feat: use self-minted tokens for sessions and migrate resource pool checks to authz (#4419)

Add new internal features to Renku, including:
* refactor access and refresh token handling in the backend, use internal tokens for sessions
* migrate resource pool authorization checks to authz

Note for @SwissDataScienceCenter/yat: the next release will need sessions to be paused during the upgrade.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Renku Bot <renku@datascience.ch>
Co-authored-by: Alessandro Degano <a.degano@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lorenzo Cavazzi <43481553+lorenzo-cavazzi@users.noreply.github.com>
Co-authored-by: Tasko Olevski <16360283+olevski@users.noreply.github.com>
Co-authored-by: Lorenzo <lorenzo.cavazzi.tech@gmail.com>
Co-authored-by: Salim Kayal <salim.kayal@idiap.ch>

Author: 7 people

helm-chart/renku/requirements.yaml

@@ -13,7 +13,7 @@ dependencies:
     condition: redis.install
   - name: amalthea-sessions
     repository: "https://swissdatasciencecenter.github.io/helm-charts/"
-    version: "0.27.2"
+    version: "0.28.0"
   - name: dlf-chart
     repository: "https://swissdatasciencecenter.github.io/datashim/"
     version: "0.3.9-renku-2"

helm-chart/renku/templates/data-service/deployment.yaml

@@ -75,6 +75,8 @@ spec:
               value: /secrets/encryptionKey/encryptionKey
             - name: SECRETS_SERVICE_PUBLIC_KEY_PATH
               value: /secrets/publicKey/publicKey
+            - name: INTERNAL_AUTHN_SECRET_KEY_PATH
+              value: /secrets/internalSecretKey/secretKey
             - name: K8S_NAMESPACE
               value: {{ .Release.Namespace | quote }}
             - name: MAX_PINNED_PROJECTS
@@ -215,6 +217,9 @@ spec:
             - mountPath: "/secrets/publicKey"
               name: secret-service-public-key
               readOnly: true
+            - mountPath: "/secrets/internalSecretKey"
+              name: internal-authn-key
+              readOnly: true
             {{- if .Values.dataService.remoteClustersKubeconfigSecretName }}
             - name: remote-cluster-kubeconfigs
               mountPath: "/secrets/kube_configs"
@@ -271,6 +276,12 @@ spec:
             items:
             - key: publicKey
               path: publicKey
+        - name: internal-authn-key
+          secret:
+            secretName: {{ template "renku.fullname" . }}-internal-authn
+            items:
+            - key: secretKey
+              path: secretKey
         {{- if .Values.dataService.remoteClustersKubeconfigSecretName }}
         - name: remote-cluster-kubeconfigs
           secret:

helm-chart/renku/templates/data-service/deployment_k8s_watcher.yaml

@@ -69,6 +69,15 @@ spec:
               value: {{ .Values.dataService.k8sWatcher.sentry.environment | quote }}
             - name: SENTRY_SAMPLE_RATE
               value: {{ .Values.dataService.k8sWatcher.sentry.sampleRate | quote }}
+            - name: AUTHZ_DB_HOST
+              value: {{ include "renku.fullname" . }}-authz
+            - name: AUTHZ_DB_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "renku.fullname" . }}-authz
+                  key: SPICEDB_GRPC_PRESHARED_KEY
+            - name: AUTHZ_DB_GRPC_PORT
+              value: "50051"
             {{- if .Values.dataService.remoteClustersKubeconfigSecretName }}
             - name: K8S_CONFIGS_ROOT
               value: "/secrets/kube_configs"

helm-chart/renku/values.yaml

@@ -14,6 +14,7 @@ global:
   # secretServicePrivateKey: ... RSA Private Key in PKCS8 PEM format (`ssh-keygen -m PKCS8 -t rsa -b 4096`)
   # secretServicePreviousPrivateKey: ... Previous Private key in PEM format, only set this when rotating keys
   # dataServiceEncryptionKey: 32 byte random string
+  # dataServiceInternalAuthnKey: 64 byte random string
   gitlab:
     ## Name of the postgres database to be used by Gitlab
     postgresDatabase: gitlabhq_production
@@ -992,7 +993,7 @@ notebooks:
   gitHttpsProxy:
     image:
       name: renku/sidecars
-      tag: 0.26.2
+      tag: "0.28.0"
     args: ["gitproxy", "proxy"]
     port: 65480
     healthPort: 65481
@@ -1091,7 +1092,7 @@ gateway:
   secretKey:
   image:
     repository: renku/renku-gateway
-    tag: "1.9.0"
+    tag: "1.10.0"
     pullPolicy: IfNotPresent
   service:
     type: ClusterIP
@@ -1183,12 +1184,12 @@ dataService:
     existingPriorityClass: ""
   image:
     repository: renku/renku-data-service
-    tag: "0.72.2"
+    tag: "0.73.0"
     pullPolicy: IfNotPresent
   k8sWatcher:
     image:
       repository: renku/data-service-k8s-watcher
-      tag: "0.72.2"
+      tag: "0.73.0"
       pullPolicy: IfNotPresent
     resources: {}
     sentry:
@@ -1199,7 +1200,7 @@ dataService:
   dataTasks:
     image:
       repository: renku/data-service-data-tasks
-      tag: "0.72.2"
+      tag: "0.73.0"
       pullPolicy: IfNotPresent
     resources: {}
     enableResourceRequestTracking: false
@@ -1330,7 +1331,7 @@ authz:
 secretsStorage:
   image:
     repository: renku/secrets-storage
-    tag: "0.72.2"
+    tag: "0.73.0"
     pullPolicy: IfNotPresent
   service:
     type: ClusterIP

scripts/platform-init/platform-init.py

@@ -1,6 +1,7 @@
-from base64 import b64decode, b64encode
+from base64 import b64decode, b64encode, urlsafe_b64encode
 import yaml
 import logging
+import random
 from typing import cast
 from kubernetes import client as k8s_client, config as k8s_config
 from dataclasses import dataclass, field
@@ -23,6 +24,7 @@ class Config:
     secret_service_private_key: str | None = field(repr=False)
     encryption_key: str | None = field(repr=False)
     previous_secret_service_private_key: str | None = field(repr=False)
+    internal_authn_secret_key : str | None = field(repr=False)
 
     @classmethod
     def from_env(cls):
@@ -40,6 +42,7 @@ def from_env(cls):
             ),
             secret_service_private_key_secret_name=f"{renku_fullname}-secret-service-private-key",
             secret_service_public_key_secret_name=f"{renku_fullname}-secret-service-public-key",
+            internal_authn_secret_key=config_map.get("dataServiceInternalAuthnKey"),
         )
 
 
@@ -257,6 +260,50 @@ def init_secret_and_data_service_encryption(config: Config):
             ),
         )
 
+def init_data_service_internal_authentication_secret_key(config: Config):
+    """Initialize symmetric signing key for internal authentication in data service."""
+    logging.info("Initializing data service internal secret key")
+    v1 = k8s_client.CoreV1Api()
+
+    internal_secret_key = f"{config.renku_fullname}-internal-authn"
+    internal_secret_key_name = "secretKey"
+    existing_internal_secret_key = _get_k8s_secret(
+        config.k8s_namespace, internal_secret_key, internal_secret_key_name
+    )
+
+    if existing_internal_secret_key is None and config.internal_authn_secret_key is None:
+        # generate a random string
+        rand = random.SystemRandom()
+        key = urlsafe_b64encode (rand.randbytes(64))
+        v1.create_namespaced_secret(
+            config.k8s_namespace,
+            k8s_client.V1Secret(
+                api_version="v1",
+                data={internal_secret_key_name: b64encode(key).decode()},
+                kind="Secret",
+                metadata={
+                    "name": internal_secret_key,
+                    "namespace": config.k8s_namespace,
+                },
+                type="Opaque",
+            ),
+        )
+    elif existing_internal_secret_key is None and config.internal_authn_secret_key is not None:
+        key = config.internal_authn_secret_key.encode()
+        v1.create_namespaced_secret(
+            config.k8s_namespace,
+            k8s_client.V1Secret(
+                api_version="v1",
+                data={internal_secret_key_name: b64encode(key).decode()},
+                kind="Secret",
+                metadata={
+                    "name": internal_secret_key,
+                    "namespace": config.k8s_namespace,
+                },
+                type="Opaque",
+            ),
+        )
+
 
 def main():
     config = Config.from_env()
@@ -265,6 +312,7 @@ def main():
     logging.info("Initializing Renku platform")
     set_secret_service_secrets(config)
     init_secret_and_data_service_encryption(config)
+    init_data_service_internal_authentication_secret_key(config)
 
 
 if __name__ == "__main__":