user-auth: oathkeeper proxy rules for kratos (#160)

* user-auth: oathkeeper proxy rules for kratos

* fix deprecated add-path for github actions

Author: davidcheung

.github/workflows/terraform.yml

@@ -24,7 +24,7 @@ jobs:
         curl -OJL $LATEST_ZERO_DOWNLOAD_URL
         tar -xvf "./${ZERO_BINARY_FILE_NAME}"
         ./zero version
-        echo "::add-path::${GITHUB_WORKSPACE}/bin"
+        echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
     - name: Copy test project structure
       id: copy_test_dir
       run: |

templates/kubernetes/terraform/modules/kubernetes/files/oathkeeper_kratos_proxy_rules.yaml.tpl

@@ -0,0 +1,54 @@
+## Public Kratos
+# pattern: http://<proxy>/.ory/kratos/public
+# these are the entrypoint of kratos, it handles initialization of forms
+# redirections(configured in user_auth.tf from infrastructure)
+apiVersion: oathkeeper.ory.sh/v1alpha1
+kind: Rule
+metadata:
+  name: kratos-public
+  namespace: user-auth
+spec:
+  upstream:
+    url: http://kratos-public.user-auth
+    stripPath: ${public_selfserve_endpoint}
+    preserveHost: true
+  match:
+    url: http://${backend_service_domain}${public_selfserve_endpoint}/<.*>
+    methods:
+      - GET
+      - POST
+      - PUT
+      - DELETE
+      - PATCH
+  authenticators:
+    - handler: noop
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: noop
+---
+## Kratos Admin
+# pattern: http://<proxy>/.ory/kratos
+# Note this only allows :GET requests
+# Once self-service flow is initiated, a flow_id is generated
+# The endpoint is used to exchange for form format / fields given a flow_id
+apiVersion: oathkeeper.ory.sh/v1alpha1
+kind: Rule
+metadata:
+  name: kratos-form-data
+  namespace: user-auth
+spec:
+  upstream:
+    url: http://kratos-admin.user-auth
+    stripPath: ${admin_selfserve_endpoint}
+    preserveHost: true
+  match:
+    url: http://${backend_service_domain}${admin_selfserve_endpoint}/self-service/<(login|registration|recovery|settings)>/flows<.*>
+    methods:
+      - GET
+  authenticators:
+    - handler: noop
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: noop

templates/kubernetes/terraform/modules/kubernetes/user_auth.tf

@@ -211,6 +211,24 @@ resource "helm_release" "kratos" {
     name  = "kratos.config.selfservice.flows."
     value = "https://${var.backend_service_domain}/"
   }
+}
 
+data "template_file" "oathkeeper_kratos_proxy_rules" {
+  template = file("${path.module}/files/oathkeeper_kratos_proxy_rules.yaml.tpl")
+  vars = {
+    backend_service_domain = var.backend_service_domain
+    public_selfserve_endpoint = "/.ory/kratos/public"
+    admin_selfserve_endpoint = "/.ory/kratos"
+  }
+}
 
+resource "null_resource" "oathkeeper_kratos_proxy_rules" {
+  triggers = {
+    manifest_sha1 = sha1(data.template_file.oathkeeper_kratos_proxy_rules.rendered)
+  }
+  # local exec call requires kubeconfig to be updated
+  provisioner "local-exec" {
+    command = "kubectl apply -f - <<EOF\n${data.template_file.oathkeeper_kratos_proxy_rules.rendered}\nEOF"
+  }
+  depends_on = [helm_release.oathkeeper]
 }