Skip to content

Commit f3f0343

Browse files
paullatzelspergerpaullatzelsperger
authored
feat: add IdentityHub Agent as dedicated resource (#98)
* feat: add IdentityHub Agent as dedicated resource * use other JWKS resolver
1 parent bd5ccd7 commit f3f0343

7 files changed

Lines changed: 93 additions & 16 deletions

File tree

‎extensions/data-plane-certs/build.gradle.kts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ dependencies {
3131
implementation(libs.edc.lib.util)
3232
implementation(libs.edc.lib.sql)
3333
implementation(libs.edc.lib.token)
34+
implementation(libs.edc.lib.keys)
3435
implementation(libs.edc.lib.oauth2.authn)
3536
implementation(libs.edc.core.sql.bootstrapper)
3637
implementation(libs.edc.core.sql)

‎extensions/data-plane-certs/src/main/java/org/eclipse/edc/virtualized/dataplane/cert/CertExchangeExtension.java‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,14 @@
1414

1515
package org.eclipse.edc.virtualized.dataplane.cert;
1616

17-
import org.eclipse.edc.api.authentication.JwksResolver;
1817
import org.eclipse.edc.api.authentication.filter.JwtValidatorFilter;
18+
import org.eclipse.edc.keys.resolver.JwksPublicKeyResolver;
1919
import org.eclipse.edc.keys.spi.KeyParserRegistry;
2020
import org.eclipse.edc.runtime.metamodel.annotation.Configuration;
2121
import org.eclipse.edc.runtime.metamodel.annotation.Extension;
2222
import org.eclipse.edc.runtime.metamodel.annotation.Inject;
2323
import org.eclipse.edc.runtime.metamodel.annotation.Setting;
2424
import org.eclipse.edc.runtime.metamodel.annotation.Settings;
25-
import org.eclipse.edc.spi.EdcException;
2625
import org.eclipse.edc.spi.system.Hostname;
2726
import org.eclipse.edc.spi.system.ServiceExtension;
2827
import org.eclipse.edc.spi.system.ServiceExtensionContext;
@@ -39,8 +38,6 @@
3938
import org.eclipse.edc.web.spi.configuration.PortMapping;
4039
import org.eclipse.edc.web.spi.configuration.PortMappingRegistry;
4140

42-
import java.net.MalformedURLException;
43-
import java.net.URL;
4441
import java.time.Clock;
4542
import java.util.List;
4643

@@ -89,15 +86,9 @@ public void initialize(ServiceExtensionContext context) {
8986
var portMapping = new PortMapping(API_CONTEXT, apiConfiguration.port(), apiConfiguration.path());
9087
portMappingRegistry.register(portMapping);
9188

92-
URL url;
93-
try {
94-
url = new URL(sigletConfig.jwksUrl());
95-
} catch (MalformedURLException e) {
96-
throw new EdcException(e);
97-
}
98-
9989
webService.registerResource(API_CONTEXT, new CertExchangePublicController(certStore, transactionContext));
100-
webService.registerResource(API_CONTEXT, new JwtValidatorFilter(tokenValidationService, new JwksResolver(url, keyParserRegistry, sigletConfig.cacheValidityInMillis), getRules()));
90+
var resolver = JwksPublicKeyResolver.create(keyParserRegistry, sigletConfig.jwksUrl(), context.getMonitor(), sigletConfig.cacheValidityInMillis());
91+
webService.registerResource(API_CONTEXT, new JwtValidatorFilter(tokenValidationService, resolver, getRules()));
10192

10293
webService.registerResource("control", new CertInternalExchangeController(certStore, transactionContext));
10394

‎gradle/libs.versions.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ edc-lib-http = { module = "org.eclipse.edc:http-lib", version.ref = "edc" }
3030
edc-lib-util = { module = "org.eclipse.edc:util-lib", version.ref = "edc" }
3131
edc-lib-sql = { module = "org.eclipse.edc:sql-lib", version.ref = "edc" }
3232
edc-lib-token = { module = "org.eclipse.edc:token-lib", version.ref = "edc" }
33+
edc-lib-keys = { module = "org.eclipse.edc:keys-lib", version.ref = "edc" }
3334
edc-lib-oauth2-authn = { module = "org.eclipse.edc:auth-authentication-oauth2-lib", version.ref = "edc" }
3435
edc-core-sql-bootstrapper = { module = "org.eclipse.edc:sql-bootstrapper", version.ref = "edc" }
3536
edc-core-http = { module = "org.eclipse.edc:http", version.ref = "edc" }

‎k8s/apps/cfm-agents.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,20 @@ spec:
6161
- name: edcv-agent-config
6262
mountPath: /etc/appname
6363
readOnly: true
64+
- name: ih-agent
65+
image: ghcr.io/eclipse-cfm/cfm/ihagent:latest
66+
imagePullPolicy: Always
67+
command: [ "/ihagent" ]
68+
args: [
69+
"--mode=debug"
70+
]
71+
envFrom:
72+
- configMapRef:
73+
name: telemetry-config
74+
volumeMounts:
75+
- name: ih-agent-config
76+
mountPath: /etc/appname
77+
readOnly: true
6478
- name: registration-agent
6579
image: ghcr.io/eclipse-cfm/cfm/regagent:latest
6680
imagePullPolicy: Always
@@ -96,6 +110,9 @@ spec:
96110
- name: edcv-agent-config
97111
configMap:
98112
name: edcv-agent-config
113+
- name: ih-agent-config
114+
configMap:
115+
name: ih-agent-config
99116
- name: registration-agent-config
100117
configMap:
101118
name: reg-agent-config

‎k8s/apps/ih-agent-config.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#
2+
# Copyright (c) 2025 Metaform Systems, Inc.
3+
#
4+
# This program and the accompanying materials are made available under the
5+
# terms of the Apache License, Version 2.0 which is available at
6+
# https://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# SPDX-License-Identifier: Apache-2.0
9+
#
10+
# Contributors:
11+
# Metaform Systems, Inc. - initial API and implementation
12+
#
13+
14+
---
15+
apiVersion: v1
16+
kind: ConfigMap
17+
metadata:
18+
name: ih-agent-config
19+
namespace: edc-v
20+
21+
data:
22+
# the file must be called "tm", and the extension must be one of
23+
# "json", "toml", "yaml", "yml", "properties", "props", "prop", "hcl", "tfvars", "dotenv", "env", "ini"
24+
ihagent.env: |
25+
uri: nats://nats.edc-v.svc.cluster.local:4222
26+
bucket: cfm-bucket
27+
stream: cfm-stream
28+
httpport: 8080
29+
postgres: true
30+
dsn: postgres://cfm:cfm@postgres.edc-v.svc.cluster.local:5432/cfm?sslmode=disable
31+
vault.url: http://vault.edc-v.svc.cluster.local:8200
32+
vault.path: secret
33+
vault.clientId: provisioner
34+
vault.clientSecret: provisioner-secret
35+
vault.tokenUrl: http://keycloak.edc-v.svc.cluster.local:8080/realms/edcv/protocol/openid-connect/token
36+
vault.softDelete: true
37+
keycloak.clientID: provisioner
38+
keycloak.clientSecret: provisioner-secret
39+
keycloak.tokenUrl: http://keycloak.edc-v.svc.cluster.local:8080/realms/edcv/protocol/openid-connect/token
40+
identityhub.url: http://identityhub.edc-v.svc.cluster.local:7081/api/identity
41+
identityhub.cs.url: http://identityhub.edc-v.svc.cluster.local:7082/api/credentials/v1/participants/%s
42+
controlplane.protocol.url: http://controlplane.edc-v.svc.cluster.local:8082/api/dsp/%s/2025-1

‎k8s/apps/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ resources:
2222
- identityhub-config.yaml
2323
- identityhub.yaml
2424
- edcv-agent-config.yaml
25+
- ih-agent-config.yaml
2526
- keycloak-agent-config.yaml
2627
- onboarding-agent-config.yaml
2728
- registration-agent-config.yaml

‎k8s/apps/provision-manager-seed-job.yaml‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,24 @@ spec:
8888
}'
8989
9090
echo "✓ edcv-activity created"
91+
92+
echo ""
93+
echo "Step 3: Create identityhub-activity ActivityDefinition"
94+
echo "------------------------------------------------"
95+
96+
curl -sfS -w "\nHTTP_STATUS:%{http_code}\n" -X POST "${PM_BASE_URL}/api/v1alpha1/activity-definitions" \
97+
-H "Content-Type: application/json" \
98+
-d '{
99+
"description": "Provisions IdentityHub entries",
100+
"inputSchema": {},
101+
"outputSchema": {},
102+
"type": "identityhub-activity"
103+
}'
104+
105+
echo "✓ identityhub-activity created"
91106
92107
echo ""
93-
echo "Step 3: Create registration-activity ActivityDefinition"
108+
echo "Step 4: Create registration-activity ActivityDefinition"
94109
echo "--------------------------------------------------------"
95110
96111
curl -sfS -w "\nHTTP_STATUS:%{http_code}\n" -X POST "${PM_BASE_URL}/api/v1alpha1/activity-definitions" \
@@ -105,7 +120,7 @@ spec:
105120
echo "✓ registration-activity created"
106121
107122
echo ""
108-
echo "Step 4: Create keycloak-activity ActivityDefinition"
123+
echo "Step 5: Create keycloak-activity ActivityDefinition"
109124
echo "----------------------------------------------------"
110125
111126
curl -sfS -w "\nHTTP_STATUS:%{http_code}\n" -X POST "${PM_BASE_URL}/api/v1alpha1/activity-definitions" \
@@ -120,7 +135,7 @@ spec:
120135
echo "✓ keycloak-activity created"
121136
122137
echo ""
123-
echo "Step 5: Create onboarding-activity ActivityDefinition"
138+
echo "Step 6: Create onboarding-activity ActivityDefinition"
124139
echo "------------------------------------------------------"
125140
126141
curl -sfS -w "\nHTTP_STATUS:%{http_code}\n" -X POST "${PM_BASE_URL}/api/v1alpha1/activity-definitions" \
@@ -135,7 +150,7 @@ spec:
135150
echo "✓ onboarding-activity created"
136151
137152
echo ""
138-
echo "Step 6: Create Orchestration Definition (deploy + dispose)"
153+
echo "Step 7: Create Orchestration Definition (deploy + dispose)"
139154
echo "------------------------------------------------"
140155
141156
DEPLOY_ORCH_ID=$(cat /proc/sys/kernel/random/uuid)
@@ -179,6 +194,14 @@ spec:
179194
{
180195
"id": "connector-provisioner",
181196
"type": "edcv-activity",
197+
"dependsOn": [
198+
"kc-client-provisioner",
199+
"identityhub-provisioner"
200+
]
201+
},
202+
{
203+
"id": "identityhub-provisioner",
204+
"type": "identityhub-activity",
182205
"dependsOn": [
183206
"kc-client-provisioner"
184207
]
@@ -188,6 +211,7 @@ spec:
188211
"type": "onboarding-activity",
189212
"dependsOn": [
190213
"connector-provisioner",
214+
"identityhub-provisioner",
191215
"registration-agent"
192216
]
193217
}]

0 commit comments

Comments
 (0)