forked from kubeflow/code-intelligence
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Create a minimally functional fulfillment webhook for dialogflow.
* The webhook handles requests asking who owns a specific area. THe fulfillment server maps the are to owners using the Kubeflow area label owners file. The fulfillment server then responds with a list of names. * Related to kubeflow#142 Update metrics notebook to take into account the age of the log message so we can look at recent issues.
- Loading branch information
Showing
39 changed files
with
1,240 additions
and
79 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # Trigger a build and push. | ||
| .PHONY: push | ||
| push: | ||
| skaffold render --output=../kubeflow_clusters/code-intelligence/acm-repo/dialogflow-webhook.yaml -v info | ||
| git add .. | ||
| git commit -m "Latest code" | ||
| # TODO(jlewi): How can we avoid hardcoding the remote name | ||
| git push jlewi | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,18 +6,35 @@ This is a Dialogflow fulfillment server. | |
|
|
||
| It is currently running in | ||
|
|
||
| * **Full cluster name**: gke_issue-label-bot-dev_us-east1-d_issue-label-bot | ||
| * **project**: issue-label-bot-dev | ||
| * **cluster**: issue-label-bot | ||
| * **cluster**: code-intelligence | ||
|
|
||
| It is deployed through ACM. To deploy it | ||
|
|
||
| ``` | ||
| skaffold render --output=../kubeflow_clusters/code-intelligence/acm-repo/dialogflow-webhook.yaml | ||
| ``` | ||
|
|
||
| Then commit and push the updated manifests to ACM | ||
|
|
||
| ## Notes. | ||
|
|
||
| To expose the webhook we need to bypass IAP. To do this we create a second K8s service to create a second GCP Backend Service | ||
| but with IAP enabled. | ||
|
|
||
| ``` | ||
| kubectl --context=issue-label-bot-dev -n istio-system create -f istio-ingressgateway.yaml | ||
| ``` | ||
| This requires the following modifications | ||
|
|
||
| * `kubeflow_clusters/code-intelligence/dialogflow-ingress.yaml` this file defines the Kubernetes service and backendconfig | ||
| * `kubeflow_clusters/code-intelligence/extensions_v1beta1_ingress_envoy-ingress.yaml` - We modify our existing | ||
| gateway to add a second path which won't have IAP enabled. | ||
|
|
||
|
|
||
| We need to manually modify the GCP health check associated with this backend | ||
|
|
||
| * Set the path to "/healthz/ready" | ||
| * Set the target port to the node port mapped to the istio status-port | ||
|
|
||
| ### Authorization using manual JWTs | ||
|
|
||
| We need to modify the security policy applied at the ingress gateway so that it won't reject requests without a valid | ||
| JWT. | ||
|
|
@@ -27,45 +44,76 @@ This traffic can't be routed through IAP. We will still use a JWT to restrict tr | |
|
|
||
| So we need to add a second JWT origin rule to match this traffic to the policy. | ||
|
|
||
| We can do this as | ||
|
|
||
| #### Creating a JWT | ||
|
|
||
| To generate JWTs we use the [jose-util](https://github.com/square/go-jose/tree/master/jose-util). | ||
|
|
||
| First we need to generate a public-private key pair to sign JWTs. | ||
|
|
||
|
|
||
| ``` | ||
| kubectl --context=issue-label-bot-dev -n istio-system patch policy ingress-jwt -p "$(cat ingress-jwt.patch.yaml)" --type=merge | ||
| git clone [email protected]:square/go-jose.git git_go-jose | ||
| cd git_go-jose/jose-uitl | ||
| go build. | ||
| ``` | ||
|
|
||
| To verify that is working we can port-forward to the service. | ||
| Generate a key pair | ||
|
|
||
|
|
||
| ``` | ||
| kubectl --context=issue-label-bot-dev -n istio-system port-forward service/chatbot-istio-ingressgateway 9080:80 | ||
| ./jose-util generate-key --alg=ES256 --use sig --kid=chatbot | ||
| ``` | ||
|
|
||
| Send a request with a JWT this should fail with "Origin Authentication Failure" since there is no JWT. | ||
| This will generate a json file. | ||
|
|
||
| Convert this to a JWK file. A JWK file is just a json file which has a list of keys; the keys being the contents of the | ||
| the json file outputted by jose-util. | ||
|
|
||
|
|
||
| Upload the public bit to a public GCS bucket. The following is our current public key. | ||
|
|
||
|
|
||
| ``` | ||
| curl localhost:9080/chatbot/dev/ -d '{}' -H "Content-Type: application/json" | ||
| https://storage.cloud.google.com/issue-label-bot-dev_public/chatbot/keys/jwk-sig-chatbot-pub.json | ||
| ``` | ||
|
|
||
|
|
||
| JWT's are bearer tokens so be sure to keep it secret. These JWTs also currently don't expire. | ||
|
|
||
| We modify the ISTIO policy to accept this JWT for paths prefixed by /chatbot; see `kubeflow_clusters/code-intelligence/acm-repo/authentication.istio.io_v1alpha1_policy_ingress-jwt.yaml` | ||
|
|
||
| To authorize Dialogflow webhook we will use a JWT. We use the jose-util to generate a public private key pair | ||
| To verify that is working try sending a request without a JWT | ||
|
|
||
| ``` | ||
| git clone [email protected]:square/go-jose.git git_go-jose | ||
| cd git_go-jose/jose-uitl | ||
| go build. | ||
| curl https://code-intelligence.endpoints.issue-label-bot-dev.cloud.goog/chatbot/ | ||
| ``` | ||
|
|
||
| Generate a key pair | ||
| * This should fail with error "Origin Authentication Failure" | ||
|
|
||
| Now generate a JWT using the binary | ||
|
|
||
| We can do this using the binary `cmd/jwt` | ||
|
|
||
| ``` | ||
| ./jose-util generate-key --alg=ES256 --use sig --kid=chatbot | ||
| cd cmd/jwt | ||
| go build . | ||
| ./jwt | ||
| ``` | ||
|
|
||
| Upload the public bit to a public GCS bucket | ||
| Send a request using this JWT in the header | ||
|
|
||
| ``` | ||
| https://storage.cloud.google.com/issue-label-bot-dev_public/chatbot/keys/jwk-sig-chatbot-pub.json | ||
| curl https://code-intelligence.endpoints.issue-label-bot-dev.cloud.goog/chatbot/ -H "Authorization: Bearer ${CHATBOTJWT}" | ||
| ``` | ||
|
|
||
| * This request should succeed. | ||
|
|
||
| To test the webhook path | ||
|
|
||
| ``` | ||
| curl https://code-intelligence.endpoints.issue-label-bot-dev.cloud.goog/chatbot/dev/dialogflow/webhook -H "Authorization: Bearer ${CHATBOTJWT}" -d '{}' -H "Content-Type: application/json" | ||
| ``` | ||
|
|
||
| ## Referencess | ||
|
|
||
Oops, something went wrong.