Config indy generic proxy as a sidecar of buildah task #1815
Conversation
| if [ "$(params.ENABLE_INDY_PROXY)" == "true" ]; then | ||
| export QUARKUS_OIDC_CLIENT_CLIENT_ID="$(params.INDY_PROXY_CLIENT_ID)" | ||
| export QUARKUS_OIDC_CLIENT_CREDENTIALS_SECRET="$(params.INDY_PROXY_CLIENT_CREDENTIAL)" | ||
| /deployment/start-service.sh | ||
| fi |
There was a problem hiding this comment.
If we are to implement a sidecar like this, is there any reason why it needs to be specific to Quarkus/INDY? Would this have value as a generalization?
There was a problem hiding this comment.
The service is implemented upon quarkus and both QUARKUS_OIDC_CLIENT_CLIENT_ID and QUARKUS_OIDC_CLIENT_CREDENTIALS_SECRET are supported in quarkus that we can declare the variable as env, which can be declared in the config file as following:
BTW, the client ID(service account) is used to access Indy.
quarkus
oidc-client:
auth-server-url: ""
client-id:
credentials:
secret:
| @@ -725,3 +754,26 @@ spec: | |||
| requests: | |||
| cpu: 100m | |||
| memory: 256Mi | |||
| sidecars: | |||
| - name: indy-generic-proxy | |||
| image: quay.io/factory2/indy-generic-proxy-service:latest-prod | |||
There was a problem hiding this comment.
What is the provenance of this image?
There was a problem hiding this comment.
I believe we need to follow konflux pattern to build the image if we agree the sidecar proposal.
Seems there is no feature flag in tekton to control the sidecar, so yeah it will result in downloading the image for every single buildah task . Hm.. do we have cache for the image ? if so, it may not download it every time, and we have flag Another way to make this is to deploy it in the cluster as a service, like what we are doing in MP+. |
Middleware build pipeline needs to access indy for generic proxy requests (like non-java & non-npm artifacts), and it requires the indy generic proxy deployed together with the builder in the same cluster to handle the proxy http format, which openshift routers don't allow.
In MP+, we deployed this as a standalone service, and in Konflux, the sidecar way maybe a better option, but we hope to start discussing based on this PR, to see which one is better. Or if we need a dedicated task to avoid introducing this to all of the users even there are feature flag.