nicolas-georger/deepseek-kubernetes-sandbox
1
0
Fork 0
mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00
Code Projects Releases Activity

feat(gateway-api): GitHub SSO via oauth2-proxy in front of dsh-gateway (#13)

Browse Source 
Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in
front of the dsh-gateway, wired through the Traefik Gateway API. The gateway
inherits the authenticated GitHub username via X-Forwarded-User (SSO).

- gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap
  (auto-provision claim + mint/rotate token + session cookie), patch_token()
- 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true
- gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example,
  HTTPRoute backend -> oauth2-proxy:4180
- tests: 10 new SSO cases (106 passing)

Placeholders (dsh-demo.example.com, your-github-org) are substituted at
apply time.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
This commit is contained in:
SREDevOps.org Agent
2026-10-25 03:43:32 -03:00
committed by GitHub
parent 2b47afa22b
commit 3f46279b39
7 changed files with 445 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
examples/dsh-agents-as-a-service/50-gateway.yaml
View File

@@ -118,7 +118,14 @@ spec:
# 60-ingress.yaml with TLS); "false" keeps the plain-HTTP demo
# usable via port-forward.
- name: COOKIE_SECURE
value: "false"
value: "true"
# Trusted reverse-proxy identity header for SSO. oauth2-proxy sets
# X-Forwarded-User to the authenticated GitHub login on every request;
# the gateway trusts it (and auto-provisions the user) only when this
# is set. Remove/unset to disable SSO and fall back to bearer/session
# auth only.
- name: AUTH_PROXY_HEADER
value: X-Forwarded-User
# Reject proxied request bodies larger than this (413).
- name: MAX_BODY_MB
value: "32"

100
examples/dsh-agents-as-a-service/gateway/gateway.py
View File

@@ -331,6 +331,11 @@ class Settings:
# Connection retries while a Ready pod is still binding its port.
upstream_attempts: int = 3
upstream_retry_delay: float = 1.0
# Optional identity header (e.g. "X-Forwarded-User") set by an authenticating
# reverse proxy such as oauth2-proxy. When configured, requests carrying a
# valid user in this header are treated as authenticated (SSO); unset (None)
# disables SSO entirely and the header is never trusted.
auth_proxy_header: str | None = None
@classmethod
def from_env(cls) -> Settings:
@@ -348,6 +353,7 @@ class Settings:
max_body_bytes=_env_int("MAX_BODY_MB", 32) * 1024 * 1024,
http_timeout=_env_float("HTTP_TIMEOUT", 300.0),
sweep_interval=_env_float("SWEEP_INTERVAL", 15.0),
auth_proxy_header=os.environ.get("AUTH_PROXY_HEADER") or None,
)
@@ -496,6 +502,18 @@ class Kubernetes:
{"spec": {"operatingMode": mode}},
)
async def patch_token(self, user: str, token_hash: str) -> None:
await self._call(
"crd",
"patch_namespaced_custom_object",
GROUP,
VERSION,
self.namespace,
"sandboxclaims",
claim_name(user),
{"metadata": {"annotations": {TOKEN_ANNOTATION: token_hash}}},
)
# -- pods and logs -----------------------------------------------------
async def get_pod(self, name: str) -> dict | None:
@@ -571,17 +589,67 @@ class Gateway:
return token, user
return None, None
def remote_user(self, headers) -> str | None:
"""The user asserted by a trusted reverse proxy, when SSO is enabled.
Honored only when ``auth_proxy_header`` is configured, and only when the
value is a valid dns-1123 label — a spoofed or malformed value is never
trusted.
"""
name = self.settings.auth_proxy_header
if not name:
return None
raw = (headers.get(name) or "").strip()
return raw if valid_user(raw) else None
def _authorized(
self,
claim: dict,
token: str | None,
cookie_user: str | None,
user: str,
remote: str | None = None,
) -> bool:
if remote == user:
return True # identity asserted by the authenticating proxy
if cookie_user is not None and cookie_user != user:
return False # a session for another user never authorizes this one
return token_matches(claim, token)
async def _sso_session(
self, remote: str, headers, cookies, response: Response
) -> dict | None:
"""Provision ``remote`` idempotently and mint/refresh a session token.
The authenticating proxy has already verified ``remote``, so it is
trusted. A brand-new user is provisioned like ``signup`` (claim created,
token minted, sandbox awaited); an existing user whose session cookie is
missing or no longer matches gets a rotated token so a fresh cookie can
be issued. A still-valid session is reused untouched.
"""
claim = await self.k8s.get_claim(remote)
token, cookie_user = self.credentials(headers, cookies)
if claim is not None and cookie_user == remote and token_matches(claim, token):
return claim
token = secrets.token_urlsafe(32)
token_hash = hashlib.sha256(token.encode()).hexdigest()
is_new = claim is None
if is_new:
try:
await self.k8s.create_claim(remote, token_hash, self.settings.pool)
except UserExists:
# Lost a concurrent signup race: rotate the existing token.
is_new = False
await self.k8s.patch_token(remote, token_hash)
else:
await self._touch(remote)
await self.wait_ready(remote, self.settings.wake_timeout)
else:
await self.k8s.patch_token(remote, token_hash)
await self._touch(remote)
self.set_session(response, remote, token)
return await self.k8s.get_claim(remote) if is_new else claim
@staticmethod
def _mutation_from_cookie(headers, method: str, cookie_user: str | None) -> bool:
return (
@@ -767,7 +835,14 @@ class Gateway:
async def healthz(self, request: Request) -> JSONResponse:
return JSONResponse({"status": "ok"})
async def landing(self, request: Request) -> HTMLResponse:
async def landing(self, request: Request) -> Response:
remote = self.remote_user(request.headers)
if remote:
response = RedirectResponse(f"/u/{remote}/", status_code=303)
await self._sso_session(
remote, request.headers, request.cookies, response
)
return response
token, user = self.credentials(request.headers, request.cookies)
session = ""
if user and token:
@@ -932,7 +1007,9 @@ against the JSON API. The browser session is an HttpOnly cookie.</p>
if claim is None:
return self._error(404, "not found")
token, cookie_user = self.credentials(request.headers, request.cookies)
if not self._authorized(claim, token, cookie_user, user):
if not self._authorized(
claim, token, cookie_user, user, self.remote_user(request.headers)
):
return self._error(401, "unauthorized")
sandbox = await self._sandbox_of(claim)
return JSONResponse(
@@ -951,7 +1028,9 @@ against the JSON API. The browser session is an HttpOnly cookie.</p>
if claim is None:
return self._error(404, "not found")
token, cookie_user = self.credentials(request.headers, request.cookies)
if not self._authorized(claim, token, cookie_user, user):
if not self._authorized(
claim, token, cookie_user, user, self.remote_user(request.headers)
):
return self._error(401, "unauthorized")
if self._mutation_from_cookie(request.headers, "DELETE", cookie_user):
return self._error(403, "cross-origin request rejected")
@@ -970,11 +1049,20 @@ against the JSON API. The browser session is an HttpOnly cookie.</p>
user = request.path_params["user"]
if not valid_user(user):
return self._error(404, "unknown user")
remote = self.remote_user(request.headers)
claim = await self.k8s.get_claim(user)
if claim is None:
if remote == user:
# SSO first hit straight at a deep link: let landing bootstrap.
return RedirectResponse("/", status_code=303)
return self._error(404, "unknown user")
token, cookie_user = self.credentials(request.headers, request.cookies)
if not self._authorized(claim, token, cookie_user, user):
if remote == user and not (
cookie_user == user and token_matches(claim, token)
):
# SSO user without a valid session cookie: bootstrap, then continue.
return RedirectResponse("/", status_code=303)
if not self._authorized(claim, token, cookie_user, user, remote):
return self._error(401, "unauthorized")
if self._mutation_from_cookie(request.headers, request.method, cookie_user):
return self._error(403, "cross-origin request rejected")
@@ -1143,7 +1231,9 @@ against the JSON API. The browser session is an HttpOnly cookie.</p>
if claim is None:
return await self._ws_reject(websocket, 4401)
token, cookie_user = self.credentials(websocket.headers, websocket.cookies)
if not self._authorized(claim, token, cookie_user, user):
if not self._authorized(
claim, token, cookie_user, user, self.remote_user(websocket.headers)
):
return await self._ws_reject(websocket, 4401)
if cookie_user is not None and not same_origin(websocket.headers):
return await self._ws_reject(websocket, 4401)

133
examples/dsh-agents-as-a-service/gateway/test_gateway.py
View File

@@ -62,6 +62,7 @@ class FakeK8s:
self.created = []
self.deleted = []
self.patches = []
self.token_patches = []
self.conflict_on_create = False
self.get_claim_error = None
self.patch_error = None
@@ -92,6 +93,17 @@ class FakeK8s:
raise self.patch_error
self.patches.append((name, mode))
async def patch_token(self, user, token_hash):
if self.patch_error is not None:
raise self.patch_error
self.token_patches.append((user, token_hash))
claim = self.claims.get(user)
if claim is not None:
annotations = claim.setdefault("metadata", {}).setdefault(
"annotations", {}
)
annotations["aaas.example.com/token-sha256"] = token_hash
async def get_pod(self, name):
return self.pods.get(name)
@@ -431,6 +443,7 @@ def test_settings_from_env(monkeypatch):
monkeypatch.setenv("COOKIE_MAX_AGE", "100")
monkeypatch.setenv("MAX_BODY_MB", "2")
monkeypatch.setenv("HTTP_TIMEOUT", "12.5")
monkeypatch.setenv("AUTH_PROXY_HEADER", "X-Forwarded-User")
settings = Settings.from_env()
assert settings.namespace == "ns-x"
assert settings.pool == "pool-x"
@@ -443,6 +456,12 @@ def test_settings_from_env(monkeypatch):
assert settings.cookie_max_age == 100
assert settings.max_body_bytes == 2 * 1024 * 1024
assert settings.http_timeout == 12.5
assert settings.auth_proxy_header == "X-Forwarded-User"
def test_settings_auth_proxy_header_defaults_to_none(monkeypatch):
monkeypatch.delenv("AUTH_PROXY_HEADER", raising=False)
assert Settings.from_env().auth_proxy_header is None
# --- Kubernetes adapter ----------------------------------------------------
@@ -1413,3 +1432,117 @@ async def test_sweeper_survives_transient_api_error(env):
# The per-user maintenance flag must be released even on failure.
assert env.gateway.state.maintenance["alice"] is False
# --- SSO (reverse-proxy identity) ------------------------------------------
def enable_sso(env, header="X-Forwarded-User"):
"""Flip an env into SSO mode: the gateway trusts the named identity header."""
env.settings = Settings(**{**env.settings.__dict__, "auth_proxy_header": header})
env.gateway.settings = env.settings
return env
def test_remote_user_none_when_sso_disabled(env):
assert env.gateway.remote_user({"X-Forwarded-User": "alice"}) is None
def test_remote_user_returns_valid_and_rejects_invalid(env):
enable_sso(env)
g = env.gateway
assert g.remote_user({"X-Forwarded-User": "alice"}) == "alice"
assert g.remote_user({"X-Forwarded-User": " bob "}) == "bob"
assert g.remote_user({"X-Forwarded-User": "UPPER"}) is None
assert g.remote_user({"X-Forwarded-User": "bad name"}) is None
assert g.remote_user({"X-Forwarded-User": ""}) is None
assert g.remote_user({}) is None
@pytest.mark.asyncio
async def test_sso_landing_provisions_new_user_and_redirects(env, monkeypatch):
enable_sso(env)
async def ready(user, timeout):
return {"metadata": {"name": f"dsh-{user}-sbx"}}
monkeypatch.setattr(env.gateway, "wait_ready", ready)
async with asgi_client(env) as client:
response = await client.get("/", headers={"X-Forwarded-User": "alice"})
assert response.status_code == 303
assert response.headers["location"] == "/u/alice/"
assert re_cookie_user(response.headers["set-cookie"]) == "alice"
assert [c[0] for c in env.k8s.created] == ["alice"]
assert env.k8s.token_patches == []
@pytest.mark.asyncio
async def test_sso_landing_reuses_valid_session_without_rotation(env):
enable_sso(env)
add_user(env.k8s)
async with asgi_client(
env, cookies={"dsh_gw_session": f"alice:{TOKEN}"}
) as client:
response = await client.get("/", headers={"X-Forwarded-User": "alice"})
assert response.status_code == 303
assert response.headers["location"] == "/u/alice/"
assert env.k8s.created == []
assert env.k8s.token_patches == []
@pytest.mark.asyncio
async def test_sso_landing_rotates_token_when_session_missing(env):
enable_sso(env)
add_user(env.k8s)
async with asgi_client(env) as client:
response = await client.get("/", headers={"X-Forwarded-User": "alice"})
assert response.status_code == 303
assert response.headers["location"] == "/u/alice/"
assert re_cookie_user(response.headers["set-cookie"]) == "alice"
assert [p[0] for p in env.k8s.token_patches] == ["alice"]
assert env.k8s.created == []
@pytest.mark.asyncio
async def test_sso_get_user_authorizes_via_header(env):
enable_sso(env)
add_user(env.k8s)
async with asgi_client(env) as client:
response = await client.get(
"/users/alice", headers={"X-Forwarded-User": "alice"}
)
assert response.status_code == 200
assert response.json()["user"] == "alice"
@pytest.mark.asyncio
async def test_sso_proxy_redirects_to_bootstrap_without_session(env):
enable_sso(env)
add_user(env.k8s)
async with asgi_client(env) as client:
response = await client.get(
"/u/alice/", headers={"X-Forwarded-User": "alice"}
)
assert response.status_code == 303
assert response.headers["location"] == "/"
@pytest.mark.asyncio
async def test_sso_proxy_redirects_to_bootstrap_when_claim_missing(env):
enable_sso(env)
async with asgi_client(env) as client:
response = await client.get(
"/u/alice/", headers={"X-Forwarded-User": "alice"}
)
assert response.status_code == 303
assert response.headers["location"] == "/"
@pytest.mark.asyncio
async def test_spoofed_header_ignored_when_sso_disabled(env):
add_user(env.k8s)
async with asgi_client(env) as client:
response = await client.get(
"/u/alice/", headers={"X-Forwarded-User": "alice"}
)
assert response.status_code == 401