Commit 9d6f0d05 authored by Dimitrios Gogos's avatar Dimitrios Gogos
Browse files

feat: add API products configuration with associated scopes for Keycloak

parent 00377aff

oop-platform-chart/charts/keycloak/templates/_helpers.tpl

+23 −0
Changes for oop-platform-chart/charts/keycloak/templates/_helpers.tpl: 23 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -101,6 +101,29 @@ clientId, or plain client IDs), else global.federation.clients. 
{{- toJson $clients -}}

{{- end }}



{{/*

API products as a JSON list (global.apiProducts), checked against files/camara-scopes.yaml:

every product needs a name and scopes, every scope must exist, and every scope must belong

to exactly one product, so no scope is left open to everyone.

*/}}

{{- define "keycloak.apiProducts" -}}

{{- $products := dig "apiProducts" (list) (.Values.global | default dict) -}}

{{- $known := list -}}

{{- range ($.Files.Get "files/camara-scopes.yaml" | fromYamlArray) }}{{ $known = append $known .name }}{{ end -}}

{{- $claimed := list -}}

{{- range $products -}}

{{- $name := required "global.apiProducts: every product needs a name" .name -}}

{{- if not .scopes }}{{ fail (printf "global.apiProducts: %s has no scopes" $name) }}{{ end -}}

{{- range .scopes -}}

{{- if not (has . $known) }}{{ fail (printf "global.apiProducts: %s lists %q, which is not in camara-scopes.yaml" $name .) }}{{ end -}}

{{- if has . $claimed }}{{ fail (printf "global.apiProducts: scope %q is in more than one product" .) }}{{ end -}}

{{- $claimed = append $claimed . -}}

{{- end -}}

{{- end -}}

{{- range $known }}{{ if not (has . $claimed) }}{{ fail (printf "global.apiProducts: scope %q belongs to no product" .) }}{{ end }}{{ end -}}

{{- toJson $products -}}

{{- end }}



{{/*

Audience added to partner tokens in the `federation` realm; Federation Manager requires it.

*/}}

oop-platform-chart/values.yaml

+29 −0
Changes for oop-platform-chart/values.yaml: 29 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -41,6 +41,35 @@ global: 
    scopes:

      api: fed-mgmt

      notif: fed-mgmt-notif

  # API products: what a developer is granted. Each is a role on Keycloak's `oeg`

  # client and groups the CAMARA scopes that role unlocks. Every scope in

  # charts/keycloak/files/camara-scopes.yaml belongs to exactly one product (checked at render).

  apiProducts:

    - name: edge-application-management

      scopes:

        - "edge-application-management:apps:read"

        - "edge-application-management:apps:write"

        - "edge-application-management:apps:delete"

        - "edge-application-management:instances:read"

        - "edge-application-management:instances:write"

        - "edge-application-management:instances:delete"

        - "edge-application-management:deployments:read"

        - "edge-application-management:deployments:write"

        - "edge-application-management:deployments:update"

        - "edge-application-management:deployments:delete"

        - "edge-application-management:clusters:read"

        - "edge-application-management:edge-cloud-zones:read"

    - name: quality-on-demand

      scopes: [qod-sessions-read, qod-sessions-write, qod-sessions-delete]

    - name: location-retrieval

      scopes: ["location-retrieval:read"]

    - name: traffic-influence

      scopes:

        - "traffic-influence:traffic-influences:read"

        - "traffic-influence:traffic-influences:write"

        - "traffic-influence:traffic-influences:update"

        - "traffic-influence:traffic-influences:delete"

        - "traffic-influence:traffic-influence-devices:write"

  labels:

    platform: oop

    version: "1.0.0"