Skip to content

Commit b682b0c

Browse files
author
yzamir
committed
wip
1 parent d5d9464 commit b682b0c

File tree

7 files changed

+163
-120
lines changed

7 files changed

+163
-120
lines changed

‎api/v1beta1/gateserver_types.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ type GateServerSpec struct {
2828
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
2929
// Important: Run "make" to regenerate code after modifying this file
3030

31+
// img is the kube-gateway image to use.
32+
// Defalut value is "quay.io/yaacov/kube-gateway:latest".
33+
// +kubebuilder:validation:Optional
34+
// +kubebuilder:validation:Type="string"
35+
// +kubebuilder:validation:MaxLength=1024
36+
// +kubebuilder:default:="quay.io/kubevirt-ui/kube-gateway:latest"
37+
IMG string `json:"img,omitempty"`
38+
3139
// api-url is the k8s API url.
3240
// Defalut value is "https://kubernetes.default.svc".
3341
// +kubebuilder:validation:Optional
@@ -66,13 +74,6 @@ type GateServerSpec struct {
6674
// +kubebuilder:validation:MaxLength=1024
6775
// +kubebuilder:default:=""
6876
AdminResources string `json:"admin-resources,omitempty"`
69-
70-
// passthrough the tokens aquired from OAuth2 server directly to k8s API
71-
// +optional
72-
// +kubebuilder:validation:Optional
73-
// +kubebuilder:validation:Type="boolean"
74-
// +kubebuilder:default:=false
75-
PassThrough bool `json:"passthrough,omitempty"`
7677
}
7778

7879
// GateServerStatus defines the observed state of GateServer

‎api/v1beta1/gatetoken_types.go‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,30 +25,28 @@ import (
2525

2626
// GateTokenCache stores initial token data
2727
type GateTokenCache struct {
28-
From string `json:"from"`
29-
Until string `json:"until"`
30-
DurationSec int64 `json:"duration-sec"`
31-
NBf int64 `json:"nbf"`
32-
Exp int64 `json:"exp"`
33-
MatchMethod string `json:"matchMethod"`
34-
MatchPath string `json:"matchPath"`
35-
Alg string `json:"alg"`
28+
From string `json:"from"`
29+
Until string `json:"until"`
30+
Duration string `json:"duration"`
31+
NBf int64 `json:"nbf"`
32+
Exp int64 `json:"exp"`
33+
Verbs []string `json:"verbs"`
34+
URLs []string `json:"urls"`
3635
}
3736

3837
// GateTokenSpec defines the desired state of GateToken
3938
type GateTokenSpec struct {
4039
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
4140
// Important: Run "make" to regenerate code after modifying this file
4241

43-
// match-path is a regular expresion used to validate API request path,
44-
// API requests matching this pattern will be validated by the token.
42+
// urls is a list of urls used to validate API request path,
43+
// API requests matching one pattern will be validated by the token.
4544
// This field may not be empty.
4645
// +required
4746
// +kubebuilder:validation:Required
48-
// +kubebuilder:validation:Type="string"
49-
// +kubebuilder:validation:Pattern="^[/^][^:@]+$"
50-
// +kubebuilder:validation:MaxLength=1024
51-
MatchPath string `json:"match-path"`
47+
// +kubebuilder:validation:MaxItems=500
48+
// +kubebuilder:validation:MinItems=1
49+
URLs []string `json:"urls"`
5250

5351
// from is time of token invocation, the token will not validate before this time,
5452
// the token duration will start from this time.
@@ -58,23 +56,34 @@ type GateTokenSpec struct {
5856
// +kubebuilder:validation:Format="date-time"
5957
From string `json:"from"`
6058

61-
// duration-sec is the duration in sec the token will be validated since it's invocation.
62-
// Defalut value is 3600s (1h).
59+
// duration is the duration the token will be validated since it's invocation.
60+
// Defalut value is "1h".
6361
// +kubebuilder:validation:Optional
64-
// +kubebuilder:validation:Type="integer"
65-
// +kubebuilder:validation:Minimum=0
66-
// +kubebuilder:default:=3600
67-
DurationSec int64 `json:"duration-sec"`
62+
// +kubebuilder:validation:Type="string"
63+
// +kubebuilder:default:="1h"
64+
Duration string `json:"duration"`
6865

69-
// match-path is a comma separated list of allowed http methods,
66+
// verbs is a comma separated list of allowed http methods,
7067
// only API requests matching one of the allowed methods will be validated.
71-
// Defalut value is "GET,OPTIONS".
68+
// Defalut value is "[GET,OPTIONS]".
69+
// +kubebuilder:validation:Optional
70+
// +kubebuilder:validation:MaxItems=500
71+
// +kubebuilder:validation:MinItems=1
72+
Verbs []string `json:"verbs"`
73+
74+
// secret-name is the name of the secret holding the private key used to sign the token.
75+
// Defalut value is "kube-gateway-secret".
76+
// +kubebuilder:validation:Optional
77+
// +kubebuilder:validation:Type="string"
78+
// +kubebuilder:default:="1h"
79+
SecretName string `json:"secret-name"`
80+
81+
// secret-namspace is the namespace of the secret holding the private key used to sign the token.
82+
// Defalut value is "kube-gateway".
7283
// +kubebuilder:validation:Optional
7384
// +kubebuilder:validation:Type="string"
74-
// +kubebuilder:validation:Pattern="^(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE)+(,(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE)+)*$"
75-
// +kubebuilder:validation:MaxLength=1024
76-
// +kubebuilder:default:="GET,OPTIONS"
77-
MatchMethod string `json:"match-method"`
85+
// +kubebuilder:default:="1h"
86+
SecretNamespace string `json:"secret-namespace"`
7887
}
7988

8089
// GateTokenStatus defines the observed state of GateToken

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 22 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/ocgate.yaacov.com_gateservers.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,12 @@ spec:
6060
maxLength: 1024
6161
pattern: ^(http|https)://.*
6262
type: string
63-
passthrough:
64-
default: false
65-
description: passthrough the tokens aquired from OAuth2 server directly
66-
to k8s API
67-
type: boolean
63+
img:
64+
default: quay.io/kubevirt-ui/kube-gateway:latest
65+
description: img is the kube-gateway image to use. Defalut value is
66+
"quay.io/yaacov/kube-gateway:latest".
67+
maxLength: 1024
68+
type: string
6869
route:
6970
description: route for the gate proxy server.
7071
maxLength: 226

‎config/crd/bases/ocgate.yaacov.com_gatetokens.yaml‎

Lines changed: 44 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -36,36 +36,47 @@ spec:
3636
spec:
3737
description: GateTokenSpec defines the desired state of GateToken
3838
properties:
39-
duration-sec:
40-
default: 3600
41-
description: duration-sec is the duration in sec the token will be
42-
validated since it's invocation. Defalut value is 3600s (1h).
43-
format: int64
44-
minimum: 0
45-
type: integer
39+
duration:
40+
default: 1h
41+
description: duration is the duration the token will be validated
42+
since it's invocation. Defalut value is "1h".
43+
type: string
4644
from:
4745
description: from is time of token invocation, the token will not
4846
validate before this time, the token duration will start from this
4947
time. Defalut to token object creation time.
5048
format: date-time
5149
type: string
52-
match-method:
53-
default: GET,OPTIONS
54-
description: match-path is a comma separated list of allowed http
55-
methods, only API requests matching one of the allowed methods will
56-
be validated. Defalut value is "GET,OPTIONS".
57-
maxLength: 1024
58-
pattern: ^(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE)+(,(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE)+)*$
50+
secret-name:
51+
default: 1h
52+
description: secret-name is the name of the secret holding the private
53+
key used to sign the token. Defalut value is "kube-gateway-secret".
5954
type: string
60-
match-path:
61-
description: match-path is a regular expresion used to validate API
62-
request path, API requests matching this pattern will be validated
63-
by the token. This field may not be empty.
64-
maxLength: 1024
65-
pattern: ^[/^][^:@]+$
55+
secret-namespace:
56+
default: 1h
57+
description: secret-namspace is the namespace of the secret holding
58+
the private key used to sign the token. Defalut value is "kube-gateway".
6659
type: string
60+
urls:
61+
description: urls is a list of urls used to validate API request path,
62+
API requests matching one pattern will be validated by the token.
63+
This field may not be empty.
64+
items:
65+
type: string
66+
maxItems: 500
67+
minItems: 1
68+
type: array
69+
verbs:
70+
description: verbs is a comma separated list of allowed http methods,
71+
only API requests matching one of the allowed methods will be validated.
72+
Defalut value is "[GET,OPTIONS]".
73+
items:
74+
type: string
75+
maxItems: 500
76+
minItems: 1
77+
type: array
6778
required:
68-
- match-path
79+
- urls
6980
type: object
7081
status:
7182
description: GateTokenStatus defines the observed state of GateToken
@@ -144,34 +155,34 @@ spec:
144155
data:
145156
description: Cached data, once created, user can not change this valuse
146157
properties:
147-
alg:
158+
duration:
148159
type: string
149-
duration-sec:
150-
format: int64
151-
type: integer
152160
exp:
153161
format: int64
154162
type: integer
155163
from:
156164
type: string
157-
matchMethod:
158-
type: string
159-
matchPath:
160-
type: string
161165
nbf:
162166
format: int64
163167
type: integer
164168
until:
165169
type: string
170+
urls:
171+
items:
172+
type: string
173+
type: array
174+
verbs:
175+
items:
176+
type: string
177+
type: array
166178
required:
167-
- alg
168-
- duration-sec
179+
- duration
169180
- exp
170181
- from
171-
- matchMethod
172-
- matchPath
173182
- nbf
174183
- until
184+
- urls
185+
- verbs
175186
type: object
176187
phase:
177188
description: Token generation phase (ready|error)

‎controllers/gateserver_controller.go‎

Lines changed: 19 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ func (r *GateServerReconciler) serviceaccount(s *ocgatev1beta1.GateServer) (*cor
363363
},
364364
Secrets: []corev1.ObjectReference{
365365
{
366-
Name: fmt.Sprintf("%s-jwt-secret", s.Name),
366+
Name: fmt.Sprintf("%s-secret", s.Name),
367367
},
368368
},
369369
}
@@ -441,7 +441,7 @@ func (r *GateServerReconciler) rolebinding(s *ocgatev1beta1.GateServer) (*rbacv1
441441
}
442442

443443
func (r *GateServerReconciler) deployment(s *ocgatev1beta1.GateServer) (*appsv1.Deployment, error) {
444-
image := "quay.io/yaacov/oc-gate:latest"
444+
image := s.Spec.IMG
445445
replicas := int32(1)
446446
labels := map[string]string{
447447
"app": s.Name,
@@ -468,53 +468,43 @@ func (r *GateServerReconciler) deployment(s *ocgatev1beta1.GateServer) (*appsv1.
468468
Spec: corev1.PodSpec{
469469
Containers: []corev1.Container{{
470470
Image: image,
471-
Name: "oc-gate",
471+
Name: "kube-gateway",
472472

473473
Ports: []corev1.ContainerPort{{
474474
ContainerPort: 8080,
475-
Name: "oc-gate-https",
475+
Name: "https",
476476
}},
477477
VolumeMounts: []corev1.VolumeMount{
478478
{
479-
Name: "oc-gate-secret",
480-
MountPath: "/secrets",
481-
},
482-
{
483-
Name: "oc-gate-jwt-secret",
484-
MountPath: "/jwt-secret",
479+
Name: "serving-cert",
480+
MountPath: "/var/run/secrets/serving-cert",
485481
},
486482
},
487483
Command: []string{
488-
"./oc-gate",
489-
fmt.Sprintf("-api-server=%s", s.Spec.APIURL),
490-
"-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt",
491-
"-cert-file=/secrets/tls.crt",
492-
"-key-file=/secrets/tls.key",
493-
fmt.Sprintf("-base-address=https://%s", s.Spec.Route),
494-
"-listen=https://0.0.0.0:8080",
495-
"-jwt-token-key-file=/jwt-secret/cert.pem",
496-
"-k8s-bearer-token-file=/var/run/secrets/kubernetes.io/serviceaccount/token",
497-
fmt.Sprintf("-k8s-bearer-token-passthrough=%v", s.Spec.PassThrough),
484+
"./kube-gateway",
485+
"-api-server=https://kubernetes.default.svc",
486+
"-gateway-listen=https://0.0.0.0:8080",
487+
"-api-server-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
488+
"-api-server-bearer-token-file=/var/run/secrets/kubernetes.io/serviceaccount/token",
489+
"-gateway-key-file=/var/run/secrets/serving-cert/tls.key",
490+
"-gateway-cert-file=/var/run/secrets/serving-cert/tls.crt",
491+
fmt.Sprintf("-jwt-public-key-name=%s-secret", s.Name),
492+
fmt.Sprintf("-jwt-public-key-namespace=%s", s.Namespace),
493+
"-jwt-request-enable=true",
494+
fmt.Sprintf("-jwt-private-key-name=%s-secret", s.Name),
495+
fmt.Sprintf("-jwt-private-key-namespace=%s", s.Namespace),
498496
},
499497
}},
500498

501499
Volumes: []corev1.Volume{
502500
{
503-
Name: "oc-gate-secret",
501+
Name: "serving-cert",
504502
VolumeSource: corev1.VolumeSource{
505503
Secret: &corev1.SecretVolumeSource{
506504
SecretName: fmt.Sprintf("%s-secret", s.Name),
507505
},
508506
},
509507
},
510-
{
511-
Name: "oc-gate-jwt-secret",
512-
VolumeSource: corev1.VolumeSource{
513-
Secret: &corev1.SecretVolumeSource{
514-
SecretName: "oc-gate-jwt-secret",
515-
},
516-
},
517-
},
518508
},
519509

520510
ServiceAccountName: s.Name,

0 commit comments

Comments
 (0)