Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml

@@ -0,0 +1,79 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+  name: create-sso-auth-provider
+  namespace: stackrox
+spec:
+  template:
+    spec:
+      containers:
+        - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
+          env:
+          - name: CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: sso-secret
+                key: client-secret
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: central-htpasswd
+                key: password
+          - name: ISSUER
+            value: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift
+          - name: DEFAULT_ROLE
+            value: Admin
+          command:
+            - /bin/bash
+            - -c
+            - |
+              #!/usr/bin/env bash
+
+              # Wait for central to be ready
+              attempt_counter=0
+              max_attempts=20
+              echo "Waiting for central to be available..."
+              until $(curl -k --output /dev/null --silent --head --fail https://central); do
+                  if [ ${attempt_counter} -eq ${max_attempts} ];then
+                    echo "Max attempts reached"
+                    exit 1
+                  fi
+                  printf '.'
+                  attempt_counter=$(($attempt_counter+1))
+                  echo "Made attempt $attempt_counter, waiting..."
+                  sleep 5
+              done
+
+              echo "Configuring SSO Provider"
+
+              echo "Test if SSO Provider already exists"
+
+              response=$(curl -k -u "admin:$PASSWORD" https://central/v1/authProviders?name=OpenShift | python3 -c "import sys, json; print(json.load(sys.stdin)['authProviders'], end = '')")
+
+              if [[ "$response" != "[]" ]] ; then
+                echo "OpenShift Provider already exists, exiting"
+                exit 0
+              fi
+
+              export DATA='{"name":"OpenShift","type":"oidc","uiEndpoint":"central-stackrox.apps.home.ocplab.com","enabled":true,"config":{"client_id":"stackrox","client_secret":"'${CLIENT_SECRET}'","issuer":"'$ISSUER'","mode":"post"},"validated":true,"extraUiEndpoints":[],"active":true}'
+
+              echo "Posting data: ${DATA}"
+
+              authid=$(curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/authProviders | python3 -c "import sys, json; print(json.load(sys.stdin)['id'], end = '')")
+
+              echo "Authentication Provider created with id ${authid}"
+              echo "Updating minimum role to Admin"
+
+              export DATA='{"previous_groups":[],"required_groups":[{"props":{"authProviderId":"'${authid}'"},"roleName":"'${DEFAULT_ROLE}'"}]}'
+
+              curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/groupsbatch
+
+          imagePullPolicy: Always
+          name: create-sso-auth-provider
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      serviceAccount: create-cluster-init
+      serviceAccountName: create-cluster-init
+      terminationGracePeriodSeconds: 30