This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch 0.9.1 in repository https://gitbox.apache.org/repos/asf/openserverless-task.git
commit ebc83a414418a1ebe55a3c10f9106d2a44659405 Author: miki3421 <[email protected]> AuthorDate: Wed Jul 1 16:37:00 2026 +0000 Add SSO admin tasks and IDE login support --- admin/docopts.md | 7 +++++-- admin/opsfile.yml | 13 ++++++++++--- admin/sso/docopts.md | 33 +++++++++++++++++++++++++++++++++ admin/sso/opsfile.yml | 38 ++++++++++++++++++++++++++++++++++++++ config/docopts.md | 3 +++ ide/opsfile.yml | 28 +++++++++++++++++++++++----- 6 files changed, 112 insertions(+), 10 deletions(-) diff --git a/admin/docopts.md b/admin/docopts.md index 19c836f..4ce482d 100644 --- a/admin/docopts.md +++ b/admin/docopts.md @@ -28,8 +28,9 @@ You can create namespaces and choose which services to enable. ```text Usage: admin adduser <username> <email> <password> [--all] [--redis] [--mongodb] [--minio|--seaweedfs] [--postgres] [--milvus] [--storagequota=<quota>|auto] - admin deleteuser <username> + admin deleteuser <username> [--confirm-namespace-delete] admin listuser [<username>] + admin sso unbind <username> admin compact [--ttl=<ttl>|10] admin usage [--debug] ``` @@ -39,6 +40,7 @@ Usage: admin adduser create a new user in OpenServerless with the username, email and password provided admin deleteuser delete a user from the OpenServerless installation via the username provided admin listuser list all the secrets of an user (default list all the users) + admin sso unbind remove SSO binding while preserving the OpenServerless namespace admin compact create a one shot job which executes couchdb compact against all available dbs admin usage calculates and displays PVC disk usage statistics for bound volumes. Shows Total, Size and Available storage per PVC ``` @@ -53,6 +55,7 @@ Usage: --postgres enable postgres --milvus enable milvus vector db --storagequota=<quota> + --confirm-namespace-delete explicitly delete a namespace on an SSO-enabled cluster --ttl=<seconds> modify the job ttl after finished (defaults to 10 seconds) --debug enable debug logging -``` \ No newline at end of file +``` diff --git a/admin/opsfile.yml b/admin/opsfile.yml index e0747fc..4b986ff 100644 --- a/admin/opsfile.yml +++ b/admin/opsfile.yml @@ -44,8 +44,15 @@ tasks: silent: true cmds: - | - {{.DRY}} ops admin ingress undeploy U="{{._username_}}" - - | + if test "$SSO_ENABLED" = "true" && ! {{.__confirm_namespace_delete}} + then + echo "SSO is enabled on this cluster." + echo "User administration is delegated to the remote authentication provider." + echo "This command would delete the OpenServerless namespace and its resources." + echo "Use 'ops admin sso unbind {{._username_}}' to disable SSO access while preserving the namespace." + echo "Re-run with '--confirm-namespace-delete' only when you really want to deprovision the namespace." + exit 1 + fi {{.DRY}} kubectl -n nuvolaris delete wsku/{{._username_}} {{.DRY}} $OPS -config -r {{._username_}} @@ -191,4 +198,4 @@ tasks: echo 'flag is {{.__debug}}' FLAG=--debug fi - bun usage/usage.js $FLAG \ No newline at end of file + bun usage/usage.js $FLAG diff --git a/admin/sso/docopts.md b/admin/sso/docopts.md new file mode 100644 index 0000000..7a05b96 --- /dev/null +++ b/admin/sso/docopts.md @@ -0,0 +1,33 @@ +<!--- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> +# Tasks `ops admin sso` + +Manage SSO bindings for OpenServerless namespaces. + +## Synopsis + +```text +Usage: + sso unbind <username> +``` + +## Commands +``` + sso unbind disable SSO login for a namespace while preserving its resources +``` diff --git a/admin/sso/opsfile.yml b/admin/sso/opsfile.yml new file mode 100644 index 0000000..edfe723 --- /dev/null +++ b/admin/sso/opsfile.yml @@ -0,0 +1,38 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +version: "3" + +env: + KUBECONFIG: + sh: | + if test -e "$OPS_TMP/kubeconfig" + then echo "$OPS_TMP/kubeconfig" + else echo ~/.kube/config + fi + +tasks: + + unbind: + desc: disable SSO login for a namespace while preserving resources + silent: true + cmds: + - | + kubectl -n nuvolaris annotate wsku/{{._username_}} openserverless.apache.org/sso-disabled=true --overwrite + echo "SSO login disabled for namespace {{._username_}}." + echo "The OpenServerless namespace and its resources were preserved." + echo "To delete them explicitly, run: ops admin deleteuser {{._username_}} --confirm-namespace-delete" diff --git a/config/docopts.md b/config/docopts.md index 54b69bd..d1cd484 100644 --- a/config/docopts.md +++ b/config/docopts.md @@ -26,6 +26,8 @@ Configure OpenServerless Usage: config (enable|disable) [--all] [--redis] [--mongodb] [--minio] [--cron] [--static] [--postgres] [--prometheus] [--slack] [--mail] [--affinity] [--tolerations] [--quota] [--milvus] [--registry] [--seaweedfs] config apihost (<apihost>|auto) [--tls=<email>] [--protocol=<http/https>|auto] + config sso keycloak --enable --issuer-url=<issuer-url> --jwks-url=<jwks-url> --audience=<audience> --required-group=<group> [--username-claim=<claim>] [--groups-claim=<claim>] [--namespace=<namespace>] [--configmap=<name>] [--statefulset=<name>] [--container=<name>] [--no-rollout] + config sso (show|disable) config runtimes [<runtimesjson>] config slack [--apiurl=<slackapiurl>] [--channel=<slackchannel>] config mail [--mailuser=<mailuser>] [--mailpwd=<mailpwd>] [--mailfrom=<mailfrom>] [--mailto=<mailto>] @@ -58,6 +60,7 @@ Usage: ``` config apihost configure the apihost (auto: auto assign) and enable tls + config sso configure SSO/OIDC integration for admin-api; run `ops config sso --help` for details config runtime show the current runtime.json or import the <runtime-json> if provided config enable enable OpenServerless services to install config disable disable OpenServerless services to install diff --git a/ide/opsfile.yml b/ide/opsfile.yml index a5a1fb2..7e7f4de 100644 --- a/ide/opsfile.yml +++ b/ide/opsfile.yml @@ -149,7 +149,10 @@ tasks: then export OPSDEV_APIHOST="{{._apihost_}}" fi echo "*** Configuring Access to OpenServerless ***" - if test -z "{{._username_}}" + if test "$SSO_ENABLED" = "true" + then + OPSDEV_USERNAME="" + elif test -z "{{._username_}}" then if test -n "$OPS_USER" then @@ -175,15 +178,31 @@ tasks: fi else export OPSDEV_APIHOST="{{._apihost_}}" fi - echo "Logging user $OPSDEV_USERNAME in $OPSDEV_APIHOST" + if test -n "$OPSDEV_USERNAME" + then echo "Logging user $OPSDEV_USERNAME in $OPSDEV_APIHOST" + else echo "Logging in $OPSDEV_APIHOST with SSO" + fi if test -n "$OPS_PASSWORD" then export "OPS_PASSWORD" fi # TO FIX: workaround to a problem on ops that ignores the paratemer if OPS_USER is set - export OPS_USER="$OPSDEV_USERNAME" + if test -n "$OPSDEV_USERNAME" + then export OPS_USER="$OPSDEV_USERNAME" + else unset OPS_USER + fi export OPS_APIHOST="$OPSDEV_APIHOST" - if ops -login + if $OPS -login then + source ~/.wskprops + if test -z "$OPSDEV_USERNAME" + then + OPSDEV_USERNAME="$($OPS -config STATUS_LOGGED_USER)" + if test -z "$OPSDEV_USERNAME" + then + OPSDEV_USERNAME="$($OPS -wsk property get --namespace | awk '{ print $3 }')" + fi + test -n "$OPSDEV_USERNAME" || die "cannot determine OpenServerless namespace after SSO login" + fi OPSDEV_HOST_PROT="$(echo "$OPSDEV_APIHOST" | awk -F '://' '{print $1}')" OPSDEV_HOST_URL="$(echo "$OPSDEV_APIHOST" | awk -F '://' '{print $2}')" OPSDEV_STREAM="${OPSDEV_APIHOST/\/\////stream.}" @@ -198,7 +217,6 @@ tasks: config VITE_OPSDEV_S3="$OPSDEV_S3" config VITE_OPSDEV_HOST="$OPSDEV_HOST" config VITE_OPSDEV_APIHOST="$OPSDEV_APIHOST" - source ~/.wskprops fi if {{.__pin}} then
