From bbc28c88b713fccfa762b2e7aabf93387bda7da4 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 17 Sep 2026 16:58:49 -0400 Subject: [PATCH] Isolate the Hydra admin API on the soauth docker network The Hydra admin API creates OAuth clients and introspects tokens without authentication, relying on network isolation the same way Kratos does, but so-hydra published 0.0.0.0:4445:4445 and sat on sobridge. With userland-proxy left at its default of true, Docker ran a proxy listener on the host, so any container reached the admin API through the manager IP or the bridge gateway regardless of its docker network. so-hydra now sits alone on soauth and no longer publishes 4445. 4444 is still published, so the nginx proxy for /oauth2/token and the well-known endpoints is unchanged. so-soc is already dual homed from the Kratos change and reaches the admin API over soauth, so only its hostUrl moves. wait_for_hydra polls the container address instead of the host port. so-client reaches the admin API through docker exec, mirroring so-user. Exit codes still propagate, so the --fail-with-body error handling is unchanged. so-hydra is removed in up_to_3.4.0 alongside so-kratos and so-soc so the highstate recreates it with the correct network membership. The auth network range is already handled by set_soauth_range. --- salt/docker/defaults.yaml | 2 +- salt/hydra/enabled.sls | 6 +++--- salt/manager/tools/sbin/so-client | 21 +++++++++++++-------- salt/manager/tools/sbin/soup | 4 ++-- salt/vars/globals.map.jinja | 2 +- 5 files changed, 20 insertions(+), 15 deletions(-) diff --git a/salt/docker/defaults.yaml b/salt/docker/defaults.yaml index ea656f3dd..b1e0d9162 100644 --- a/salt/docker/defaults.yaml +++ b/salt/docker/defaults.yaml @@ -73,9 +73,9 @@ docker: ulimits: [] 'so-hydra': final_octet: 30 + networks: ['soauth'] port_bindings: - 0.0.0.0:4444:4444 - - 0.0.0.0:4445:4445 custom_bind_mounts: [] extra_hosts: [] extra_env: [] diff --git a/salt/hydra/enabled.sls b/salt/hydra/enabled.sls index 74106f550..13fce79cf 100644 --- a/salt/hydra/enabled.sls +++ b/salt/hydra/enabled.sls @@ -26,8 +26,8 @@ so-hydra: - hostname: hydra - name: so-hydra - networks: - - sobridge: - - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ip }} + - soauth: + - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }} - binds: - /opt/so/conf/hydra/:/hydra-conf:ro - /opt/so/log/hydra/:/hydra-log:rw @@ -73,7 +73,7 @@ delete_so-hydra_so-status.disabled: wait_for_hydra: http.wait_for_successful_query: - - name: 'http://{{ GLOBALS.manager }}:4444/health/alive' + - name: 'http://{{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }}:4444/health/alive' - ssl: True - verify_ssl: False - status: diff --git a/salt/manager/tools/sbin/so-client b/salt/manager/tools/sbin/so-client index f979d7bc0..0bafde603 100755 --- a/salt/manager/tools/sbin/so-client +++ b/salt/manager/tools/sbin/so-client @@ -106,7 +106,8 @@ while [[ $# -gt 0 ]]; do esac done -hydraUrl=${HYDRA_URL:-http://127.0.0.1:4445} +hydraContainer=${HYDRA_CONTAINER:-so-hydra} +hydraUrl=${HYDRA_URL:-http://localhost:4445} socRolesFile=${SOC_ROLES_FILE:-/opt/so/conf/soc/soc_clients_roles} soUID=${SOCORE_UID:-939} soGID=${SOCORE_GID:-939} @@ -124,6 +125,10 @@ function fail() { exit 1 } +function hydraCurl() { + docker exec -i "$hydraContainer" curl "$@" +} + function require() { cmd=$1 which "$1" 2>&1 > /dev/null @@ -133,8 +138,8 @@ function require() { # Verify this environment is capable of running this script function verifyEnvironment() { require "jq" - require "curl" - response=$(curl -Ss -L ${hydraUrl}/health/alive) + require "docker" + response=$(hydraCurl -Ss -L ${hydraUrl}/health/alive) [[ "$response" != '{"status":"ok"}' ]] && fail "Unable to communicate with Hydra; specify URL via HYDRA_URL environment variable" } @@ -164,7 +169,7 @@ function ensureRoleFileExists() { } function listClients() { - response=$(curl -Ss -L -f ${hydraUrl}/admin/clients) + response=$(hydraCurl -Ss -L -f ${hydraUrl}/admin/clients) [[ $? != 0 ]] && fail "Unable to communicate with Hydra" clientIds=$(echo "${response}" | jq -r ".[] | .client_id" | sort) @@ -251,7 +256,7 @@ function createClient() { EOF ) - response=$(curl -Ss -L --fail-with-body -X POST ${hydraUrl}/admin/clients -d "$body") + response=$(hydraCurl -Ss -L --fail-with-body -X POST ${hydraUrl}/admin/clients -d "$body") if [[ $? != 0 ]]; then error=$(echo $response | jq .error) fail "Failed to submit request to Hydra: $error" @@ -283,7 +288,7 @@ function update() { EOF ) - response=$(curl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body") + response=$(hydraCurl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body") if [[ $? != 0 ]]; then error=$(echo $response | jq .error) fail "Failed to submit request to Hydra: $error" @@ -305,7 +310,7 @@ function generateSecret() { EOF ) - response=$(curl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body") + response=$(hydraCurl -Ss -L --fail-with-body -X PATCH ${hydraUrl}/admin/clients/$id -d "$body") if [[ $? != 0 ]]; then error=$(echo $response | jq .error) fail "Failed to submit request to Hydra: $error" @@ -317,7 +322,7 @@ function deleteClient() { [[ ${identityId} == "" ]] && fail "Client not found" - response=$(curl -Ss -XDELETE -L --fail-with-body "${hydraUrl}/admin/clients/$identityId") + response=$(hydraCurl -Ss -XDELETE -L --fail-with-body "${hydraUrl}/admin/clients/$identityId") if [[ $? != 0 ]]; then error=$(echo $response | jq .error) fail "Failed to submit request to Hydra: $error" diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 2bc1ea9e8..62bc7d266 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1100,8 +1100,8 @@ post_to_3.3.0() { up_to_3.4.0() { set_soauth_range - echo "Removing so-kratos and so-soc so they are recreated on the soauth network." - docker rm -f so-kratos so-soc >> $SOUP_LOG 2>&1 + echo "Removing so-kratos, so-hydra and so-soc so they are recreated on the soauth network." + docker rm -f so-kratos so-hydra so-soc >> $SOUP_LOG 2>&1 INSTALLEDVERSION=3.4.0 } diff --git a/salt/vars/globals.map.jinja b/salt/vars/globals.map.jinja index 772fe8797..5060806d5 100644 --- a/salt/vars/globals.map.jinja +++ b/salt/vars/globals.map.jinja @@ -54,7 +54,7 @@ {% do GLOBALS.update({ 'application_urls': { - 'hydra': 'http://' ~ GLOBALS.manager ~ ':4445/', + 'hydra': 'http://' ~ DOCKERMERGED.containers['so-hydra'].ips['soauth'] ~ ':4445/', 'kratos': 'http://' ~ DOCKERMERGED.containers['so-kratos'].ips['soauth'] ~ ':4434/', 'elastic': 'https://' ~ GLOBALS.manager ~ ':9200/', 'influxdb': 'https://' ~ GLOBALS.manager ~ ':8086/'