Skip to content

Commit 86635b3

Browse files
rwhundleyrwhundley
authored
Expose Routes externally with front door (#1031)
Originating issue: [IBMPrivateCloud/roadmap#66643](https://github.ibm.com/IBMPrivateCloud/roadmap/issues/66643) --------- Signed-off-by: Rob Hundley <[email protected]>
1 parent 9a3a7f4 commit 86635b3

16 files changed

+776
-621
lines changed

‎api/operator/v1alpha1/authentication_types.go

Lines changed: 54 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -115,43 +115,49 @@ type ClientRegistrationSpec struct {
115115
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
116116
}
117117

118+
type IngressConfig struct {
119+
Hostname *string `json:"hostname,omitempty"`
120+
Secret *string `json:"secret,omitempty"`
121+
}
122+
118123
type ConfigSpec struct {
119-
ClusterCADomain string `json:"clusterCADomain"`
120-
DefaultAdminUser string `json:"defaultAdminUser"`
121-
DefaultAdminPassword string `json:"defaultAdminPassword"`
122-
ScimAdminUser string `json:"scimAdminUser"`
123-
ScimAdminPassword string `json:"scimAdminPassword"`
124-
ClusterName string `json:"clusterName"`
125-
ClusterInternalAddress string `json:"clusterInternalAddress"`
126-
ClusterExternalAddress string `json:"clusterExternalAddress"`
127-
WLPClientID string `json:"wlpClientID"`
128-
WLPClientSecret string `json:"wlpClientSecret"`
129-
AuthUniqueHosts string `json:"authUniqueHosts"`
130-
WLPClientRegistrationSecret string `json:"wlpClientRegistrationSecret"`
131-
InstallType string `json:"installType"`
132-
IsOpenshiftEnv bool `json:"isOpenshiftEnv"`
133-
OpenshiftPort int32 `json:"openshiftPort"`
134-
ICPPort int32 `json:"icpPort"`
135-
FIPSEnabled bool `json:"fipsEnabled"`
136-
ROKSEnabled bool `json:"roksEnabled"`
137-
IBMCloudSaas bool `json:"ibmCloudSaas,omitempty"`
138-
OnPremMultipleDeploy bool `json:"onPremMultipleDeploy,omitempty"`
139-
SaasClientRedirectUrl string `json:"saasClientRedirectUrl,omitempty"`
140-
NONCEEnabled bool `json:"nonceEnabled"`
141-
XFrameDomain string `json:"xframeDomain,omitempty"`
142-
PreferredLogin string `json:"preferredLogin,omitempty"`
143-
DefaultLogin string `json:"defaultLogin,omitempty"`
144-
ROKSURL string `json:"roksURL"`
145-
ROKSUserPrefix string `json:"roksUserPrefix"`
146-
EnableImpersonation bool `json:"enableImpersonation"`
147-
BootstrapUserId string `json:"bootstrapUserId,omitempty"`
148-
ProviderIssuerURL string `json:"providerIssuerURL,omitempty"`
149-
ClaimsSupported string `json:"claimsSupported,omitempty"`
150-
ClaimsMap string `json:"claimsMap,omitempty"`
151-
ScopeClaim string `json:"scopeClaim,omitempty"`
152-
OIDCIssuerURL string `json:"oidcIssuerURL"`
153-
AttrMappingFromConfig bool `json:"attrMappingFromConfig,omitempty"`
154-
ZenFrontDoor bool `json:"zenFrontDoor,omitempty"`
124+
ClusterCADomain string `json:"clusterCADomain"`
125+
DefaultAdminUser string `json:"defaultAdminUser"`
126+
DefaultAdminPassword string `json:"defaultAdminPassword"`
127+
ScimAdminUser string `json:"scimAdminUser"`
128+
ScimAdminPassword string `json:"scimAdminPassword"`
129+
ClusterName string `json:"clusterName"`
130+
ClusterInternalAddress string `json:"clusterInternalAddress"`
131+
ClusterExternalAddress string `json:"clusterExternalAddress"`
132+
WLPClientID string `json:"wlpClientID"`
133+
WLPClientSecret string `json:"wlpClientSecret"`
134+
AuthUniqueHosts string `json:"authUniqueHosts"`
135+
WLPClientRegistrationSecret string `json:"wlpClientRegistrationSecret"`
136+
InstallType string `json:"installType"`
137+
IsOpenshiftEnv bool `json:"isOpenshiftEnv"`
138+
OpenshiftPort int32 `json:"openshiftPort"`
139+
ICPPort int32 `json:"icpPort"`
140+
FIPSEnabled bool `json:"fipsEnabled"`
141+
ROKSEnabled bool `json:"roksEnabled"`
142+
IBMCloudSaas bool `json:"ibmCloudSaas,omitempty"`
143+
OnPremMultipleDeploy bool `json:"onPremMultipleDeploy,omitempty"`
144+
SaasClientRedirectUrl string `json:"saasClientRedirectUrl,omitempty"`
145+
NONCEEnabled bool `json:"nonceEnabled"`
146+
XFrameDomain string `json:"xframeDomain,omitempty"`
147+
PreferredLogin string `json:"preferredLogin,omitempty"`
148+
DefaultLogin string `json:"defaultLogin,omitempty"`
149+
ROKSURL string `json:"roksURL"`
150+
ROKSUserPrefix string `json:"roksUserPrefix"`
151+
EnableImpersonation bool `json:"enableImpersonation"`
152+
BootstrapUserId string `json:"bootstrapUserId,omitempty"`
153+
ProviderIssuerURL string `json:"providerIssuerURL,omitempty"`
154+
ClaimsSupported string `json:"claimsSupported,omitempty"`
155+
ClaimsMap string `json:"claimsMap,omitempty"`
156+
ScopeClaim string `json:"scopeClaim,omitempty"`
157+
OIDCIssuerURL string `json:"oidcIssuerURL"`
158+
AttrMappingFromConfig bool `json:"attrMappingFromConfig,omitempty"`
159+
ZenFrontDoor bool `json:"zenFrontDoor,omitempty"`
160+
Ingress *IngressConfig `json:"ingress,omitempty"`
155161
}
156162

157163
type ManagedResourceStatus struct {
@@ -309,6 +315,18 @@ func (a *Authentication) HasNoDBSchemaVersion() bool {
309315
return !a.HasDBSchemaVersion()
310316
}
311317

318+
func (a *Authentication) HasCustomIngressHostname() bool {
319+
return a.Spec.Config.Ingress != nil && a.Spec.Config.Ingress.Hostname != nil && *a.Spec.Config.Ingress.Hostname != ""
320+
}
321+
322+
func (a *Authentication) HasCustomIngressCertificate() bool {
323+
return a.Spec.Config.Ingress != nil && a.Spec.Config.Ingress.Secret != nil && *a.Spec.Config.Ingress.Secret != ""
324+
}
325+
326+
func (a *Authentication) HasCustomIngress() bool {
327+
return a.HasCustomIngressHostname() || a.HasCustomIngressCertificate()
328+
}
329+
312330
func (a *Authentication) GetDBSchemaVersion() string {
313331
annotations := a.GetAnnotations()
314332
if version, ok := annotations[AnnotationAuthDBSchemaVersion]; ok {

‎api/operator/v1alpha1/zz_generated.deepcopy.go

Lines changed: 31 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/ibm-iam-operator.clusterserviceversion.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ metadata:
152152
categories: Security
153153
certified: "false"
154154
containerImage: icr.io/cpopen/ibm-iam-operator:4.13.0
155-
createdAt: "2025-07-01T14:35:22Z"
155+
createdAt: "2025-07-08T01:10:36Z"
156156
description: The IAM operator provides a simple Kubernetes CRD-Based API to manage the lifecycle of IAM services. With this operator, you can simply deploy and upgrade the IAM services
157157
features.operators.openshift.io/disconnected: "true"
158158
features.operators.openshift.io/fips-compliant: "true"

‎bundle/manifests/operator.ibm.com_authentications.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,14 @@ spec:
203203
icpPort:
204204
format: int32
205205
type: integer
206+
ingress:
207+
properties:
208+
hostname:
209+
type: string
210+
secret:
211+
type: string
212+
type: object
213+
x-kubernetes-preserve-unknown-fields: true
206214
installType:
207215
type: string
208216
isOpenshiftEnv:

‎config/crd/bases/operator.ibm.com_authentications.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,14 @@ spec:
244244
type: boolean
245245
attrMappingFromConfig:
246246
type: boolean
247+
ingress:
248+
properties:
249+
hostname:
250+
type: string
251+
secret:
252+
type: string
253+
type: object
254+
x-kubernetes-preserve-unknown-fields: true
247255
required:
248256
- authUniqueHosts
249257
- clusterCADomain

‎helm-cluster-scoped/templates/00_operator.ibm.com_authentications.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,14 @@ spec:
202202
icpPort:
203203
format: int32
204204
type: integer
205+
ingress:
206+
properties:
207+
hostname:
208+
type: string
209+
secret:
210+
type: string
211+
type: object
212+
x-kubernetes-preserve-unknown-fields: true
205213
installType:
206214
type: string
207215
isOpenshiftEnv:

‎internal/controller/common/secondary.go

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,3 +403,63 @@ func NewSecondaryReconcilerFn(req ctrl.Request, fn subreconciler.FnWithRequest)
403403
return fn(ctx, req)
404404
}
405405
}
406+
407+
// Subreconcilers implements Subreconciler
408+
type Subreconcilers []Subreconciler
409+
410+
var _ Subreconciler = Subreconcilers{}
411+
412+
func (s Subreconcilers) Reconcile(ctx context.Context) (result *ctrl.Result, err error) {
413+
results := []*ctrl.Result{}
414+
errs := []error{}
415+
for _, reconciler := range s {
416+
result, err = reconciler.Reconcile(ctx)
417+
results = append(results, result)
418+
errs = append(errs, err)
419+
}
420+
return ReduceSubreconcilerResultsAndErrors(results, errs)
421+
}
422+
423+
type subreconcilers struct {
424+
Subreconcilers
425+
strategy func(*subreconcilers, context.Context) (*ctrl.Result, error)
426+
}
427+
428+
func (s *subreconcilers) Reconcile(ctx context.Context) (result *ctrl.Result, err error) {
429+
return s.strategy(s, ctx)
430+
}
431+
432+
func NewStrictSubreconcilers(fns ...Subreconciler) *subreconcilers {
433+
return &subreconcilers{
434+
Subreconcilers: fns,
435+
strategy: strictReconcile,
436+
}
437+
}
438+
439+
func NewLazySubreconcilers(fns ...Subreconciler) *subreconcilers {
440+
return &subreconcilers{
441+
Subreconcilers: fns,
442+
strategy: lazyReconcile,
443+
}
444+
}
445+
446+
func strictReconcile(s *subreconcilers, ctx context.Context) (result *ctrl.Result, err error) {
447+
for _, reconciler := range s.Subreconcilers {
448+
result, err = reconciler.Reconcile(ctx)
449+
if err != nil {
450+
return
451+
}
452+
}
453+
return
454+
}
455+
456+
func lazyReconcile(s *subreconcilers, ctx context.Context) (result *ctrl.Result, err error) {
457+
results := []*ctrl.Result{}
458+
errs := []error{}
459+
for _, reconciler := range s.Subreconcilers {
460+
result, err = reconciler.Reconcile(ctx)
461+
results = append(results, result)
462+
errs = append(errs, err)
463+
}
464+
return ReduceSubreconcilerResultsAndErrors(results, errs)
465+
}

‎internal/controller/operator/authentication_controller.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ import (
5050
"sigs.k8s.io/controller-runtime/pkg/reconcile"
5151

5252
operatorv1alpha1 "github.com/IBM/ibm-iam-operator/api/operator/v1alpha1"
53-
zenv1 "github.com/IBM/ibm-iam-operator/internal/api/zen.cpd.ibm.com/v1"
5453
"github.com/opdev/subreconciler"
5554
logf "sigs.k8s.io/controller-runtime/pkg/log"
5655
)
@@ -365,6 +364,10 @@ func (r *AuthenticationReconciler) Reconcile(ctx context.Context, req ctrl.Reque
365364
return subreconciler.Evaluate(subResult, err)
366365
}
367366

367+
if subResult, err := r.syncClientHostnames(ctx, req); subreconciler.ShouldHaltOrRequeue(subResult, err) {
368+
return subreconciler.Evaluate(subResult, err)
369+
}
370+
368371
return subreconciler.Evaluate(subreconciler.DoNotRequeue())
369372
}
370373

@@ -385,9 +388,6 @@ func (r *AuthenticationReconciler) SetupWithManager(mgr ctrl.Manager) error {
385388
if ctrlcommon.ClusterHasOpenShiftConfigGroupVerison(&r.DiscoveryClient) {
386389
authCtrl.Watches(&routev1.Route{}, handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &operatorv1alpha1.Authentication{}, handler.OnlyControllerOwner()))
387390
}
388-
if ctrlcommon.ClusterHasZenExtensionGroupVersion(&r.DiscoveryClient) {
389-
authCtrl.Watches(&zenv1.ZenExtension{}, handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &operatorv1alpha1.Authentication{}, handler.OnlyControllerOwner()))
390-
}
391391
if ctrlcommon.ClusterHasOperandRequestAPIResource(&r.DiscoveryClient) {
392392
authCtrl.Watches(&operatorv1alpha1.OperandRequest{}, handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &operatorv1alpha1.Authentication{}, handler.OnlyControllerOwner()))
393393
}

0 commit comments

Comments
 (0)