Add Dex for Sub-Cluster Authentication

lb4368 commented 3 years ago

Problem description Need to provide a Dex OIDC provider pod during a sub-cluster deployment in order to be able to configure authentication and authorization within each sub-cluster.

Previous design had the SIP operator delivering Dex as a infrastructure service as a SIP CR was applied. Since Dex deployment does not rely on any of SIP scheduling results and can leverage manifest functions defined for delivering Dex for the target cluster, it may be simpler to deliver Dex per sub-cluster directly via manifests during the same phase that the SIP CR is delivered for providing sub-cluster infrastructure. This also decouples Dex as the authentication provider for the sub-clusters.

Proposed change Leverage manifest functions created as part of #19 to deliver a Dex service to the target cluster on a specified NodePort as part of each sub-cluster deployment.

The deployment of Dex will need to allow for specifying configuration of Dex for the associated sub-cluster including:

The NodePort on the target cluster where the sub-cluster auth service will be exposed for HTTPS access
The LDAP back-end info (URL, credentials, search attributes, etc.)
Sub-cluster information needed to enable authentication (CA cert/key, API server port, VIP address(es), FQDN(s), etc.)
Dex pod replica count (this can be set by patching the HelmRelease document if the default needs to be overridden)