Skip to content

Commit b7f5e38

Browse files
dipti-paidipti-pai
committed
[RFC-0010] Add multi-tenant workload identity support for ImageUpdateAutomation with Azure GitRepository
Signed-off-by: Dipti Pai <[email protected]>
1 parent 6243cf0 commit b7f5e38

File tree

6 files changed

+35
-7
lines changed

6 files changed

+35
-7
lines changed

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ require (
1919
github.com/fluxcd/image-reflector-controller/api v0.35.2
2020
github.com/fluxcd/pkg/apis/acl v0.9.0
2121
github.com/fluxcd/pkg/apis/event v0.19.0
22-
github.com/fluxcd/pkg/apis/meta v1.20.0
22+
github.com/fluxcd/pkg/apis/meta v1.21.0
2323
github.com/fluxcd/pkg/auth v0.29.0
2424
github.com/fluxcd/pkg/cache v0.11.0
2525
github.com/fluxcd/pkg/git v0.36.0
2626
github.com/fluxcd/pkg/git/gogit v0.40.0
2727
github.com/fluxcd/pkg/gittestserver v0.20.0
2828
github.com/fluxcd/pkg/runtime v0.82.0
2929
github.com/fluxcd/pkg/ssh v0.21.0
30-
github.com/fluxcd/source-controller/api v1.6.2
30+
github.com/fluxcd/source-controller/api v1.7.0-rc.1
3131
github.com/go-git/go-billy/v5 v5.6.2
3232
github.com/go-git/go-git/v5 v5.16.2
3333
github.com/go-logr/logr v1.4.3

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,8 @@ github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2T
128128
github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
129129
github.com/fluxcd/pkg/apis/event v0.19.0 h1:ZJU2voontkzp5rNYA4JMOu40S4tRcrWi4Do59EnyFwg=
130130
github.com/fluxcd/pkg/apis/event v0.19.0/go.mod h1:deuIyUb6lh+Z1Ccvwwxhm1wNM3kpSo+vF1IgRnpaZfQ=
131-
github.com/fluxcd/pkg/apis/meta v1.20.0 h1:l9h0kWoDZTcYV0WJkFMgDXq6Q4tSojrJ+bHpFJSsaW0=
132-
github.com/fluxcd/pkg/apis/meta v1.20.0/go.mod h1:XUAEUgT4gkWDAEN79E141tmL+v4SV50tVZ/Ojpc/ueg=
131+
github.com/fluxcd/pkg/apis/meta v1.21.0 h1:R+bN02chcs0HUmyVDQhqe/FHmYLjipVDMLnyYfNX850=
132+
github.com/fluxcd/pkg/apis/meta v1.21.0/go.mod h1:XUAEUgT4gkWDAEN79E141tmL+v4SV50tVZ/Ojpc/ueg=
133133
github.com/fluxcd/pkg/auth v0.29.0 h1:lLc63zjodqIqg5ydlU/Kp3Qa+wvh6G2khjop5MHALvk=
134134
github.com/fluxcd/pkg/auth v0.29.0/go.mod h1:bjZ+6RMSGgsQQK+aPfVP8HWuBbb+FLlFxMiqd8ywzik=
135135
github.com/fluxcd/pkg/cache v0.11.0 h1:fsE8S+una21fSNw4MDXGUIf0Gf1J+pqa4RbsVKf2aTI=
@@ -146,8 +146,8 @@ github.com/fluxcd/pkg/ssh v0.21.0 h1:ZmyF0n9je0cTTkOpvFVgIhmdx9qtswnVE60TK4IzJh0
146146
github.com/fluxcd/pkg/ssh v0.21.0/go.mod h1:nX+gvJOmjf0E7lxq5mKKzDIdPEL2jOUQZbkBMS+mDtk=
147147
github.com/fluxcd/pkg/version v0.10.0 h1:WETlCRbfbocsDItkCCeh/4x4zQkZ5i/lUe7P7VaQBrI=
148148
github.com/fluxcd/pkg/version v0.10.0/go.mod h1:dgmjEq4ykvBnqK1oVXM+hcXx3kAY/b4uZDYUn8XnHjk=
149-
github.com/fluxcd/source-controller/api v1.6.2 h1:UmodAeqLIeF29HdTqf2GiacZyO+hJydJlepDaYsMvhc=
150-
github.com/fluxcd/source-controller/api v1.6.2/go.mod h1:ZJcAi0nemsnBxjVgmJl0WQzNvB0rMETxQMTdoFosmMw=
149+
github.com/fluxcd/source-controller/api v1.7.0-rc.1 h1:FPTZJqLFJQHjP53m1IXN1JzuE0s6KPAU2JepFuXAlDE=
150+
github.com/fluxcd/source-controller/api v1.7.0-rc.1/go.mod h1:sbJibK4Ik+2AuTRRLXPA+n2u6nLUIGaxC07ava+RqeM=
151151
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
152152
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
153153
github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

‎internal/controller/imageupdateautomation_controller.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ import (
4343
aclapi "github.com/fluxcd/pkg/apis/acl"
4444
eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
4545
"github.com/fluxcd/pkg/apis/meta"
46+
"github.com/fluxcd/pkg/auth"
4647
"github.com/fluxcd/pkg/cache"
4748
"github.com/fluxcd/pkg/git"
4849
"github.com/fluxcd/pkg/runtime/acl"
@@ -372,6 +373,13 @@ func (r *ImageUpdateAutomationReconciler) reconcile(ctx context.Context, sp *pat
372373
result, retErr = ctrl.Result{}, nil
373374
return
374375
}
376+
if errors.Is(err, source.ErrFeatureGateNotEnabled) {
377+
const gate = auth.FeatureGateObjectLevelWorkloadIdentity
378+
const msgFmt = "to use spec.serviceAccountName for provider authentication please enable the %s feature gate in the controller"
379+
conditions.MarkStalled(obj, meta.FeatureGateDisabledReason, msgFmt, gate)
380+
result, retErr = ctrl.Result{}, nil
381+
return
382+
}
375383
e := fmt.Errorf("failed configuring source manager: %w", err)
376384
conditions.MarkFalse(obj, meta.ReadyCondition, imagev1.SourceManagerFailedReason, "%s", e)
377385
result, retErr = ctrl.Result{}, e
@@ -383,7 +391,7 @@ func (r *ImageUpdateAutomationReconciler) reconcile(ctx context.Context, sp *pat
383391
}
384392
}()
385393
// Update any stale Ready=False condition from SourceManager failure.
386-
if conditions.HasAnyReason(obj, meta.ReadyCondition, aclapi.AccessDeniedCondition, imagev1.InvalidSourceConfigReason, imagev1.SourceManagerFailedReason) {
394+
if conditions.HasAnyReason(obj, meta.ReadyCondition, aclapi.AccessDeniedCondition, imagev1.InvalidSourceConfigReason, imagev1.SourceManagerFailedReason, meta.FeatureGateDisabledReason) {
387395
conditions.MarkUnknown(obj, meta.ReadyCondition, meta.ProgressingReason, "reconciliation in progress")
388396
}
389397

‎internal/source/git.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,14 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
209209
auth.WithServiceAccountNamespace(srcOpts.objNamespace),
210210
}
211211

212+
if repo.Spec.ServiceAccountName != "" {
213+
// Check object-level workload identity feature gate.
214+
if !auth.IsObjectLevelWorkloadIdentityEnabled() {
215+
return nil, ErrFeatureGateNotEnabled
216+
}
217+
opts = append(opts, auth.WithServiceAccountName(repo.Spec.ServiceAccountName))
218+
}
219+
212220
if srcOpts.tokenCache != nil {
213221
involvedObject := cache.InvolvedObject{
214222
Kind: imagev1.ImageUpdateAutomationKind,

‎internal/source/git_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,15 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
155155
},
156156
wantErr: "ManagedIdentityCredential",
157157
},
158+
{
159+
name: "azure provider with service account and feature gate for object-level identity disabled",
160+
url: "https://dev.azure.com/foo/bar/_git/baz",
161+
beforeFunc: func(obj *sourcev1.GitRepository) {
162+
obj.Spec.Provider = sourcev1.GitProviderAzure
163+
obj.Spec.ServiceAccountName = "azure-sa"
164+
},
165+
wantErr: ErrFeatureGateNotEnabled.Error(),
166+
},
158167
{
159168
name: "github provider with no secret ref",
160169
url: "https://github.com/org/repo.git",

‎internal/source/source.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ import (
4848
// ErrInvalidSourceConfiguration is an error for invalid source configuration.
4949
var ErrInvalidSourceConfiguration = errors.New("invalid source configuration")
5050

51+
// ErrFeatureGateNotEnabled is an error for when a required feature gate is not enabled.
52+
var ErrFeatureGateNotEnabled = errors.New("required feature gate not enabled")
53+
5154
// RemovedTemplateFieldError represents an error when a removed template field is used.
5255
type RemovedTemplateFieldError struct {
5356
Field string

0 commit comments

Comments
 (0)