miki3421 opened a new pull request, #214:
URL: https://github.com/apache/openserverless-task/pull/214
## Summary
- add `config/sso` as a standard hierarchical `ops` task on branch `0.9.1`
- move SSO/OIDC Kubernetes orchestration into a dependency-free
Bun/TypeScript runner
- preserve unrelated admin-api `env`, `envFrom`, volumes, volume mounts, and
annotations
- make disable idempotent and use targeted JSON Patch operations
- keep secrets out of task command lines and local `config.json`
- document the exact resources and values managed by the task
## Architecture
All other public `ops config` commands are task-backed. SSO was the
exception: `main.go` intercepted `ops config sso` and executed release-specific
orchestration embedded in the CLI. That required publishing a new CLI for every
SSO workflow change and allowed task help to become inconsistent with the
installed CLI.
This pull request restores the standard architecture:
```text
ops config sso
-> config/sso/opsfile.yml
-> config/sso/sso.ts
```
The YAML is declarative. Docopt values are passed through task environment
variables, including the client secret, so they are not interpolated into a
shell command line. The TypeScript runner invokes `ops -config` only as a
stable local-config primitive.
Companion CLI PR: https://github.com/apache/openserverless-cli/pull/43
## Safe Kubernetes behavior
The task reads the target StatefulSet and generates JSON Patch operations
only for exact, prefix-free references to its managed ConfigMap and Secret.
Removal operations include JSON Patch `test` guards, preventing a concurrent
list change from removing the wrong entry.
Repeated disable does not patch or roll out the StatefulSet. ConfigMap and
Secret deletion uses `--ignore-not-found`. Removing an `envFrom` entry changes
the pod template and starts the Kubernetes rollout naturally; the task waits
for it unless `--no-rollout` is set and does not add a redundant restart
annotation.
## Validation
- Bun 1.3.14: `bun test config/sso/sso.test.ts`
- Bun 1.3.14: `bun build config/sso/sso.ts --target=bun`
- parsed `config/opsfile.yml` and `config/sso/opsfile.yml` with yq 4.47.1
- verified `ops config sso` and `ops config sso --help` through the normal
CLI task dispatcher
- ran `ops config sso keycloak --enable ... --no-rollout` end-to-end with an
isolated home and fake kubectl
Tests cover foreign direct environment variables, ConfigMap and Secret
`envFrom` entries, volumes, volume mounts, annotations, idempotent repeated
disable, and the full `enable -> disable -> enable` cycle.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
