New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dex configuration change do not apply properly on running Dex Pods #2569

Closed

TeddyAndrieux opened this issue May 25, 2020 · 0 comments

Assignees

Labels

complexity:medium kind:bug priority:high topic:authentication topic:tests

Milestone

Collaborator

TeddyAndrieux commented May 25, 2020 •

edited

Loading

Component:

'tests', 'authentication'

What happened:

The Dex configuration is stored in a secret, mounted in the Dex Pods. If the secret change the file is automatically changed in the Dex Pods but as Dex process does not restart he still uses the old config.

Like explained in the docs for CSC to apply a change for Dex you need to manually restart the Dex Pods

What was expected:

Do not need user action to properly deploy the Dex config changes on all running Dex deployment (handled automatically by the salt state)

This Bug should have been seen in CSC test.

Steps to reproduce

Change the Dex secret (or the Dex CSC) and apply Dex salt state.

Resolution proposal (optional):

~~Add an annotations metalk8s.scality.com/config-digest~~ Use the checksum/config annotation on the Dex Pod, containing a digest of the config file. So that when you apply the salt state and the config content changed the Pod will be re-created automatically. (same as the one we have for static pods)
Remove the rollout command from the CSC doc
Add a new test to check that after a CSC update for Dex the change get applied on the running Pods as excepted

The text was updated successfully, but these errors were encountered:

TeddyAndrieux added kind:bug topic:tests complexity:medium topic:authentication priority:high labels

TeddyAndrieux self-assigned this

TeddyAndrieux added a commit that referenced this issue


          charts: re-render the dex charts to use checksum/config

e8d6cdd

We need Dex Pods to restart when secret content change, so use the
`checksum/config` annotation on the Dex Pods. This annotation is equal
to the digest of the secret content

This chart is re-rendered using:

```
./charts/render.py dex --namespace metalk8s-auth charts/dex.yaml \
    --service-config dex metalk8s-dex-config \
    charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Fixes: #2569

TeddyAndrieux added a commit that referenced this issue


          Revert "docs: Add step to restart dex deployment after config changes"

d07e462

This reverts commit 1fb6804.

This rollout is not longer needed since it's automatically handled by
the salt states

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          charts: re-render the dex charts to use checksum/config

abaee43

We need Dex Pods to restart when secret content change, so use the
`checksum/config` annotation on the Dex Pods. This annotation is equal
to the digest of the secret content

This chart is re-rendered using:

```
./charts/render.py dex --namespace metalk8s-auth charts/dex.yaml \
    --service-config dex metalk8s-dex-config \
    charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Fixes: #2569

TeddyAndrieux added a commit that referenced this issue


          Revert "docs: Add step to restart dex deployment after config changes"

bb7eb27

This reverts commit 1fb6804.

This rollout is not longer needed since it's automatically handled by
the salt states

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

9e15106

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

dbb25c4

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux mentioned this issue

Add digest for dex config #2573

Merged

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

c3bc1d0

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

TeddyAndrieux added a commit that referenced this issue


          charts: re-render the dex charts to use checksum/config

75c84c4

We need Dex Pods to restart when secret content change, so use the
`checksum/config` annotation on the Dex Pods. This annotation is equal
to the digest of the secret content

This chart is re-rendered using:

```
./charts/render.py dex --namespace metalk8s-auth charts/dex.yaml \
    --service-config dex metalk8s-dex-config \
    charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Fixes: #2569

TeddyAndrieux added a commit that referenced this issue


          Revert "docs: Add step to restart dex deployment after config changes"

e72ce31

This reverts commit 1fb6804.

This rollout is not longer needed since it's automatically handled by
the salt states

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

e1f1cd1

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

c17e8e9

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

TeddyAndrieux added a commit that referenced this issue


          charts: re-render the dex charts to use checksum/config

3b51a4f

We need Dex Pods to restart when secret content change, so use the
`checksum/config` annotation on the Dex Pods. This annotation is equal
to the digest of the secret content

This chart is re-rendered using:

```
./charts/render.py dex --namespace metalk8s-auth charts/dex.yaml \
    --service-config dex metalk8s-dex-config \
    charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls
```

Fixes: #2569

TeddyAndrieux added a commit that referenced this issue


          Revert "docs: Add step to restart dex deployment after config changes"

59928f6

This reverts commit 1fb6804.

This rollout is not longer needed since it's automatically handled by
the salt states

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

2fa0e13

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

86a8a3a

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

119a88d

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

4e684ed

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

f9c24fe

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

f74e47d

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added this to the MetalK8s 2.5.1 milestone

TeddyAndrieux added a commit that referenced this issue


          Revert "docs: Add step to restart dex deployment after config changes"

458bf6b

This reverts commit 1fb6804.

This rollout is not longer needed since it's automatically handled by
the salt states

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          tests: Add scenario to test Admin static user password change

9fa09f8

Use CSC to change the password for the Admin static user and test login
with this new password on Dex

Refs: #2569

TeddyAndrieux added a commit that referenced this issue


          Merge remote-tracking branch 'origin/bugfix/GH-2569-add-digest-for-de…

c7e0b96

…x-config' into w/2.6/bugfix/GH-2569-add-digest-for-dex-config

bert-e added a commit that referenced this issue


          Merge branch 'bugfix/GH-2569-add-digest-for-dex-config' into q/2.5

ef488b2

bert-e added a commit that referenced this issue


          Merge branches 'w/2.6/bugfix/GH-2569-add-digest-for-dex-config' and '…

be0bfd0

…q/2573/2.5/bugfix/GH-2569-add-digest-for-dex-config' into tmp/octopus/q/2.6

bert-e closed this as completed in

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment