Allow customize http vhost config using HttpdCustomization.CustomConfigSecret

[stuggi]

This change allows to customize the httpd vhost config using this parameter to specify a secret that contains service config data. The content of each provided snippet gets rendered as a go template and placed into
/etc/httpd/conf/httpd_custom_<endpoint>_<key> .
At the end of the vhost config in the default httpd template these custom configs get included using Include conf/httpd_custom_<endpoint>_*.

For information on how sections in httpd configuration get merged, check section "How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging

All possible parameters which can be use in a template can be looked up in the <service>-config-data secret of the service like:

$ oc get secret -n openstack keystone-config-data -o json | jq -r .data.TemplatingParameters | base64 -d

or in the running pod of the service in the file:

$ cat /var/lib/config-data/default/templatingParameters

The content of the parameters of the service operator, like:

DatabaseConnection: mysql+pymysql://user:[email protected]/keystone?read_default_file=/etc/my.cnf
KeystoneEndpointInternal: https://keystone-internal.openstack.svc:5000/
KeystoneEndpointPublic: https://keystone-public-openstack.apps-crc.testing/
ProcessNumber: 3
TransportURL: rabbit://user:[email protected]:5671/?ssl=1
VHosts:
    internal:
        Override: false
        SSLCertificateFile: /etc/pki/tls/certs/internal.crt
        SSLCertificateKeyFile: /etc/pki/tls/private/internal.key
        ServerName: keystone-internal.openstack.svc
        TLS: true
    public:
        Override: false
        SSLCertificateFile: /etc/pki/tls/certs/public.crt
        SSLCertificateKeyFile: /etc/pki/tls/private/public.key
        ServerName: keystone-public.openstack.svc
        TLS: true
EnableSecureRBAC: true
FernetMaxActiveKeys: 5
MemcachedServers: memcached-0.memcached.openstack.svc:11212
MemcachedServersWithInet: inet:[memcached-0.memcached.openstack.svc]:11211
MemcachedTLS: true

Jira: https://issues.redhat.com/browse/OSPRH-13100

[stuggi]

With this change you can e.g. add the following template in a secret to configure OIDC Federation Settings

OIDCClaimPrefix "OIDC-"
OIDCResponseType "id_token"
OIDCScope "openid email profile"
OIDCClaimDelimiter ";"
OIDCPassUserInfoAs "claims"
OIDCPassClaimsAs "both"
OIDCCacheType "memcache"
OIDCMemCacheServers "{{ .MemcachedServers }}"
OIDCProviderMetadataURL "https://my_provider_metadata_url"
OIDCClientID "my_client_id"
OIDCClientSecret "12345678"
OIDCCryptoPassphrase "12345678"
OIDCOAuthClientID "my_oauth_client_id"
OIDCOAuthClientSecret "12345678"
OIDCOAuthIntrospectionEndpoint "https://my_oauth_introspection_endpoint"

# The following directives are necessary to support websso from Horizon
# (Per https://docs.openstack.org/keystone/pike/advanced-topics/federation/websso.html)
OIDCRedirectURI "{{ .KeystoneEndpointPublic }}/v3/auth/OS-FEDERATION/identity_providers/my_federation_provider_name/protocols/openid/websso"
OIDCRedirectURI "{{ .KeystoneEndpointPublic }}/v3/auth/OS-FEDERATION/websso/openid"

<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/my_federation_provider_name/protocols/openid/websso">
  AuthType "openid-connect"
  Require valid-user
</LocationMatch>

<Location ~ "/v3/OS-FEDERATION/identity_providers/my_federation_provider_name/protocols/openid/auth">
  AuthType oauth20
  Require valid-user
</Location>

<LocationMatch "/v3/auth/OS-FEDERATION/websso/openid">
  AuthType "openid-connect"
  Require valid-user
</LocationMatch>

The secret then can be referenced using httpdCustomization.customConfigSecret and keystone config required parameters set via customServiceConfig:

    keystone:
      template:
        customServiceConfig: |
          [federation]
          trusted_dashboard={{ .KeystoneEndpointPublic }}/dashboard/auth/websso/

          [openid]
          remote_id_attribute=HTTP_OIDC_ISS

          [auth]
          methods = password,token,oauth1,mapped,application_credential,openid
        httpdCustomization:
          customConfigSecret: keystone-httpd-override

[stuggi]

/test keystone-operator-build-deploy-kuttl

[stuggi]

/retest

[gibizer]

looks OK to me.

[olliewalsh]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: olliewalsh, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [olliewalsh,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gibizer]

still looks good