Skip to content

Commit 5d5c467

Browse files
irbyirby
authored
Merge bfb9c27 into fe79ea2 
2 parents fe79ea2 + bfb9c27 commit 5d5c467

File tree

11 files changed

+177
-27
lines changed

11 files changed

+177
-27
lines changed

‎api/v1alpha1/issuer_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,14 @@ type IssuerSpec struct {
8181
// effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8282
// +optional
8383
Scopes string `json:"scopes,omitempty"`
84+
85+
// The audience value used when requesting a Bearer token from an ambient token provider implied
86+
// by the environment, rather than by commandSecretName. For example, could be set to
87+
// https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
88+
// the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
89+
// the audience for this method in an Opaque secret.
90+
// +optional
91+
Audience string `json:"audience,omitempty"`
8492
}
8593

8694
func (i *Issuer) GetStatus() *IssuerStatus {

‎config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@ spec:
8585
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8686
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8787
type: string
88+
audience:
89+
description: |-
90+
The audience value used when requesting a Bearer token from an ambient token provider implied
91+
by the environment, rather than by commandSecretName. For example, could be set to
92+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
93+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
94+
the audience for this method in an Opaque secret.
95+
type: string
8896
type: object
8997
status:
9098
description: IssuerStatus defines the observed state of Issuer

‎config/crd/bases/command-issuer.keyfactor.com_issuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@ spec:
8585
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8686
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8787
type: string
88+
audience:
89+
description: |-
90+
The audience value used when requesting a Bearer token from an ambient token provider implied
91+
by the environment, rather than by commandSecretName. For example, could be set to
92+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
93+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
94+
the audience for this method in an Opaque secret.
95+
type: string
8896
type: object
8997
status:
9098
description: IssuerStatus defines the observed state of Issuer

‎deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,14 @@ spec:
8787
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8888
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8989
type: string
90+
audience:
91+
description: |-
92+
The audience value used when requesting a Bearer token from an ambient token provider implied
93+
by the environment, rather than by commandSecretName. For example, could be set to
94+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
95+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
96+
the audience for this method in an Opaque secret.
97+
type: string
9098
type: object
9199
status:
92100
description: IssuerStatus defines the observed state of Issuer

‎deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,14 @@ spec:
8787
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8888
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8989
type: string
90+
audience:
91+
description: |-
92+
The audience value used when requesting a Bearer token from an ambient token provider implied
93+
by the environment, rather than by commandSecretName. For example, could be set to
94+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
95+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
96+
the audience for this method in an Opaque secret.
97+
type: string
9098
type: object
9199
status:
92100
description: IssuerStatus defines the observed state of Issuer

‎docsource/content.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
256256
| certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` |
257257
| certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. |
258258
| certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. |
259+
| scopes | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. |
260+
| audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. |
259261
260262
> If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration.
261263
@@ -281,6 +283,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
281283
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
282284
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
283285
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
286+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
287+
# audience: "https://your-command-url.com" # Uncomment if desired
284288
EOF
285289
286290
kubectl -n default apply -f issuer.yaml
@@ -305,6 +309,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
305309
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
306310
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
307311
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
312+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
313+
# audience: "https://your-command-url.com" # Uncomment if desired
308314
EOF
309315
310316
kubectl apply -f clusterissuer.yaml

‎go.mod‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ require (
88
github.com/cert-manager/cert-manager v1.16.2
99
github.com/go-logr/logr v1.4.2
1010
github.com/stretchr/testify v1.10.0
11-
golang.org/x/oauth2 v0.24.0
11+
golang.org/x/oauth2 v0.26.0
1212
k8s.io/api v0.31.1
1313
k8s.io/apimachinery v0.31.1
1414
k8s.io/client-go v0.31.1
@@ -17,7 +17,24 @@ require (
1717
)
1818

1919
require (
20-
cloud.google.com/go/compute/metadata v0.5.1 // indirect
20+
cloud.google.com/go/auth v0.15.0 // indirect
21+
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
22+
github.com/felixge/httpsnoop v1.0.4 // indirect
23+
github.com/go-logr/stdr v1.2.2 // indirect
24+
github.com/google/s2a-go v0.1.9 // indirect
25+
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
26+
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
27+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
28+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
29+
go.opentelemetry.io/otel v1.34.0 // indirect
30+
go.opentelemetry.io/otel/metric v1.34.0 // indirect
31+
go.opentelemetry.io/otel/trace v1.34.0 // indirect
32+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
33+
google.golang.org/grpc v1.70.0 // indirect
34+
)
35+
36+
require (
37+
cloud.google.com/go/compute/metadata v0.6.0 // indirect
2138
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 // indirect
2239
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 // indirect
2340
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
@@ -45,7 +62,7 @@ require (
4562
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4663
github.com/golang/protobuf v1.5.4 // indirect
4764
github.com/google/gnostic-models v0.6.8 // indirect
48-
github.com/google/go-cmp v0.6.0 // indirect
65+
github.com/google/go-cmp v0.7.0 // indirect
4966
github.com/google/gofuzz v1.2.0 // indirect
5067
github.com/google/uuid v1.6.0 // indirect
5168
github.com/hashicorp/go-hclog v1.5.0 // indirect
@@ -76,15 +93,16 @@ require (
7693
go.mozilla.org/pkcs7 v0.9.0 // indirect
7794
go.uber.org/multierr v1.11.0 // indirect
7895
go.uber.org/zap v1.27.0 // indirect
79-
golang.org/x/crypto v0.30.0 // indirect
96+
golang.org/x/crypto v0.33.0 // indirect
8097
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
81-
golang.org/x/net v0.32.0 // indirect
82-
golang.org/x/sys v0.28.0 // indirect
83-
golang.org/x/term v0.27.0 // indirect
84-
golang.org/x/text v0.21.0 // indirect
85-
golang.org/x/time v0.6.0 // indirect
98+
golang.org/x/net v0.35.0 // indirect
99+
golang.org/x/sys v0.30.0 // indirect
100+
golang.org/x/term v0.29.0 // indirect
101+
golang.org/x/text v0.22.0 // indirect
102+
golang.org/x/time v0.10.0 // indirect
86103
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
87-
google.golang.org/protobuf v1.34.2 // indirect
104+
google.golang.org/api v0.223.0
105+
google.golang.org/protobuf v1.36.5 // indirect
88106
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
89107
gopkg.in/inf.v0 v0.9.1 // indirect
90108
gopkg.in/yaml.v2 v2.4.0 // indirect

0 commit comments

Comments
 (0)