worksmobile 연동 & ory stack 26.2.0으로 업그레이드

2026-05-06 09:30:00 +09:00
parent 3dcdd97882
commit 2495fcb13d
74 changed files with 8698 additions and 212 deletions
--- a/docker/compose.ory.yaml
+++ b/docker/compose.ory.yaml
@@ -88,6 +88,33 @@ services:
            - ory-net
            - hydranet

+    keto-migrate:
+        image: oryd/keto:${KETO_VERSION:-v25.4.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+        volumes:
+            - ./docker/ory/keto:/etc/config/keto
+        command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
+
+    keto:
+        image: oryd/keto:${KETO_VERSION:-v25.4.0}
+        container_name: ory_keto
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+        volumes:
+            - ./docker/ory/keto:/etc/config/keto
+        command: serve -c /etc/config/keto/keto.yml
+        depends_on:
+            keto-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+
    oathkeeper:
        image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v0.40.6}
        container_name: oathkeeper
@@ -123,20 +150,32 @@ services:
              echo 'Wait for services...';
              until curl -s http://kratos:4433/health/ready; do sleep 1; done;
              until curl -s http://hydra:4444/health/ready; do sleep 1; done;
+              until curl -s http://keto:4466/health/ready; do sleep 1; done;
              echo 'Ory Stack is fully operational!';"
        depends_on:
            - kratos
            - hydra
+            - keto
        networks:
            - ory-net

    init-rp:
-        image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+        image: alpine:latest
        container_name: init-rp
-        entrypoint: ["/bin/sh"]
+        env_file:
+            - ../.env
        command:
+            - /bin/sh
            - -ec
            - |
+              apk add --no-cache curl tar
+              HYDRA_CLI_VERSION="$${HYDRA_VERSION:-v26.2.0}"
+              HYDRA_CLI_VERSION="$${HYDRA_CLI_VERSION%-distroless}"
+              HYDRA_CLI_ARCHIVE_VERSION="$${HYDRA_CLI_VERSION#v}"
+              curl -fsSLo /tmp/hydra.tar.gz "https://github.com/ory/hydra/releases/download/$${HYDRA_CLI_VERSION}/hydra_$${HYDRA_CLI_ARCHIVE_VERSION}-linux_64bit.tar.gz"
+              tar -xzf /tmp/hydra.tar.gz -C /usr/local/bin hydra
+              rm /tmp/hydra.tar.gz
+
              echo "Creating/Updating OAuth2 Clients..."
              
              hydra create oauth2-client \
--- a/docker/ory/kratos/kratos.yml
+++ b/docker/ory/kratos/kratos.yml
@@ -1,4 +1,4 @@
-version: v25.4.0
+version: v26.2.0

 dsn: ${DSN}

--- a/docker/ory/oathkeeper/entrypoint.sh
+++ b/docker/ory/oathkeeper/entrypoint.sh
@@ -19,17 +19,15 @@ export RULES_FILE

 echo "[oathkeeper] APP_ENV=$APP_ENV_VALUE rules=$RULES_FILE"

-RULES_ACTIVE="/etc/config/oathkeeper/rules.active.json"
+RUNTIME_DIR="/tmp/oathkeeper"
+RULES_ACTIVE="${RUNTIME_DIR}/rules.active.json"
 if [ ! -f "$RULES_FILE" ]; then
  echo "[oathkeeper] rules file not found: $RULES_FILE"
  exit 1
 fi

-# Remove existing active rules file to prevent overwrite issues (File exists/Permission denied)
-if [ -f "$RULES_ACTIVE" ]; then
-  rm -f "$RULES_ACTIVE" || echo "[oathkeeper] Warning: Failed to remove existing rules.active.json"
-fi
-cp -f "$RULES_FILE" "$RULES_ACTIVE" || echo "[oathkeeper] Warning: Failed to copy rules file. Using existing if present."
+mkdir -p "$RUNTIME_DIR"
+cp -f "$RULES_FILE" "$RULES_ACTIVE"

 LOG_DIR="/var/log/oathkeeper"
 LOG_FILE="${LOG_DIR}/access.log"
@@ -41,7 +39,7 @@ if ! touch "$LOG_FILE" 2>/dev/null; then
 fi

 if [ -n "$LOG_FILE" ]; then
-  exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml 2>&1 | tee \"$LOG_FILE\""
+  exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml 2>&1 | tee -a \"$LOG_FILE\""
 fi

 exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml"
--- a/docker/ory/oathkeeper/oathkeeper.yml
+++ b/docker/ory/oathkeeper/oathkeeper.yml
@@ -14,7 +14,7 @@ errors:

 access_rules:
  repositories:
-    - file:///etc/config/oathkeeper/rules.active.json
+    - file:///tmp/oathkeeper/rules.active.json

 authenticators:
  noop:
--- a/docker/ory/vector/vector.toml
+++ b/docker/ory/vector/vector.toml
@@ -7,56 +7,60 @@
  type = "remap"
  inputs = ["oathkeeper_file"]
  source = '''
-    .raw = .message
-    parsed = parse_json(.message) ?? {}
-
-    .timestamp = to_timestamp(.timestamp) ?? now()
-    .request_id = parsed.request_id ?? parsed.req_id ?? ""
-    request_method = get(parsed, ["request", "method"]) ?? ""
-    request_path = get(parsed, ["request", "path"]) ?? ""
-    request_url = get(parsed, ["request", "url"]) ?? ""
-    request_host = get(parsed, ["request", "host"]) ?? ""
-    request_scheme = get(parsed, ["request", "scheme"]) ?? ""
-    request_query = get(parsed, ["request", "query"]) ?? ""
-    .method = parsed.method ?? parsed.http_method ?? request_method ?? ""
-    .path = parsed.path ?? parsed.http_path ?? request_path ?? request_url ?? ""
+    raw = to_string(.message) ?? ""
+    parsed = parse_json(raw) ?? {}
+    request_method = to_string(get(parsed, ["request", "method"]) ?? "") ?? ""
+    request_path = to_string(get(parsed, ["request", "path"]) ?? "") ?? ""
+    request_url = to_string(get(parsed, ["request", "url"]) ?? "") ?? ""
+    request_host = to_string(get(parsed, ["request", "host"]) ?? "") ?? ""
+    request_scheme = to_string(get(parsed, ["request", "scheme"]) ?? "") ?? ""
+    request_query = to_string(get(parsed, ["request", "query"]) ?? "") ?? ""
    response_status = get(parsed, ["response", "status"]) ?? 0
-    .status = to_int(parsed.status ?? parsed.status_code ?? response_status ?? 0) ?? 0
-    .latency_ms = to_int(parsed.latency_ms ?? parsed.duration_ms ?? parsed.took ?? 0) ?? 0
-    identity_id = get(parsed, ["identity", "id"]) ?? ""
-    .subject = parsed.subject ?? identity_id ?? ""
-    .client_ip = parsed.client_ip ?? parsed.remote_ip ?? parsed.ip ?? ""
+    identity_id = to_string(get(parsed, ["identity", "id"]) ?? "") ?? ""
    headers = get(parsed, ["headers"]) ?? {}
-    .user_agent = parsed.user_agent
-    if is_null(.user_agent) { .user_agent = get(headers, ["User-Agent"]) }
-    if is_null(.user_agent) { .user_agent = "" }
-    .referer = get(headers, ["Referer"]) ?? ""
-
-    .decision = parsed.decision
-    if is_null(.decision) { .decision = parsed.result }
-    if is_null(.decision) { .decision = "" }
-
-    .trace_id = parsed.trace_id
-    if is_null(.trace_id) { .trace_id = "" }
-
-    .span_id = parsed.span_id
-    if is_null(.span_id) { .span_id = "" }
-
-    .rp = parsed.rp ?? ""
-    .action = parsed.action ?? ""
-    .target = parsed.target ?? ""
-    .rule_id = parsed.rule_id ?? get(parsed, ["rule", "id"]) ?? ""
-    parsed_url = {}
-    if request_url != "" { parsed_url = parse_url(request_url) ?? {} }
+    user_agent = to_string(get(headers, ["User-Agent"]) ?? "") ?? ""
+    referer = to_string(get(headers, ["Referer"]) ?? "") ?? ""
+    rule_id = to_string(get(parsed, ["rule", "id"]) ?? "") ?? ""
+    upstream_url = to_string(get(parsed, ["upstream", "url"]) ?? "") ?? ""
+    client_id = to_string(get(parsed, ["client", "id"]) ?? "") ?? ""
+    parent_session_id = to_string(get(parsed, ["extra", "parent_session_id"]) ?? "") ?? ""
+    parsed_url = parse_url(request_url) ?? {}
    query_params = get(parsed_url, ["query"]) ?? {}
-    .client_id = parsed.client_id ?? get(parsed, ["client", "id"]) ?? get(query_params, ["client_id"]) ?? get(query_params, ["clientId"]) ?? ""
-    .parent_session_id = parsed.parent_session_id ?? get(parsed, ["extra", "parent_session_id"]) ?? ""
-    .host = parsed.host ?? request_host ?? ""
-    .scheme = parsed.scheme ?? request_scheme ?? ""
-    .query = parsed.query ?? request_query ?? ""
-    .upstream_url = parsed.upstream_url ?? get(parsed, ["upstream", "url"]) ?? ""
-    .bytes_in = to_int(parsed.bytes_in ?? parsed.request_bytes ?? 0) ?? 0
-    .bytes_out = to_int(parsed.bytes_out ?? parsed.response_bytes ?? 0) ?? 0
+    event_path = to_string(parsed.path) ?? to_string(parsed.http_path) ?? ""
+    if event_path == "" { event_path = request_path }
+    if event_path == "" { event_path = request_url }
+    event_client_id = to_string(parsed.client_id) ?? ""
+    if event_client_id == "" { event_client_id = client_id }
+    if event_client_id == "" { event_client_id = to_string(get(query_params, ["client_id"]) ?? "") ?? "" }
+    if event_client_id == "" { event_client_id = to_string(get(query_params, ["clientId"]) ?? "") ?? "" }
+
+    . = {
+      "request_id": to_string(parsed.request_id) ?? to_string(parsed.req_id) ?? "",
+      "method": to_string(parsed.method) ?? to_string(parsed.http_method) ?? request_method,
+      "path": event_path,
+      "status": to_int(parsed.status) ?? to_int(parsed.status_code) ?? to_int(response_status) ?? 0,
+      "latency_ms": to_int(parsed.latency_ms) ?? to_int(parsed.duration_ms) ?? to_int(parsed.took) ?? 0,
+      "client_id": event_client_id,
+      "rp": to_string(parsed.rp) ?? "",
+      "action": to_string(parsed.action) ?? "",
+      "target": to_string(parsed.target) ?? "",
+      "rule_id": to_string(parsed.rule_id) ?? rule_id,
+      "host": to_string(parsed.host) ?? request_host,
+      "scheme": to_string(parsed.scheme) ?? request_scheme,
+      "query": to_string(parsed.query) ?? request_query,
+      "upstream_url": to_string(parsed.upstream_url) ?? upstream_url,
+      "subject": to_string(parsed.subject) ?? identity_id,
+      "parent_session_id": to_string(parsed.parent_session_id) ?? parent_session_id,
+      "client_ip": to_string(parsed.client_ip) ?? to_string(parsed.remote_ip) ?? to_string(parsed.ip) ?? "",
+      "user_agent": to_string(parsed.user_agent) ?? user_agent,
+      "referer": referer,
+      "decision": to_string(parsed.decision) ?? to_string(parsed.result) ?? "",
+      "bytes_in": to_int(parsed.bytes_in) ?? to_int(parsed.request_bytes) ?? 0,
+      "bytes_out": to_int(parsed.bytes_out) ?? to_int(parsed.response_bytes) ?? 0,
+      "trace_id": to_string(parsed.trace_id) ?? "",
+      "span_id": to_string(parsed.span_id) ?? "",
+      "raw": raw
+    }
  '''

 [sinks.clickhouse]
@@ -66,3 +70,6 @@
  database = "ory"
  table = "oathkeeper_access_logs"
  compression = "gzip"
+  auth.strategy = "basic"
+  auth.user = "${ORY_CLICKHOUSE_USER}"
+  auth.password = "${ORY_CLICKHOUSE_PASSWORD}"
--- a/docker/staging_pull_compose.template.yaml
+++ b/docker/staging_pull_compose.template.yaml
@@ -271,7 +271,10 @@ services:
      - -ec
      - |
        apk add --no-cache curl tar
-        curl -sLo /tmp/hydra.tar.gz https://github.com/ory/hydra/releases/download/v25.4.0/hydra_25.4.0-linux_64bit.tar.gz
+        HYDRA_CLI_VERSION="$${HYDRA_VERSION:-v26.2.0}"
+        HYDRA_CLI_VERSION="$${HYDRA_CLI_VERSION%-distroless}"
+        HYDRA_CLI_ARCHIVE_VERSION="$${HYDRA_CLI_VERSION#v}"
+        curl -fsSLo /tmp/hydra.tar.gz "https://github.com/ory/hydra/releases/download/$${HYDRA_CLI_VERSION}/hydra_$${HYDRA_CLI_ARCHIVE_VERSION}-linux_64bit.tar.gz"
        tar -xzf /tmp/hydra.tar.gz -C /usr/local/bin hydra
        rm /tmp/hydra.tar.gz