Serverless Function Authentication with Ory Oathkeeper in Kubernetes

Question

Pulumi · Accepted Answer

To set up a serverless function with authentication in Kubernetes using Ory Oathkeeper, you would typically need to create and configure the following components:

1. **A Kubernetes cluster**: This is where all your services will run.
2. **A serverless function provider**: This could be a Kubernetes-native solution like Knative or a cloud provider offering like AWS Lambda running on a Kubernetes backend through something like the AWS Lambda Custom Runtime on Kubernetes.
3. **Ory OAuthkeeper**: It's an identity and access proxy that operates at the edge of your infrastructure (in your API Gateway), so no internal network traffic ever needs to be exposed.
4. **Ingress or API gateway**: To direct external traffic to your services correctly and securely within the Kubernetes cluster.

I'll provide you with a basic example of how to achieve this with Pulumi and Python, assuming you already have a Kubernetes cluster set up and ready to use.

This program will:
- Deploy a simple serverless function to your Kubernetes cluster.
- Install Ory Oathkeeper as an identity and access proxy to secure the function.
- Create an ingress rule so that the serverless function can be accessed from outside the cluster, but only with proper authentication via Ory Oathkeeper.

Please note: Ory Oathkeeper setup and configuration can be quite complex and involves creating several Kubernetes resources like Deployments, Services, ConfigMaps, and Secrets. For simplicity, this example will not cover the full range of configurations that you would need for a production setup.

```python
import pulumi
import pulumi_kubernetes as k8s

# Replace `my_namespace` with the appropriate namespace in your Kubernetes cluster.
namespace = "my_namespace"

# Define the serverless function (you could use Knative or OpenFaaS or any serverless framework that works with Kubernetes).
# Note: The actual function code and container image needs to be provided.
function = k8s.apps.v1.Deployment(
    "serverless-function",
    metadata=k8s.meta.v1.ObjectMetaArgs(
        name="serverless-function",
        namespace=namespace,
    ),
    spec=k8s.apps.v1.DeploymentSpecArgs(
        selector=k8s.meta.v1.LabelSelectorArgs(
            match_labels={"app": "serverless-function"},
        ),
        replicas=1,
        template=k8s.core.v1.PodTemplateSpecArgs(
            metadata=k8s.meta.v1.ObjectMetaArgs(
                labels={"app": "serverless-function"},
            ),
            spec=k8s.core.v1.PodSpecArgs(
                containers=[
                    k8s.core.v1.ContainerArgs(
                        name="function",
                        image="YOUR_FUNCTION_CONTAINER_IMAGE",
                        # Add any other necessary container configurations.
                    ),
                ],
            ),
        ),
    ),
)

# Ory Oathkeeper's Proxy is the component that handles incoming traffic, typically exposed via an Ingress.
# Deploying Ory Oathkeeper to Kubernetes is a non-trivial process that typically involves deploying
# a series of components. For the sake of brevity, this example will assume that you have an existing
# Helm chart or manifest files to deploy Ory Oathkeeper.

# IMPORTANT: The actual implementation for Ory Oathkeeper varies greatly depending on your specific use-case
# and security requirements. Please refer to the Ory Oathkeeper documentation for setup instructions:
# https://www.ory.sh/oathkeeper/docs/

# Create an Ingress to expose the serverless function and route through Ory Oathkeeper for authentication.
ingress = k8s.networking.v1.Ingress(
    "serverless-function-ingress",
    metadata=k8s.meta.v1.ObjectMetaArgs(
        name="serverless-function-ingress",
        namespace=namespace,
        # Annotate with Ory Oathkeeper specific settings, these are placeholders and should be changed accordingly.
        annotations={
            "kubernetes.io/ingress.class": "nginx",
            "nginx.ingress.kubernetes.io/auth-url": "http://ory-oathkeeper-proxy.my_namespace.svc.cluster.local:4455/auth",
            "nginx.ingress.kubernetes.io/auth-signin": "https://my-oauth-service.my_namespace/login",
        },
    ),
    spec=k8s.networking.v1.IngressSpecArgs(
        rules=[
            k8s.networking.v1.IngressRuleArgs(
                host="function.mydomain.com",
                http=k8s.networking.v1.HTTPIngressRuleValueArgs(
                    paths=[
                        k8s.networking.v1.HTTPIngressPathArgs(
                            path="/",
                            path_type="Prefix",
                            backend=k8s.networking.v1.IngressBackendArgs(
                                service=k8s.networking.v1.IngressServiceBackendArgs(
                                    name="serverless-function",
                                    port=k8s.networking.v1.ServiceBackendPortArgs(
                                        number=80,
                                    ),
                                ),
                            ),
                        ),
                    ],
                ),
            ),
        ],
    ),
)

pulumi.export('ingress_url', pulumi.Output.concat("http://", ingress.metadata.apply(lambda metadata: metadata.name), ".mydomain.com"))
```

In this program:
- We define a `serverless-function` Deployment resource. This represents the serverless function that we want to deploy. Replace `YOUR_FUNCTION_CONTAINER_IMAGE` with the Docker image that contains your function code.
- We've set up an Ingress named `serverless-function-ingress` that routes traffic to the `serverless-function` Service. The Ingress is annotated with the necessary settings to integrate with Ory Oathkeeper, which is assumed to be deployed separately. The annotations direct all authentication requests to Ory Oathkeeper's proxy service.
- We export the URL where the serverless function will be available once the Ingress is up and running.

Please replace any placeholder strings like `YOUR_FUNCTION_CONTAINER_IMAGE`, `my_namespace`, and `mydomain.com` with your actual container image, Kubernetes namespace, and domain.

For a real-world deployment, you would also set up Ory Oathkeeper with the appropriate rules and access policies. You could manage its deployment using Helm or simply applying raw YAML files with Pulumi's `ConfigFile` or `ConfigGroup` resources from the `pulumi_kubernetes.yaml` module. For more advanced scenarios, you'd also include error handling, logging, and security settings.

Remember, Pulumi can work alongside existing tools like Helm or kubectl. That means you can use Pulumi to handle parts of