run CI for #7966#8261
Draft
n1ru4l wants to merge 64 commits into
Draft
Conversation
#2) * feat: add Azure Federated Identity (OAuthBearer) support for Kafka/EventHub Add support for the `oauthbearer` SASL mechanism in both the usage and usage-ingestor services, enabling Azure Workload Identity authentication to Event Hub when deployed in Kubernetes. Changes: - Add `@azure/identity` dependency to usage and usage-ingestor packages - Add `oauthbearer` SASL mechanism to environment config (Zod schemas) - Create `oauth-bearer-provider.ts` using DefaultAzureCredential - Update Kafka client initialization to support oauthbearer mechanism - Update Pulumi deployment to conditionally configure oauthbearer Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/b3983d22-e4bf-4a52-90f1-c93895adeff8 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * refactor: improve OAuth bearer provider error handling and documentation Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/b3983d22-e4bf-4a52-90f1-c93895adeff8 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * revert: remove incorrect Kafka OAuthBearer changes Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/755ee5ba-e92c-4df8-b742-e04e182b5a13 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * feat: add Azure Federated Workload Identity support for OIDC SSO login When deployed in Kubernetes with Azure Workload Identity, the OIDC integration can now authenticate to the identity provider using a federated token (client_assertion) instead of a client_secret. Changes: - DB migration: add use_federated_credential column, make client_secret nullable - Entity/model: update OIDCIntegration to include useFederatedCredential - GraphQL: make clientSecret optional in create input, add useFederatedCredential field - OIDC provider: allow creation without client secret when federated - Auth server: use client_assertion with AZURE_FEDERATED_TOKEN_FILE - UI: show federated credential status, allow saving without client secret Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/755ee5ba-e92c-4df8-b742-e04e182b5a13 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * fix: use strict equality for null check in OIDC provider Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/755ee5ba-e92c-4df8-b742-e04e182b5a13 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
…irect process.env access (#3) Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/8b554117-9357-40a5-9879-83f5ac168987 Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com>
* Add validation in updateOIDCIntegration to ensure valid auth method after update Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/3b791a1d-2b1b-4152-af23-11dcd32bc977 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * Improve error message for missing auth method validation Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/3b791a1d-2b1b-4152-af23-11dcd32bc977 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com>
…rated token management (#5) * refactor: move federated token reading to WorkloadIdentityFederationProvider with polling Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/75f0bc25-7acb-495c-bd74-6767a633f1d3 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> * fix: trim whitespace from federated token file content Agent-Logs-Url: https://github.com/cosmincatalin/console/sessions/75f0bc25-7acb-495c-bd74-6767a633f1d3 Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: cosmincatalin <525590+cosmincatalin@users.noreply.github.com>
The `useFederatedCredential` flag is no longer stored on OIDC integration entities or exposed in the API/UI. Instead, the decision to use federated credentials is now externalized and controlled solely by environment variables, specifically `OIDC_WORKLOAD_FEDERATION_ORGANIZATION_IDS`. This simplifies the OIDC integration model by making client secrets always required unless an organization is explicitly listed for federated authentication via environment configuration.
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
Contributor
Contributor
|
🐋 This PR was built and pushed to the following Docker images: Targets: Platforms: Image Tags: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
run CI for #7966