client credential flow

charts/k6-operator/templates/k6-testrun.yaml

@@ -13,11 +13,18 @@ spec:
       file: ping-graph.ts
   runner:
     env:
-      - name: GRAPH_PROXY_BEARER_TOKEN
+      - name: KEYCLOAK_CLIENT_ID
         valueFrom: 
           secretKeyRef: 
             name: graph-proxy-k6-auth
-            key: GRAPH_PROXY_BEARER_TOKEN
+            key: KEYCLOAK_CLIENT_ID
+      - name: KEYCLOAK_CLIENT_SECRET
+        valueFrom: 
+          secretKeyRef: 
+            name: graph-proxy-k6-auth
+            key: KEYCLOAK_CLIENT_SECRET
+      - name: KEYCLOAK_TOKEN_URL
+        value: https://identity.diamond.ac.uk/realms/dls/protocol/openid-connect/token
       - name: GRAPH_URL
         value: http://graph-proxy.graph-proxy.svc.cluster.local:80/graphql
     resources:

charts/k6-operator/tests/ping-graph.ts

@@ -1,8 +1,11 @@
-import http, { RefinedResponse, ResponseType } from 'k6/http';
+import http from 'k6/http';
 import { Options } from 'k6/options';
 import { fail } from 'k6';
 
-const url = __ENV.GRAPH_PROXY_URL ?? 'http://graph-proxy.graph-proxy.svc.cluster.local:80/graphql';
+const graphUrl = __ENV.GRAPH_URL
+const keycloakUrl = __ENV.KEYCLOAK_TOKEN_URL
+const clientID = __ENV.KEYCLOAK_CLIENT_ID
+const clientSecret = __ENV.KEYCLOAK_CLIENT_SECRET
 
 
 interface VisitInput {
@@ -78,23 +81,54 @@ export const options: Options = {
 };
 
 export default function(): void {
-  const token = __ENV.GRAPH_PROXY_BEARER_TOKEN;
+  if (!clientSecret) {
+    fail('KEYCLOAK_CLIENT_SECRET requried');
+  }
+  if (!clientID) {
+    fail('KEYCLOAK_CLIENT_ID required');
+  }
+  if (!keycloakUrl) {
+    fail('KEYCLOAK_TOKEN_URL required');
+  }
+  if (!graphUrl) {
+    fail('GRAPH_URL required');
+  }
+
+  const tokenRes = http.post(
+    keycloakUrl,
+    {
+      grant_type: 'client_credentials',
+      client_id: clientID,
+      client_secret: clientSecret,
+    },
+    {
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    },
+  );
+
+  if (tokenRes.status !== 200) {
+    fail(`Token request failed: ${tokenRes.status} ${tokenRes.body}`);
+  }
+
+  const tokenBody = JSON.parse(tokenRes.body as string);
+  const token = tokenBody.access_token;
   if (!token) {
-    fail('GRAPH_PROXY_BEARER_TOKEN required');
+    fail('No access_token in Keycloak response');
   }
 
   const payload = JSON.stringify({
     query: queryExamples.listWorkflowsForVisit.query,
     variables: queryExamples.listWorkflowsForVisit.variables,
   });
+
   const params = {
     headers: {
       Accept: 'application/json, multipart/mixed',
       'Content-Type': 'application/json',
       Authorization: `Bearer ${token}`,
     },
   };
-  const res = http.post(url, payload, params);
+  const res = http.post(graphUrl, payload, params);
   console.log(`status=${res && res.status}`);
   console.log(`body=${res && res.body}`);
 }

charts/workflows-cluster/Chart.yaml

@@ -3,7 +3,7 @@ name: workflows-cluster
 description: A virtual cluster for Data Analysis workflows
 type: application
 
-version: 0.12.1
+version: 0.12.2
 dependencies:
   - name: common
     version: 2.23.0

charts/workflows-cluster/charts/secrets/templates/graph-proxy-k6-auth.yaml

@@ -0,0 +1,16 @@
+{{- if eq .Values.cluster "pollux" }}
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: graph-proxy-k6-auth  
+  namespace: workflows
+spec:
+  encryptedData:
+    KEYCLOAK_CLIENT_ID: AgBfgu/0rkkZ9sut6uYcVqFVRaBbUI7MQuTV15EzOjTKSdt22SBF2gUr9GQC+oHX5tnsqqpk3EE0kuq4FgN+Hb/bw2gUftzl/B7sZU/fcUOqcL4bHgtNdJ527B6JMFTL12CAJSSnwflteLYuNvKD4T514/c2tMdh1d+XYHuVs1nl/YxtdBVjrT3qX+G6kqaGCeaR/IYEIa7jE9y/1TH92rSt8pJq7l5k2vuKfw4U2+YHUO1+1pwdE9eFa5PQVgXIiynfcifEQn/QrsJdfKAbpq+IC+ZSoplcehBS52QQJ46MhvM5Dg5oGXX4U33UdrZHfnTeHte2odwANogg8d39Tmg9h6e78wbMTqKHSCcbKVq3OUr/yKpRk7D0hkJTfITr/PXAH1W+PuxHjd4mmFX3x1M8MizDVYsPZxlCIp0sv4Y+NJPtr0rYp5HzfnWVFy5Hef26plNUzE3NhtUAfDDXfb34u0em6Y60HEsG31M9AmPHyomQnaxM5uoNwHyGo4EuUh7n1+mDpkFUAYfqy8QLFoJ3pQymdoQqVToUc28DFNqpo40lsrrRoOUmfC2puQPn97njkw0CNGV5/TWl8kJ1GStkL3ayuFrz6xRLWgq+Ut/u1ItFVlNUwz7O8RiypA4glzqbWYJ5brsqu4x0hkc+3YDZ0CNCBdwu26kOhdqYJS6A1xTWXtk6lNunYcsajHmfIVPsxYnInQjBvZax
+    KEYCLOAK_CLIENT_SECRET: AgBgO0BNUsJNARu6vnnzV6fhjNhpD6vbmdBZk3xyAzll49EEwrOaJi+UQLv+K4/2bUBD+R8QXh626bQwYwcljFi36mmuDDCcj7pXv9KiQp9XXXhGAo7HuzabcAQ5wplD5YrJtkL2lb+p/Z9dAPJeDO1a2fK0Yea8dC+UDwM4GIpUPhkxdas8W3nc6TfuovdXUb/CCNOVG3xwlmM3kPD2JCgynv05fZ2WU1Mfq5i48I1kAb6bY1OtFh639L7TmwPCARb6ENa7uVkwAevSP2wxfn1eqvhKcEJ7lQMEh3x8QvGad6fKKXux77kRcCA7MzEZa/XSSzshHA6LAYjmtABtR7bHkQ+XATA22qAUGy8EFhNLSN7gw8LSyYlOVIU9B0iaMBzmRfFanJCYy6nQmDqG3TPqIqNTYj4GjxyXTY7iud6g+QqqMMxDAMuOhi7gAkmoi5BsZpdFPYgA1DF7nxyhHeE/byQcE1h77LrxZQYtr7hnPBemt3dbfdgWnVy3PLsGXLyaKYWWtyeDab5X/hOYEYa+qEpAcQvJoQR81X1qgJJYJ7febSyFM+L+GmNJ84QB4lnXw4Tc5GZMfvpNVhvG/Zc5w/9Q4jjBL5CFBR0ktgMN8uif1ElYtHXiK2CESgtc86vfk2MUABfnoyHmUb0RNOgX+Ni/qvBbo0pJq+//RR9XPPzAKVUe3Fs196hFKwhnHsU5i9o9yC/Nh9RL6GARXWicWVmoqrNhW3UHliifKyRVFA== 
+  template:
+    metadata:
+      name: graph-proxy-k6-auth
+      namespace: workflows
+    type: Opaque
+{{- end }}

charts/workflows-cluster/staging-values.yaml

@@ -77,6 +77,7 @@ vcluster:
             "/postgres-argo-workflows-password": "workflows/postgres-argo-workflows-password"
             "/postgres-application-passwords": "workflows/postgres-application-passwords"
             "/postgres-initdb-script": "workflows/postgres-initdb-script"
+            "/graph-proxy-k6-auth": "k6/graph-proxy-k6-auth"
 
 ingress:
   secretName: letsencrypt-kubernetes-staging-workflows-diamond-ac-uk