Skip to content

Commit 55e7a9e

Browse files
Brutus5000Brutus5000
committed
Transition to Ory Hydra 2 (in parallel)
1 parent 145ea18 commit 55e7a9e

File tree

13 files changed

+283
-0
lines changed

13 files changed

+283
-0
lines changed

‎apps/faf-user-service/templates/config-hydra2.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: faf-user-service-hydra2
5+
labels:
6+
app: faf-user-service-hydra2
7+
data:
8+
# Only for testing environments
9+
FAF_ENVIRONMENT: {{ eq .Values.environment "prod" | ternary "" .Values.environment }}
10+
REAL_IP_HEADER: "Cf-Connecting-Ip"
11+
PASSWORD_RESET_URL: "https://www.{{.Values.baseDomain}}/account/password/reset"
12+
REGISTER_ACCOUNT_URL: "https://www.{{.Values.baseDomain}}/account/register"
13+
ACTIVATION_URL_FORMAT: "https://user.{{.Values.baseDomain}}/register/activate?token=%s"
14+
FAILED_LOGIN_ACCOUNT_THRESHOLD: "5"
15+
FAILED_LOGIN_ATTEMPT_THRESHOLD: "10"
16+
FAILED_LOGIN_THROTTLING_MINUTES: "5"
17+
FAILED_LOGIN_DAYS_TO_CHECK: "1"
18+
HYDRA_TOKEN_ISSUER: "https://login.{{.Values.baseDomain}}"
19+
HYDRA_JWKS_URL: "https://login.{{.Values.baseDomain}}/.well-known/jwks.json"
20+
HYDRA_BASE_ADMIN_URL: "http://ory-hydra2:4445"
21+
DB_URL: "jdbc:mariadb://mariadb:3306/faf_lobby?ssl=false"
22+
DB_USERNAME: "faf-user-service"
23+
DB_DATABASE: "faf_lobby" # for mariadb init script
24+
LOBBY_URL: "wss://ws.{{.Values.baseDomain}}"
25+
IRC_TOKEN_TTL: "300"
26+
JAVA_OPTS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"

‎apps/faf-user-service/templates/deployment-hydra2.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: faf-user-service-hydra2
6+
labels:
7+
app: faf-user-service-hydra2
8+
annotations:
9+
reloader.stakater.com/auto: "true"
10+
spec:
11+
replicas: 1
12+
revisionHistoryLimit: 10
13+
selector:
14+
matchLabels:
15+
app: faf-user-service-hydra2
16+
template:
17+
metadata:
18+
labels:
19+
app: faf-user-service-hydra2
20+
annotations:
21+
prometheus.io/scrape: 'true'
22+
prometheus.io/port: '8081'
23+
prometheus.io/path: '/actuator/prometheus'
24+
spec:
25+
containers:
26+
- image: faforever/faf-user-service:3.2.0-RC2
27+
imagePullPolicy: Always
28+
name: faf-user-service
29+
envFrom:
30+
- configMapRef:
31+
name: faf-user-service-hydra2
32+
- secretRef:
33+
name: faf-user-service
34+
volumeMounts:
35+
- name: mail-templates
36+
mountPath: /config/mail/
37+
readOnly: true
38+
ports:
39+
- containerPort: 8080
40+
startupProbe:
41+
httpGet:
42+
port: 8080
43+
path: /q/health
44+
failureThreshold: 10
45+
periodSeconds: 3
46+
livenessProbe:
47+
httpGet:
48+
port: 8080
49+
path: /q/health
50+
failureThreshold: 3
51+
periodSeconds: 10
52+
restartPolicy: Always
53+
volumes:
54+
- name: mail-templates
55+
configMap:
56+
name: faf-user-service-mail-templates

‎apps/faf-user-service/templates/ingress.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,9 @@ spec:
1111
services:
1212
- name: faf-user-service
1313
port: 8080
14+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
15+
- match: Host(`user-nx.{{.Values.baseDomain}}`)
16+
kind: Rule
17+
services:
18+
- name: faf-user-service-hydra2
19+
port: 8080

‎apps/faf-user-service/templates/service-hydra2.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: faf-user-service-hydra2
6+
labels:
7+
app: faf-user-service-hydra2
8+
spec:
9+
selector:
10+
app: faf-user-service-hydra2
11+
ports:
12+
- port: 8080
13+
targetPort: 8080

‎apps/ory-hydra2/Chart.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: ory-hydra2
3+
version: 1.0.0

‎apps/ory-hydra2/templates/config.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra2
8+
data:
9+
URLS_SELF_ISSUER: "https://login.{{.Values.baseDomain}}"
10+
URLS_LOGIN: "https://user-nx.{{.Values.baseDomain}}/oauth2/login"
11+
URLS_CONSENT: "https://user-nx.{{.Values.baseDomain}}/oauth2/consent"
12+
STRATEGIES_ACCESS_TOKEN: "jwt"
13+
OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE: "true"
14+
# These are only used for postgres init script, it is redundant in the DSN secret! Don't forget to also create a secret for DB_PASSWORD
15+
DB_USER: "hydra"
16+
DB_NAME: "ory-hydra"

‎apps/ory-hydra2/templates/deployment.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: ory-hydra2
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra2
8+
annotations:
9+
reloader.stakater.com/auto: "true"
10+
spec:
11+
replicas: 1
12+
revisionHistoryLimit: 10
13+
selector:
14+
matchLabels:
15+
app: ory-hydra2
16+
template:
17+
metadata:
18+
labels:
19+
app: ory-hydra2
20+
annotations:
21+
prometheus.io/scrape: 'false'
22+
spec:
23+
containers:
24+
- image: oryd/hydra:v2.3.0
25+
imagePullPolicy: Always
26+
name: ory-hydra2
27+
envFrom:
28+
- configMapRef:
29+
name: ory-hydra2
30+
- secretRef:
31+
name: ory-hydra2
32+
ports:
33+
- containerPort: 4444
34+
- containerPort: 4445
35+
restartPolicy: Always

‎apps/ory-hydra2/templates/ingress.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: traefik.io/v1alpha1
2+
kind: IngressRoute
3+
metadata:
4+
name: ory-hydra2
5+
spec:
6+
entryPoints:
7+
- websecure
8+
routes:
9+
- match: Host(`login.{{.Values.baseDomain}}`)
10+
kind: Rule
11+
services:
12+
- name: ory-hydra2
13+
port: 4444

‎apps/ory-hydra2/templates/janitor-cronjob.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
kind: CronJob
2+
apiVersion: batch/v1
3+
metadata:
4+
name: ory-hydra-janitor
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra-janitor
8+
spec:
9+
# Once per hour
10+
schedule: "0 * * * *"
11+
suspend: true
12+
concurrencyPolicy: Forbid
13+
jobTemplate:
14+
metadata:
15+
labels:
16+
app: ory-hydra-janitor
17+
annotations:
18+
prometheus.io/scrape: 'false'
19+
spec:
20+
template:
21+
spec:
22+
containers:
23+
- image: oryd/hydra:v2.3.0
24+
imagePullPolicy: Always
25+
name: ory-hydra
26+
envFrom:
27+
- configMapRef:
28+
name: ory-hydra
29+
- secretRef:
30+
name: ory-hydra
31+
ports:
32+
- containerPort: 4444
33+
- containerPort: 4445
34+
args: [ "janitor",
35+
"--read-from-env",
36+
"--keep-if-younger", "230h",
37+
"--access-lifespan", "100h",
38+
"--refresh-lifespan", "1000h",
39+
"--consent-request-lifespan", "1000h",
40+
"--requests",
41+
"--grants",
42+
"--tokens" ]
43+
restartPolicy: Never

‎apps/ory-hydra2/templates/migration-cronjob.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
kind: CronJob
2+
apiVersion: batch/v1
3+
metadata:
4+
name: ory-hydra2-migration
5+
namespace: faf-apps
6+
labels:
7+
app: ory-hydra-migration
8+
spec:
9+
# Disabled because triggered manually
10+
schedule: "0 0 31 2 *"
11+
suspend: true
12+
concurrencyPolicy: Forbid
13+
jobTemplate:
14+
metadata:
15+
labels:
16+
app: ory-hydra2-migration
17+
annotations:
18+
prometheus.io/scrape: 'false'
19+
spec:
20+
template:
21+
spec:
22+
containers:
23+
- image: oryd/hydra:v2.3.0
24+
imagePullPolicy: Always
25+
name: ory-hydra
26+
envFrom:
27+
- configMapRef:
28+
name: ory-hydra2
29+
- secretRef:
30+
name: ory-hydra2
31+
ports:
32+
- containerPort: 4444
33+
- containerPort: 4445
34+
args: [ "migrate", "sql", "--read-from-env", "--yes"]
35+
restartPolicy: Never

0 commit comments

Comments
 (0)