forked from helidon-io/helidon
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
4.1.7: Use helidon.oci prefix for OCI Config and allow some oci auth …
…types to accept federation-endpoint and tenancy-id (helidon-io#9765) * Use helidon.oci prefix for OCI Config and allow some oci auth types to accept federation-endpoint and tenancy-id (helidon-io#9740) The PR fixes Issues 9681 and 9734 which includes the following: 1. Allow instance-principal, resource-principal and oke-workload-identity to accept federation-endpoint and tenancy-id as config parameters. This is originally targeted just for oke-workload-identity where Instance Metadata Service (IMDS) does not work on an OKE environment. Because of these, it is unable to assemble the target endpoint as it needs the IMDS to retrieve the region. To resolve the issue, the federation-endpoint configuration is now allowed to be explicitly specified to avoid generation of endpoint using the region from IMDS. In some examples of the use of oke-workload-identity, the tenancy id is required, so this configuration parameter is also added as an option. Furthermore, because instance-principal and resource-principal providers extends AbstractRequestingAuthenticationDetailsProvider similar to oke-workload-instance, hence they are included in the change to allow those optional parameters. 2. Fix a bug where the oci configuration does not work when prefixed with "helidon.oci". 3. Add comprehensive testing coverage for above changes. 4. Remove unnecessary Weight annotation with default value and replace WARNING message with TRACE when oci config does not use "helidon.oci" * Adjust unit tests because of a problem with combineDependencies in the generated sources --------- Co-authored-by: Keith Lustria <[email protected]>
- Loading branch information
Showing
18 changed files
with
380 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -30,6 +30,7 @@ jaxb.index | |
| /MANIFEST.MF | ||
| /README | ||
| /CONTRIBUTING.md | ||
| .crt | ||
| .pem | ||
| .p8 | ||
| .pkcs8.pem | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
71 changes: 71 additions & 0 deletions
71
...n/integrations/oci/authentication/instance/AuthenticationMethodInstancePrincipalTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| /* | ||
| * Copyright (c) 2025 Oracle and/or its affiliates. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package io.helidon.integrations.oci.authentication.instance; | ||
|
|
||
| import java.util.Properties; | ||
|
|
||
| import io.helidon.service.registry.ServiceRegistry; | ||
| import io.helidon.service.registry.ServiceRegistryManager; | ||
|
|
||
| import com.oracle.bmc.auth.InstancePrincipalsAuthenticationDetailsProvider; | ||
| import org.junit.jupiter.api.AfterEach; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import static org.hamcrest.CoreMatchers.is; | ||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
|
|
||
| public class AuthenticationMethodInstancePrincipalTest { | ||
| private static ServiceRegistryManager registryManager; | ||
| private static ServiceRegistry registry; | ||
|
|
||
| void setUp(Properties p) { | ||
| p.put("helidon.oci.authentication-method", "instance-principal"); | ||
| p.put("helidon.oci.imds-timeout", "PT1S"); | ||
| p.put("helidon.oci.imds-detect-retries", "0"); | ||
| System.setProperties(p); | ||
|
|
||
| registryManager = ServiceRegistryManager.create(); | ||
| registry = registryManager.registry(); | ||
| } | ||
|
|
||
| @AfterEach | ||
| void cleanUp() { | ||
| registry = null; | ||
| if (registryManager != null) { | ||
| registryManager.shutdown(); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testInstancePrincipalConfigurationAndInstantiation() { | ||
| final String IMDS_BASE_URI = "http://localhost:8000/opc/v2/"; | ||
| final String FEDERATION_ENDPOINT = "https://auth.us-myregion-1.oraclecloud.com"; | ||
| final String TENANT_ID = "ocid1.tenancy.oc1..mytenancyid"; | ||
|
|
||
| Properties p = System.getProperties(); | ||
| p.put("helidon.oci.imds-base-uri", IMDS_BASE_URI); | ||
| p.put("helidon.oci.federation-endpoint", FEDERATION_ENDPOINT); | ||
| p.put("helidon.oci.tenant-id", TENANT_ID); | ||
| setUp(p); | ||
|
|
||
| var builder = registry.get(InstancePrincipalsAuthenticationDetailsProvider.InstancePrincipalsAuthenticationDetailsProviderBuilder.class); | ||
| // The following validation indicates that the instance principal provider has been configured properly | ||
| assertThat(builder.getMetadataBaseUrl(), is(IMDS_BASE_URI)); | ||
| assertThat(builder.getFederationEndpoint(), is(FEDERATION_ENDPOINT)); | ||
| assertThat(builder.getTenancyId(), is(TENANT_ID)); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 74 additions & 0 deletions
74
...idon/integrations/oci/authentication/okeworkload/AuthenticationMethodOkeWorkloadTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /* | ||
| * Copyright (c) 2025 Oracle and/or its affiliates. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package io.helidon.integrations.oci.authentication.okeworkload; | ||
|
|
||
| import java.util.Properties; | ||
|
|
||
| import io.helidon.service.registry.ServiceRegistry; | ||
| import io.helidon.service.registry.ServiceRegistryManager; | ||
|
|
||
| import com.oracle.bmc.auth.BasicAuthenticationDetailsProvider; | ||
| import com.oracle.bmc.auth.okeworkloadidentity.OkeWorkloadIdentityAuthenticationDetailsProvider.OkeWorkloadIdentityAuthenticationDetailsProviderBuilder; | ||
| import org.junit.jupiter.api.AfterEach; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import static org.hamcrest.CoreMatchers.containsString; | ||
| import static org.hamcrest.CoreMatchers.is; | ||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
| import static org.junit.jupiter.api.Assertions.assertThrows; | ||
|
|
||
| public class AuthenticationMethodOkeWorkloadTest { | ||
| private static ServiceRegistryManager registryManager; | ||
| private static ServiceRegistry registry; | ||
|
|
||
| void setUp(Properties p) { | ||
| p.put("helidon.oci.authentication-method", "oke-workload-identity"); | ||
| System.setProperties(p); | ||
|
|
||
| registryManager = ServiceRegistryManager.create(); | ||
| registry = registryManager.registry(); | ||
| } | ||
|
|
||
| @AfterEach | ||
| void cleanUp() { | ||
| registry = null; | ||
| if (registryManager != null) { | ||
| registryManager.shutdown(); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testOkeWorkloadIdentityConfigurationAndInstantiation() { | ||
| final String FEDERATION_ENDPOINT = "https://auth.us-myregion-1.oraclecloud.com"; | ||
| final String TENANT_ID = "ocid1.tenancy.oc1..mytenancyid"; | ||
|
|
||
| Properties p = System.getProperties(); | ||
| p.put("helidon.oci.federation-endpoint", FEDERATION_ENDPOINT); | ||
| p.put("helidon.oci.tenant-id", TENANT_ID); | ||
| setUp(p); | ||
|
|
||
| // This error indicates that the oke-workload-identity provider has been instantiated | ||
| var thrown = assertThrows(IllegalArgumentException.class, | ||
| () -> registry.get(BasicAuthenticationDetailsProvider.class)); | ||
| assertThat(thrown.getMessage(), containsString("Invalid Kubernetes ca certification")); | ||
|
|
||
| var builder = registry.get(OkeWorkloadIdentityAuthenticationDetailsProviderBuilder.class); | ||
| // The following validation indicates that the oke-workload-identity provider has been configured properly | ||
| assertThat(builder.getFederationEndpoint(), is(FEDERATION_ENDPOINT)); | ||
| assertThat(builder.getTenancyId(), is(TENANT_ID)); | ||
| } | ||
| } |
4 changes: 4 additions & 0 deletions
4
integrations/oci/authentication/oke-workload/src/test/resources/dummy-ca.crt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| NOTICE: | ||
| ======= | ||
| This file represents a dummy ca.crt that will be used by the AuthenticationMethodOkeWorkload to validate if it can proceed with | ||
| authentication processing. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.