Enhancement to support the httpd authentication configuration map. #201

abellotti · 2017-08-17T21:27:05Z

Added new httpd-auth-configs config map to the templates
mounted the new configmap for httpd pod as /etc/httpd/auth-conf.d
updated teardown script to handle the new config map

- Added new httpd-auth-configs config map to the templates - mounted the new configmap for httpd pod as /etc/httpd/auth-conf.d - updated teardown script to handle the new config map

carbonin · 2017-08-18T13:18:15Z

@abellotti Can you add something to the README about how to specify the other external auth files? Should they be added to the same ConfigMap?

Also, is any guidance needed around what files should be added for which authentication types?

abellotti · 2017-08-18T13:36:36Z

Stuff here should be generic, I can move the config map/config file syntax out of the templates into the README and maybe give a single example. Yes, they go to the same httpd-auth-configs map.

The guidance/list of files generated for each auth type will go in the new repo (scripts configuring the different ext-auth and creating the configmap that users can update here and restart their httpd pod), probably ManageIQ/container-httpd-auth-config, coming soon.

carbonin · 2017-08-18T13:40:07Z

will go in the new repo

Ah, I didn't know there was more. My concern was that this felt like we were leaving too much up to the user to figure out how to configure this stuff. It sounds like this repo will accomplish what I was looking for.

In that case a link from the README here to that repo with a sentence or two will probably be enough.

…ile. - Updated template's Auth Configmap usage details to reference the README file.

abellotti · 2017-08-18T18:41:50Z

/cc @carbonin updated for you. simplified config maps, referencing this pod's README which has all details, with reference to future container-httpd-auth-config repo for auto-generating those puppies.

carbonin · 2017-08-18T19:05:54Z

README.md

+$ oc edit configmaps httpd-auth-configs
+```
+
+Then rebouncing the _httpd_ pod for the new authentication configuration to take effect.


I think "redeploy the httpd pod" or "rollout a new httpd deployment" here rather than "rebouncing the httpd pod"

carbonin · 2017-08-18T19:06:39Z

templates/miq-template.yaml

@@ -963,6 +978,10 @@ parameters:
  displayName: Apache Configuration Directory
  description: Directory used to store the Apache configuration files.
  value: "/etc/httpd/conf.d"
+- name: HTTPD_AUTH_CONFIG_DIR
+  displayName: External Authentication Configuration Directory
+  description: Directory used to store the exxternal authentication configuration files.


Typo, s/exxternal/external/

👍 fixed.

… redeploying the httpd pod.

carbonin

Looks good to me. Do we want to wait until we have the other referenced repo in place for this change?

abellotti · 2017-08-18T19:36:12Z

hmm, might take a week or two to get the other repo up. I do need this merged in now though. I could remove the reference for now until the other is live, then re-add that paragraph in the README.md then, thoughts ?

carbonin · 2017-08-18T19:55:32Z

Yeah, I think that's probably for the best.

When we have the other repo up and running we'll re-add the info about it.

…d-auth-config. We will re-add once that repo/pod is available. Removed text: Support for automatically generating authentication configuration maps for _httpd_ will be provided by [ManageIQ/container-httpd-auth-config](https://github.com/ManageIQ/container-httpd-auth-config). Please see the [README.md](https://github.com/ManageIQ/container-httpd-auth-config/blob/master/README.md) in that repo for further details. The generated authentication configuration map can then be defined in the _httpd_ pod and further customized as follows: ```bash $ oc edit configmaps httpd-auth-configs ```

abellotti · 2017-08-18T20:07:58Z

👍 done. 7d783ba

abellotti · 2017-08-22T13:08:01Z

ping @bdunne

- kick off the /usr/bin/entrypoint via a postStart lifecycle hook. - declare the authentication type as a config map auth-type key. - expose the auth-type key as an HTTPD_AUTH_TYPE environment variable. Updated README.md for the auth config map changes.

Fryguy · 2017-08-25T21:28:10Z

README.md

@@ -541,3 +541,100 @@ $ oc new-app --template=manageiq \
  -p APPLICATION_IMG_TAG=latest \
  ...
 ```
+
+## Configuring External Authentication
+Configuring the _httpd_ pod for external authentication is done by updating the _httpd-auth-configs_ configuration map to include all necessary config files and certificates. Upon startup, the _httpd_ pod overlays its files with the ones specified in the _auth-configuration.conf_ file in the configuration map. This is done by the _initialize-httpd-auth_ service that runs before _httpd_.


Instead of italics can you use backticks, to make it preformatted? I find it hard to read with italics. (pretty much everywhere in these changes

Fryguy · 2017-08-25T21:30:18Z

templates/miq-template-ext-db.yaml

+    auth-configuration.conf: |
+      # External Authentication Configuration File
+      #
+      # For details on usage please see https://github.com/ManageIQ/manageiq-pods/blob/master/README.md


You can actually link directly to your new section with :

https://github.com/ManageIQ/manageiq-pods/blob/master/README.md#configuring-external-authentication

…thentication.

…environment

miq-bot · 2017-08-29T12:19:08Z

Checked commits abellotti/manageiq-pods@7abe98b~...6465faa with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
0 files checked, 0 offenses detected
Everything looks fine. ⭐

carbonin

More approval from me. Anything you want to add @Fryguy @bdunne ?

Fryguy · 2017-08-29T18:54:54Z

LGTM

Enhancement to support the httpd authentication configuration map.

7abe98b

- Added new httpd-auth-configs config map to the templates - mounted the new configmap for httpd pod as /etc/httpd/auth-conf.d - updated teardown script to handle the new config map

abellotti mentioned this pull request Aug 17, 2017

Added support for an httpd authentication configuration map ManageIQ/container-httpd#12

Merged

- Moved details on the auth-configuration.conf file into the README f…

7f2e61a

…ile. - Updated template's Auth Configmap usage details to reference the README file.

carbonin reviewed Aug 18, 2017

View reviewed changes

Fixed typos in the miq-templates* and better wording in README.md for…

5c3ed79

… redeploying the httpd pod.

carbonin added enhancement fine/no labels Aug 18, 2017

carbonin approved these changes Aug 18, 2017

View reviewed changes

carbonin requested a review from bdunne August 18, 2017 19:16

abellotti changed the title ~~Enhancement to support the httpd authentication configuration map.~~ [WIP] Enhancement to support the httpd authentication configuration map. Aug 25, 2017

miq-bot added the wip label Aug 25, 2017

abellotti changed the title ~~[WIP] Enhancement to support the httpd authentication configuration map.~~ Enhancement to support the httpd authentication configuration map. Aug 25, 2017

miq-bot removed the wip label Aug 25, 2017

Fryguy reviewed Aug 25, 2017

View reviewed changes

abellotti added 2 commits August 28, 2017 13:48

Improving readability of README.md section on configuring external au…

11b5bb7

…thentication.

Renamed httpd pod postStart script from entrypoint to save-container-…

6465faa

…environment

carbonin approved these changes Aug 29, 2017

View reviewed changes

carbonin self-assigned this Aug 29, 2017

carbonin added this to the Sprint 68 Ending Sep 4, 2017 milestone Aug 29, 2017

carbonin merged commit a781640 into ManageIQ:master Aug 29, 2017

abellotti deleted the ext-auth-configmap branch September 8, 2017 18:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enhancement to support the httpd authentication configuration map. #201

Enhancement to support the httpd authentication configuration map. #201

abellotti commented Aug 17, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017 •

edited

Loading

carbonin Aug 18, 2017

carbonin Aug 18, 2017

abellotti Aug 18, 2017

carbonin left a comment

abellotti commented Aug 18, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017

abellotti commented Aug 22, 2017

Fryguy Aug 25, 2017 •

edited

Loading

Fryguy Aug 25, 2017

miq-bot commented Aug 29, 2017

carbonin left a comment

Fryguy commented Aug 29, 2017

Enhancement to support the httpd authentication configuration map. #201

Enhancement to support the httpd authentication configuration map. #201

Conversation

abellotti commented Aug 17, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017 • edited Loading

carbonin Aug 18, 2017

Choose a reason for hiding this comment

carbonin Aug 18, 2017

Choose a reason for hiding this comment

abellotti Aug 18, 2017

Choose a reason for hiding this comment

carbonin left a comment

Choose a reason for hiding this comment

abellotti commented Aug 18, 2017

carbonin commented Aug 18, 2017

abellotti commented Aug 18, 2017

abellotti commented Aug 22, 2017

Fryguy Aug 25, 2017 • edited Loading

Choose a reason for hiding this comment

Fryguy Aug 25, 2017

Choose a reason for hiding this comment

miq-bot commented Aug 29, 2017

carbonin left a comment

Choose a reason for hiding this comment

Fryguy commented Aug 29, 2017

abellotti commented Aug 18, 2017 •

edited

Loading

Fryguy Aug 25, 2017 •

edited

Loading