Skip to content

Commit 2cfc921

Browse files
everettraveneverettraven
committed
config/authentication: improve issuerURL validations
to align with the KAS validations Signed-off-by: Bryce Palmer <[email protected]>
1 parent ff3355d commit 2cfc921

File tree

21 files changed

+723
-37
lines changed

21 files changed

+723
-37
lines changed

‎config/v1/tests/authentications.config.openshift.io/ExternalOIDC.yaml

Lines changed: 470 additions & 0 deletions
Large diffs are not rendered by default.

‎config/v1/types_authentication.go

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ type AuthenticationSpec struct {
9191
// +kubebuilder:validation:MaxItems=1
9292
// +openshift:enable:FeatureGate=ExternalOIDC
9393
// +openshift:enable:FeatureGate=ExternalOIDCWithUIDAndExtraClaimMappings
94+
// +optional
9495
OIDCProviders []OIDCProvider `json:"oidcProviders,omitempty"`
9596
}
9697

@@ -253,9 +254,16 @@ type TokenIssuer struct {
253254
// The Kubernetes API server determines how authentication tokens should be handled
254255
// by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
255256
//
256-
// issuerURL must use the 'https' scheme.
257+
// Must be at least 1 character and must not exceed 512 characters in length.
258+
// Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
257259
//
258-
// +kubebuilder:validation:Pattern=`^https:\/\/[^\s]`
260+
// +kubebuilder:validation:XValidation:rule="isURL(self)",message="must be a valid URL"
261+
// +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() == 'https'",message="must use the 'https' scheme"
262+
// +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getQuery() == {}",message="must not have a query"
263+
// +kubebuilder:validation:XValidation:rule="self.find('#(.+)$') == ''",message="must not have a fragment"
264+
// +kubebuilder:validation:XValidation:rule="self.find('@') == ''",message="must not have user info"
265+
// +kubebuilder:validation:MaxLength=512
266+
// +kubebuilder:validation:MinLength=1
259267
// +required
260268
URL string `json:"issuerURL"`
261269

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -290,9 +290,22 @@ spec:
290290
The Kubernetes API server determines how authentication tokens should be handled
291291
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
292292
293-
issuerURL must use the 'https' scheme.
294-
pattern: ^https:\/\/[^\s]
293+
Must be at least 1 character and must not exceed 512 characters in length.
294+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
295+
maxLength: 512
296+
minLength: 1
295297
type: string
298+
x-kubernetes-validations:
299+
- message: must be a valid URL
300+
rule: isURL(self)
301+
- message: must use the 'https' scheme
302+
rule: isURL(self) && url(self).getScheme() == 'https'
303+
- message: must not have a query
304+
rule: isURL(self) && url(self).getQuery() == {}
305+
- message: must not have a fragment
306+
rule: self.find('#(.+)$') == ''
307+
- message: must not have user info
308+
rule: self.find('@') == ''
296309
required:
297310
- audiences
298311
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-CustomNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,22 @@ spec:
441441
The Kubernetes API server determines how authentication tokens should be handled
442442
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
443443
444-
issuerURL must use the 'https' scheme.
445-
pattern: ^https:\/\/[^\s]
444+
Must be at least 1 character and must not exceed 512 characters in length.
445+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
446+
maxLength: 512
447+
minLength: 1
446448
type: string
449+
x-kubernetes-validations:
450+
- message: must be a valid URL
451+
rule: isURL(self)
452+
- message: must use the 'https' scheme
453+
rule: isURL(self) && url(self).getScheme() == 'https'
454+
- message: must not have a query
455+
rule: isURL(self) && url(self).getQuery() == {}
456+
- message: must not have a fragment
457+
rule: self.find('#(.+)$') == ''
458+
- message: must not have user info
459+
rule: self.find('@') == ''
447460
required:
448461
- audiences
449462
- issuerURL

‎config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDC.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -291,9 +291,22 @@ spec:
291291
The Kubernetes API server determines how authentication tokens should be handled
292292
by matching the 'iss' claim in the JWT to the issuerURL of configured identity providers.
293293
294-
issuerURL must use the 'https' scheme.
295-
pattern: ^https:\/\/[^\s]
294+
Must be at least 1 character and must not exceed 512 characters in length.
295+
Must be a valid URL that uses the 'https' scheme and does not contain a query, fragment or user.
296+
maxLength: 512
297+
minLength: 1
296298
type: string
299+
x-kubernetes-validations:
300+
- message: must be a valid URL
301+
rule: isURL(self)
302+
- message: must use the 'https' scheme
303+
rule: isURL(self) && url(self).getScheme() == 'https'
304+
- message: must not have a query
305+
rule: isURL(self) && url(self).getQuery() == {}
306+
- message: must not have a fragment
307+
rule: self.find('#(.+)$') == ''
308+
- message: must not have user info
309+
rule: self.find('@') == ''
297310
required:
298311
- audiences
299312
- issuerURL

0 commit comments

Comments
 (0)