nil, fmt.Errorf("failed to connect to nais-api: %w", err)
26+
}
27+
28+
return &Client{
29+
client: protoapi.NewTeamsClient(gclient),
30+
}, nil
31+
}
32+
33+
func (c *Client) IsAuthorized(ctx context.Context, repo, team string) bool {
34+
resp, err := c.client.IsRepositoryAuthorized(ctx, &protoapi.IsRepositoryAuthorizedRequest{
35+
TeamSlug: team,
36+
Repository: repo,
37+
Authorization: protoapi.RepositoryAuthorization_DEPLOY,
38+
})
39+
if err != nil {
40+
log.WithError(err).Error("checking repo authorization in teams")
41+
return false
42+
}
43+
44+
return resp.IsAuthorized
45+
}

‎pkg/naisapi/protoapi/pagination.pb.go

+163
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)