feat: integrate with dex-oidc-config interface and remove public-url

[DnPlas]

This commit integrates the oidc-gatekeeper charm with dex-auth via the dex-oidc-config interface.

dex-auth (see canonical/dex-auth-operator#203) recently introduced the aforementioned interface, which will help us remove the public-url configuration option as the main way of configuring oidc-gatekeeper's OIDC_AUTH_PROVIDER env variable. The new relation provides all the information that is required for setting that env variable, so this charm and its users should not change it.

The changes in this PR include:

• Removing the public-url configuration option entirely (a backwards compatible solution is not required in this case because dex-auth already has it) -> this tackles Remove the public-url configuration option #157
• Removing all traces of the public-url from the charm code and test code
• Integrating with the new interface and use the relation data to render were needed -> this tackles Integrate with the dex-auth-info interface to set OIDC_PROVIDER value #156
• Adding the dex_oidc_config library to this charm so the interface is handled by it
• Adding some extra requirements for the library to work

Testing

1. Deploy the charm from this PR and dex-auth from latest/edge
2. Add the relation between the two juju relate dex-auth oidc-gatekeeper:dex-oidc-config
3. Confirm that the pebble layer of oidc-gatekeeper has the OIDC_AUTH_PROVIDER env variable matching the value from the relation data (issuer-url) -> for us it should be http://dex-auth.<namespace>.svc:5556/dex

$ juju ssh --container oidc-authservice oidc-gatekeeper/0
# bash
root@oidc-gatekeeper-0:/# pebble plan
services:
    oidc-authservice:
        summary: oidc-gatekeeper service
        startup: enabled
        override: replace
        command: /home/authservice/oidc-authservice
        environment:
            AFTER_LOGIN_URL: /
            AFTER_LOGOUT_URL: /
            AUTHSERVICE_URL_PREFIX: /authservice/
            CLIENT_ID: authservice-oidc
            CLIENT_SECRET: QU66F65WMLA0CQ4L1SLGC6QQXFMLZQ
            DISABLE_USERINFO: "true"
            OIDC_AUTH_URL: /dex/auth
            OIDC_PROVIDER: http://dex-auth.kubeflow.svc:5556/dex # <--- this should match relation data
...

$ juju show-unit oidc-gatekeeper/0
oidc-gatekeeper/0:
...
  - relation-id: 48
    endpoint: dex-oidc-config
    related-endpoint: dex-oidc-config
    application-data:
      issuer-url: http://dex-auth.kubeflow.svc:5556/dex # <--- this should match pebble layer
...

4. Additionally we can confirm this value is also used by Dex in its OIDC configuration

$ kubectl get svc -nkubeflow | grep dex
dex-auth                            ClusterIP      10.152.183.168   <none>                             5556/TCP,5558/TCP                       8m46s

$ curl 10.152.183.168:5556/dex/.well-known/openid-configuration
{
  "issuer": "http://dex-auth.kubeflow.svc:5556/dex", # <--- this should match oidc-gatekeeper's data
...

Fixes #156
Fixes #157

[rgildein]

Hi @DnPlas, I think you forgot to add the library to this PR. Also, I was not able to build this charm. Are you able to build it? See my logs.

[DnPlas]

Hi @DnPlas, I think you forgot to add the library to this PR. Also, I was not able to build this charm. Are you able to build it? See my logs.

You are right, let me add it right away and I'll add the missing dependencies (rust toolchain)

[orfeas-k]

Good job, left some comments. I 'm also testing right now and will comment back with my findings

[orfeas-k]

During testing, I first refreshed from an existing latest/edge deployment and this was the result

╰─$ juju ssh --container oidc-authservice oidc-gatekeeper/0     
# pebble plan
services:
    oidc-authservice:
        summary: oidc-gatekeeper service
        startup: enabled
        override: replace
        command: /home/authservice/oidc-authservice
        environment:
            AFTER_LOGIN_URL: /
            AFTER_LOGOUT_URL: /
            AUTHSERVICE_URL_PREFIX: /authservice/
            CLIENT_ID: authservice-oidc
            CLIENT_SECRET: H7Z5S5SBMS7F2WEZX90VPK6FQUS5HS
            DISABLE_USERINFO: "true"
            OIDC_AUTH_URL: /dex/auth
            OIDC_PROVIDER: http://10.64.140.43.nip.io/dex <---- here!!
..

I understand this is expected since public-url since:

$ juju config oidc-gatekeeper public-url                                                                                                                               130 ↵
http://10.64.140.43.nip.io
$ juju config dex-auth public-url                            
http://10.64.140.43.nip.io

and the relation data have issuer-url http://10.64.140.43.nip.io/dex.
After running

juju config dex-auth public-url="" 

I see the updated relation data

issuer-url  http://dex-auth.kubeflow.svc:5556/dex    

and pebble plan with

            OIDC_PROVIDER: http://dex-auth.kubeflow.svc:5556/dex

[orfeas-k]

Good job 🎉