Skip to content

Commit 22ae95b

Browse files
pantierrapantierra
committed
Added custom filter logic for stac-auth-proxy.
1 parent f658b16 commit 22ae95b

File tree

5 files changed

+139
-4
lines changed

5 files changed

+139
-4
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1010
### Added
1111

1212
- Added support for annotations on the PgSTAC bootstrap job via `pgstacBootstrap.jobAnnotations` in values.yaml [#381](https://github.com/developmentseed/eoapi-k8s/pull/381)
13+
- Added support for custom filters configuration via `customFiltersFile` in values.yaml [#388](https://github.com/developmentseed/eoapi-k8s/pull/388)
1314

1415
### Fixed
1516

‎charts/eoapi/data/stac-auth-proxy/custom_filters.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import dataclasses
2+
3+
from typing import Any
4+
5+
6+
@dataclasses.dataclass
7+
class CollectionsFilter:
8+
async def __call__(self, context: dict[str, Any]) -> str:
9+
return "1=1"
10+
11+
12+
@dataclasses.dataclass
13+
class ItemsFilter:
14+
async def __call__(self, context: dict[str, Any]) -> str:
15+
return "1=1"

‎charts/eoapi/templates/core/stac-auth-proxy-filters-configmap.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if index .Values "stac-auth-proxy" "enabled" }}
2+
{{- $stacAuthProxy := index .Values "stac-auth-proxy" }}
3+
{{- if and (hasKey $stacAuthProxy "extraVolumes") $stacAuthProxy.extraVolumes }}
4+
{{- $filterFile := $stacAuthProxy.customFiltersFile | default "data/stac-auth-proxy/custom_filters.py" }}
5+
apiVersion: v1
6+
kind: ConfigMap
7+
metadata:
8+
name: {{ .Release.Name }}-stac-auth-proxy-filters
9+
labels:
10+
{{- include "eoapi.labels" . | nindent 4 }}
11+
app.kubernetes.io/component: stac-auth-proxy
12+
data:
13+
custom_filters.py: |
14+
{{ .Files.Get $filterFile | indent 4 }}
15+
{{- end }}
16+
{{- end }}

‎charts/eoapi/tests/stac-auth-proxy-filters_test.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
suite: test stac-auth-proxy custom filters ConfigMap
2+
templates:
3+
- templates/_helpers/core.tpl
4+
- templates/core/stac-auth-proxy-filters-configmap.yaml
5+
6+
tests:
7+
- it: should create ConfigMap when stac-auth-proxy is enabled and extraVolumes is defined
8+
set:
9+
stac-auth-proxy.enabled: true
10+
stac-auth-proxy.extraVolumes:
11+
- name: filters
12+
configMap:
13+
name: test-filters
14+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
15+
asserts:
16+
- isKind:
17+
of: ConfigMap
18+
- equal:
19+
path: metadata.name
20+
value: RELEASE-NAME-stac-auth-proxy-filters
21+
- isNotEmpty:
22+
path: data
23+
24+
- it: should not create ConfigMap when stac-auth-proxy is disabled
25+
set:
26+
stac-auth-proxy.enabled: false
27+
stac-auth-proxy.extraVolumes:
28+
- name: filters
29+
configMap:
30+
name: test-filters
31+
asserts:
32+
- hasDocuments:
33+
count: 0
34+
35+
- it: should not create ConfigMap when extraVolumes is not defined
36+
set:
37+
stac-auth-proxy.enabled: true
38+
asserts:
39+
- hasDocuments:
40+
count: 0
41+
42+
- it: should have correct labels
43+
set:
44+
stac-auth-proxy.enabled: true
45+
stac-auth-proxy.extraVolumes:
46+
- name: filters
47+
configMap:
48+
name: test-filters
49+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
50+
asserts:
51+
- equal:
52+
path: metadata.labels["app.kubernetes.io/component"]
53+
value: stac-auth-proxy
54+
- exists:
55+
path: metadata.labels["app.kubernetes.io/name"]
56+
- exists:
57+
path: metadata.labels["app.kubernetes.io/instance"]
58+
- exists:
59+
path: metadata.labels["helm.sh/chart"]
60+
61+
- it: should use custom file path when customFiltersFile is specified
62+
set:
63+
stac-auth-proxy.enabled: true
64+
stac-auth-proxy.customFiltersFile: "data/eoepca_filters.py"
65+
stac-auth-proxy.extraVolumes:
66+
- name: filters
67+
configMap:
68+
name: test-filters
69+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
70+
asserts:
71+
- isKind:
72+
of: ConfigMap
73+
- equal:
74+
path: metadata.name
75+
value: RELEASE-NAME-stac-auth-proxy-filters
76+
- isNotEmpty:
77+
path: data

‎charts/eoapi/values.yaml‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -415,15 +415,41 @@ stac:
415415
# STAC Auth Proxy - authentication layer for STAC API
416416
stac-auth-proxy:
417417
enabled: false
418-
env:
419-
DEFAULT_PUBLIC: "true"
420-
# UPSTREAM_URL will be set dynamically in template to point to stac service
421-
# OIDC_DISCOVERY_URL must be configured when enabling auth
422418
ingress:
423419
enabled: false # Handled by main eoapi ingress
424420
service:
425421
port: 8080
426422
resources: {}
423+
env:
424+
# OIDC_DISCOVERY_URL must be configured when enabling auth
425+
# UPSTREAM_URL will be set dynamically in template to point to stac service
426+
#
427+
# Authentication filters settings:
428+
DEFAULT_PUBLIC: "true" # This enables standard profile for authentication filters
429+
# Alternatively with the following settings custom filters can be added
430+
# These must be mounted with extraVolumes/extraVolumeMounts (see below)
431+
# COLLECTIONS_FILTER_CLS: stac_auth_proxy.custom_filters:CollectionsFilter
432+
# ITEMS_FILTER_CLS: stac_auth_proxy.custom_filters:ItemsFilter
433+
434+
# Path to custom filters file (relative to chart root)
435+
# When extraVolumes is configured, a ConfigMap will be created from this file
436+
# customFiltersFile: "data/stac-auth-proxy/custom_filters.py"
437+
438+
# Additional volumes to mount (e.g., for custom filter files)
439+
extraVolumes: []
440+
# Example:
441+
# extraVolumes:
442+
# - name: filters
443+
# configMap:
444+
# name: stac-auth-proxy-filters
445+
# Additional volume mounts for the container
446+
extraVolumeMounts: []
447+
# Example:
448+
# extraVolumeMounts:
449+
# - name: filters
450+
# mountPath: /app/src/stac_auth_proxy/custom_filters.py
451+
# subPath: custom_filters.py
452+
# readOnly: true
427453

428454
vector:
429455
enabled: true

0 commit comments

Comments
 (0)