feature: Basic auth support with fission router (#2292)

charts/fission-all/templates/NOTES.txt

@@ -20,6 +20,15 @@ Windows:
   # Register this function with Fission
   $ fission function create --name hello --env nodejs --code hello.js
 
+{{- if .Values.authentication.enabled }}
+
+  # Create token
+  $ FISSION_USERNAME=$(kubectl get secrets/router --template={{`{{.data.username}}`}} -n fission | base64 -d)
+  $ FISSION_PASSWORD=$(kubectl get secrets/router --template={{`{{.data.password}}`}} -n fission | base64 -d)
+  $ export FISSION_AUTH_TOKEN=$(fission token create --username $FISSION_USERNAME --password $FISSION_PASSWORD)
+{{- end }}
+
   # Run this function
   $ fission function test --name hello
   Hello, world!
+

charts/fission-all/templates/_helpers.tpl

@@ -31,6 +31,13 @@ canary:
   prometheusSvc: {{ .Values.prometheus.serviceEndpoint | default "" | quote }}
   {{- end }}
   {{- printf "\n" -}}
+auth:
+  enabled: {{ .Values.authentication.enabled | default false }}
+  {{- if .Values.authentication.enabled }}
+  authUriPath: {{ .Values.authentication.authUriPath | default "/auth/login" | quote}}
+  jwtExpiryTime: {{ .Values.authentication.jwtExpiryTime | default 120 }}
+  jwtIssuer: {{ .Values.authentication.jwtIssuer | default "fission" | quote }}
+  {{- end }}
 {{- end -}}
 
 {{/*

charts/fission-all/templates/router/deployment.yaml

@@ -35,6 +35,23 @@ spec:
         command: ["/fission-bundle"]
         args: ["--routerPort", "8888", "--executorUrl", "http://executor.{{ .Release.Namespace }}"]
         env:
+        {{- if .Values.authentication.enabled }}
+        - name: AUTH_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: router
+              key: username
+        - name: AUTH_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: router
+              key: password
+        - name: JWT_SIGNING_KEY
+          valueFrom:
+            secretKeyRef:
+              name: router
+              key: jwtSigningKey
+        {{- end }}      
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
@@ -80,6 +97,10 @@ spec:
             port: 8888
           initialDelaySeconds: 35
           periodSeconds: 5
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/config/config.yaml
+          subPath: config.yaml
         ports:
         - containerPort: 8080
           name: metrics
@@ -100,6 +121,10 @@ spec:
         terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
         {{- end }}
       serviceAccountName: fission-svc
+      volumes:
+      - name: config-volume
+        configMap:
+          name: feature-config
 {{- if .Values.router.priorityClassName }}
       priorityClassName: {{ .Values.router.priorityClassName }}
 {{- else if .Values.priorityClassName }}

charts/fission-all/templates/router/secret.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.authentication.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: router
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": pre-install
+data:
+  username: {{ .Values.authentication.authUsername | b64enc | quote }}
+  password: {{ randAlphaNum 20 | b64enc | quote }}
+  jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
+{{- end }}

charts/fission-all/values.yaml

@@ -161,7 +161,6 @@ router:
   ## router resource utilization when under heavy workloads.
   ##
   displayAccessLog: false
-
   ## svcAnnotations is the annotations to be added to the service resource created for router.
   ##
   # svcAnnotations:
@@ -483,6 +482,37 @@ prometheus:
 canaryDeployment:
   enabled: false
 
+## Enable authentication for fission function invocation via Fission router
+##
+authentication:
+  ## set this flag to true if you need authentication
+  ## for all function invocations
+  ## default 'false'
+  ##
+  enabled: false
+  ## authUriPath defines authentication endpoint path
+  ## via router
+  ## default '/auth/login'
+  ##
+  authUriPath:
+  ## authUsername is used as a username for authentication
+  ## default 'admin'
+  ##
+  authUsername: admin
+  ## jwtSigningKey is the signing key used for
+  ## signing the JWT token
+  ##
+  jwtSigningKey: serverless
+  ## jwtExpiryTime is the JWT expiry time
+  ## in seconds
+  ## default '120'
+  ##
+  jwtExpiryTime: 
+  ## jwtIssuer is the issuer of JWT
+  ## default 'fission'
+  ##
+  jwtIssuer: fission
+
 ## Use the following flags to enable OpenTracing.
 ## Note: OpenTracing support will be removed in an upcoming release.
 ## Please prefer using OpenTelemetry instead.