feat: bump dex to v2.37.0 and introduce webhooks (#1685)

hack/release/go.mod

@@ -3,46 +3,47 @@ module github.com/mesosphere/kommander-applications/hack/release
 go 1.19
 
 require (
-	github.com/Masterminds/semver/v3 v3.1.1
+	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/drone/envsubst v1.0.3
-	github.com/fluxcd/helm-controller/api v0.22.1
-	github.com/otiai10/copy v1.7.0
+	github.com/fluxcd/helm-controller/api v0.36.1
+	github.com/otiai10/copy v1.12.0
 	github.com/r3labs/diff/v3 v3.0.0
-	github.com/spf13/cobra v1.6.1
-	github.com/stretchr/testify v1.8.1
+	github.com/spf13/cobra v1.7.0
+	github.com/stretchr/testify v1.8.4
 	sigs.k8s.io/yaml v1.3.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v0.4.1 // indirect
-	github.com/fluxcd/pkg/apis/meta v0.14.1 // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.1.1 // indirect
+	github.com/fluxcd/pkg/apis/meta v1.1.2 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/google/pprof v0.0.0-20230406165453-00490a63f317 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
-	golang.org/x/net v0.0.0-20220811182439-13a9a731de15 // indirect
-	golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	golang.org/x/net v0.16.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/tools v0.14.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.24.6 // indirect
-	k8s.io/apimachinery v0.24.6 // indirect
-	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	sigs.k8s.io/controller-runtime v0.11.2 // indirect
-	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
+	k8s.io/apiextensions-apiserver v0.28.2 // indirect
+	k8s.io/apimachinery v0.28.2 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	sigs.k8s.io/controller-runtime v0.16.2 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
 )

licenses.d2iq.yaml

@@ -184,7 +184,7 @@ resources:
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/kommander-auditing-pipeline
-  - container_image: docker.io/mesosphere/dex-controller:v0.9.1
+  - container_image: docker.io/mesosphere/dex-controller:v0.12.1
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/dex-controller
@@ -193,7 +193,7 @@ resources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/mesosphere/dex-k8s-authenticator
-  - container_image: docker.io/mesosphere/dex:v2.35.1-d2iq.1
+  - container_image: docker.io/mesosphere/dex:v2.37.0-d2iq.1
     sources:
       - license_path: LICENSE
         ref: ${image_tag}

magefiles/go.mod

@@ -15,8 +15,8 @@ require (
 	github.com/iancoleman/strcase v0.3.0 // indirect
 	github.com/magefile/mage v1.15.0 // indirect
 	github.com/vektah/gqlparser/v2 v2.5.6 // indirect
-	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/tools v0.11.0 // indirect
+	golang.org/x/mod v0.13.0 // indirect
+	golang.org/x/sync v0.4.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/tools v0.14.0 // indirect
 )

magefiles/go.sum

@@ -36,15 +36,11 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/vektah/gqlparser/v2 v2.5.6 h1:Ou14T0N1s191eRMZ1gARVqohcbe1e8FrcONScsq8cRU=
 github.com/vektah/gqlparser/v2 v2.5.6/go.mod h1:z8xXUff237NntSuH8mLFijZ+1tjV1swDbpDqjJmk6ME=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/tools v0.11.0 h1:EMCa6U9S2LtZXLAMoWiR/R8dAQFRqbAitmbJ2UKhoi8=
-golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

services/dex/2.12.4/defaults/cm.yaml → services/dex/2.13.2/defaults/cm.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: dex-2.12.4-d2iq-defaults
+  name: dex-2.13.2-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |-
     ---
     priorityClassName: "dkp-critical-priority"
     image: mesosphere/dex
-    imageTag: v2.35.1-d2iq.1
+    imageTag: v2.37.0-d2iq.1
     resources:
       requests:
         cpu: 100m
@@ -57,6 +57,37 @@ data:
         skipApprovalScreen: true
       staticClients: []
       lazyInitConnectors: true
+      connectorFiltersHooks:
+        filterHooks:
+        - name: "dex-controller"
+          type: "external"
+          requestContext:
+            params:
+              - "state"
+              - "tenant-id"
+          config:
+            url: "https://dex-dex-controller-webhook-service:18443/connectors"
+            tlsRootCAFile: "/etc/dex/tls/client/ca.crt"
+            clientAuthentication:
+              clientKeyFile: "/etc/dex/tls/client/tls.key"
+              clientCertificateFile: "/etc/dex/tls/client/tls.crt"
+              clientCAFile: "/etc/dex/tls/client/ca.crt"
+      tokenClaimsHooks:
+        mutatingHooks:
+        - name: "dex-controller"
+          type: "external"
+          claims:
+            - "groups"
+            - "email"
+            - "username"
+            - "preferred_username"
+          config:
+            url: "https://dex-dex-controller-webhook-service:18443/claims"
+            tlsRootCAFile: "/etc/dex/tls/client/ca.crt"
+            clientAuthentication:
+              clientKeyFile: "/etc/dex/tls/client/tls.key"
+              clientCertificateFile: "/etc/dex/tls/client/tls.crt"
+              clientCAFile: "/etc/dex/tls/client/ca.crt"
     certIssuerRef:
       kind: ${certificateIssuerKind:=Issuer}
       name: ${certificateIssuerName}

services/dex/2.12.4/dex.yaml → services/dex/2.13.2/dex.yaml

@@ -11,7 +11,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-charts-stable
         namespace: kommander-flux
-      version: 2.12.4
+      version: 2.13.2
   interval: 15s
   install:
     crds: CreateReplace
@@ -24,5 +24,5 @@ spec:
   releaseName: dex
   valuesFrom:
     - kind: ConfigMap
-      name: dex-2.12.4-d2iq-defaults
+      name: dex-2.13.2-d2iq-defaults
   targetNamespace: ${releaseNamespace}