Skip to content

Commit ab5c966

Browse files
kcp-ci-botkcp-ci-bot
authored
Merge pull request #89 from aaronschweig/main
feat: allow `--oidc-ca-file` configuration
2 parents ef879dc + 97e19ba commit ab5c966

File tree

11 files changed

+183
-27
lines changed

11 files changed

+183
-27
lines changed

‎config/crd/bases/operator.kcp.io_frontproxies.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,22 @@ spec:
9090
oidc:
9191
description: 'Optional: OIDC configures OpenID Connect Authentication.'
9292
properties:
93+
caFileRef:
94+
description: |-
95+
Optionally provides a reference to a secret that contains a CA bundle for the OIDC issuer. This is useful when
96+
the OIDC issuer is not publicly trusted.
97+
properties:
98+
key:
99+
description: Key is the key in the secret that contains
100+
the CA file. Defaults to "ca.crt".
101+
type: string
102+
name:
103+
description: Name is the name of the secret that contains
104+
the CA file.
105+
type: string
106+
required:
107+
- name
108+
type: object
93109
clientID:
94110
description: ClientID is the OIDC client ID configured on
95111
the issuer side for this KCP instance.

‎config/crd/bases/operator.kcp.io_rootshards.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,22 @@ spec:
133133
oidc:
134134
description: 'Optional: OIDC configures OpenID Connect Authentication.'
135135
properties:
136+
caFileRef:
137+
description: |-
138+
Optionally provides a reference to a secret that contains a CA bundle for the OIDC issuer. This is useful when
139+
the OIDC issuer is not publicly trusted.
140+
properties:
141+
key:
142+
description: Key is the key in the secret that contains
143+
the CA file. Defaults to "ca.crt".
144+
type: string
145+
name:
146+
description: Name is the name of the secret that contains
147+
the CA file.
148+
type: string
149+
required:
150+
- name
151+
type: object
136152
clientID:
137153
description: ClientID is the OIDC client ID configured on
138154
the issuer side for this KCP instance.

‎config/crd/bases/operator.kcp.io_shards.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,22 @@ spec:
133133
oidc:
134134
description: 'Optional: OIDC configures OpenID Connect Authentication.'
135135
properties:
136+
caFileRef:
137+
description: |-
138+
Optionally provides a reference to a secret that contains a CA bundle for the OIDC issuer. This is useful when
139+
the OIDC issuer is not publicly trusted.
140+
properties:
141+
key:
142+
description: Key is the key in the secret that contains
143+
the CA file. Defaults to "ca.crt".
144+
type: string
145+
name:
146+
description: Name is the name of the secret that contains
147+
the CA file.
148+
type: string
149+
required:
150+
- name
151+
type: object
136152
clientID:
137153
description: ClientID is the OIDC client ID configured on
138154
the issuer side for this KCP instance.

‎go.mod‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,13 @@ require (
8787
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
8888
go.uber.org/multierr v1.11.0 // indirect
8989
golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
90-
golang.org/x/mod v0.20.0 // indirect
91-
golang.org/x/net v0.38.0 // indirect
90+
golang.org/x/mod v0.24.0 // indirect
91+
golang.org/x/net v0.40.0 // indirect
9292
golang.org/x/oauth2 v0.27.0 // indirect
93-
golang.org/x/sync v0.12.0 // indirect
94-
golang.org/x/sys v0.31.0 // indirect
95-
golang.org/x/term v0.30.0 // indirect
96-
golang.org/x/text v0.23.0 // indirect
93+
golang.org/x/sync v0.14.0 // indirect
94+
golang.org/x/sys v0.33.0 // indirect
95+
golang.org/x/term v0.32.0 // indirect
96+
golang.org/x/text v0.25.0 // indirect
9797
golang.org/x/time v0.6.0 // indirect
9898
golang.org/x/tools v0.24.0 // indirect
9999
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect

‎go.sum‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -185,34 +185,34 @@ golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++
185185
golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
186186
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
187187
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
188-
golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
189-
golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
188+
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
189+
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
190190
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
191191
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
192192
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
193193
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
194-
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
195-
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
194+
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
195+
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
196196
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
197197
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
198198
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
199199
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
200200
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
201-
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
202-
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
201+
golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
202+
golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
203203
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
204204
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
205205
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
206206
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
207207
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
208-
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
209-
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
210-
golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
211-
golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
208+
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
209+
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
210+
golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
211+
golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
212212
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
213213
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
214-
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
215-
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
214+
golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
215+
golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
216216
golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
217217
golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
218218
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎internal/resources/utils/authentication.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,24 @@ func applyOIDCConfiguration(deployment *appsv1.Deployment, config operatorv1alph
5656
extraArgs = append(extraArgs, fmt.Sprintf("--oidc-groups-prefix=%s", val))
5757
}
5858

59-
// TODO(mjudeikis): Add support for when OIDC is not publically trusted --oidc-ca-file=/etc/kcp/tls/oidc/<ca-secret-name>
59+
if val := config.CAFileRef; val != nil {
60+
extraArgs = append(extraArgs, fmt.Sprintf("--oidc-ca-file=/etc/kcp/tls/oidc/%s", val.Key))
61+
62+
podSpec.Volumes = append(deployment.Spec.Template.Spec.Volumes, corev1.Volume{
63+
Name: "oidc-ca-file",
64+
VolumeSource: corev1.VolumeSource{
65+
Secret: &corev1.SecretVolumeSource{
66+
SecretName: val.Name,
67+
},
68+
},
69+
})
70+
71+
podSpec.Containers[0].VolumeMounts = append(podSpec.Containers[0].VolumeMounts, corev1.VolumeMount{
72+
Name: "oidc-ca-file",
73+
MountPath: "/etc/kcp/tls/oidc",
74+
ReadOnly: true,
75+
})
76+
}
6077

6178
podSpec.Containers[0].Args = append(podSpec.Containers[0].Args, extraArgs...)
6279
deployment.Spec.Template.Spec = podSpec

‎sdk/apis/operator/v1alpha1/common.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,4 +379,16 @@ type OIDCConfiguration struct {
379379
// Optionally sets a custom username prefix. This defaults to "oidc:" if unset, which means a user called "[email protected]"
380380
// on the OIDC side will be recognised as "oidc:[email protected]" in KCP.
381381
UsernamePrefix string `json:"usernamePrefix,omitempty"`
382+
383+
// Optionally provides a reference to a secret that contains a CA bundle for the OIDC issuer. This is useful when
384+
// the OIDC issuer is not publicly trusted.
385+
CAFileRef *OIDCCAFileRef `json:"caFileRef,omitempty"`
386+
}
387+
388+
type OIDCCAFileRef struct {
389+
// Name is the name of the secret that contains the CA file.
390+
Name string `json:"name"`
391+
// Key is the key in the secret that contains the CA file. Defaults to "ca.crt".
392+
// +optional
393+
Key string `json:"key,omitempty"`
382394
}

‎sdk/apis/operator/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 21 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/applyconfiguration/operator/v1alpha1/oidccafileref.go‎

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/applyconfiguration/operator/v1alpha1/oidcconfiguration.go‎

Lines changed: 16 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)