Skip to content

Commit ff3355d

Browse files
everettraveneverettraven
committed
config/authentication: oidc: tighten validation on CEL expression fields
as we discovered in openshift/kubernetes#2353 (comment) that the current constraints are to loose and result in excessive expression compile times when used up to the limitations. Signed-off-by: Bryce Palmer <[email protected]>
1 parent ba53b2a commit ff3355d

17 files changed

+93
-93
lines changed

‎config/v1/types_authentication.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -320,10 +320,10 @@ type TokenClaimMappings struct {
320320
// used to construct the extra attribute for the cluster identity.
321321
// When omitted, no extra attributes will be present on the cluster identity.
322322
// key values for extra mappings must be unique.
323-
// A maximum of 64 extra attribute mappings may be provided.
323+
// A maximum of 32 extra attribute mappings may be provided.
324324
//
325325
// +optional
326-
// +kubebuilder:validation:MaxItems=64
326+
// +kubebuilder:validation:MaxItems=32
327327
// +listType=map
328328
// +listMapKey=key
329329
// +openshift:enable:FeatureGate=ExternalOIDCWithUIDAndExtraClaimMappings
@@ -375,10 +375,10 @@ type TokenClaimOrExpressionMapping struct {
375375
// Precisely one of claim or expression must be set.
376376
// expression must not be specified when claim is set.
377377
// When specified, expression must be at least 1 character in length
378-
// and must not exceed 4096 characters in length.
378+
// and must not exceed 1024 characters in length.
379379
//
380380
// +optional
381-
// +kubebuilder:validation:MaxLength=4096
381+
// +kubebuilder:validation:MaxLength=1024
382382
// +kubebuilder:validation:MinLength=1
383383
Expression string `json:"expression,omitempty"`
384384
}
@@ -437,12 +437,12 @@ type ExtraMapping struct {
437437
// For example, the 'sub' claim value can be accessed as 'claims.sub'.
438438
// Nested claims can be accessed using dot notation ('claims.foo.bar').
439439
//
440-
// valueExpression must not exceed 4096 characters in length.
440+
// valueExpression must not exceed 1024 characters in length.
441441
// valueExpression must not be empty.
442442
//
443443
// +required
444444
// +kubebuilder:validation:MinLength=1
445-
// +kubebuilder:validation:MaxLength=4096
445+
// +kubebuilder:validation:MaxLength=1024
446446
ValueExpression string `json:"valueExpression"`
447447
}
448448

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-CustomNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ spec:
8989
used to construct the extra attribute for the cluster identity.
9090
When omitted, no extra attributes will be present on the cluster identity.
9191
key values for extra mappings must be unique.
92-
A maximum of 64 extra attribute mappings may be provided.
92+
A maximum of 32 extra attribute mappings may be provided.
9393
items:
9494
description: |-
9595
ExtraMapping allows specifying a key and CEL expression
@@ -170,16 +170,16 @@ spec:
170170
For example, the 'sub' claim value can be accessed as 'claims.sub'.
171171
Nested claims can be accessed using dot notation ('claims.foo.bar').
172172
173-
valueExpression must not exceed 4096 characters in length.
173+
valueExpression must not exceed 1024 characters in length.
174174
valueExpression must not be empty.
175-
maxLength: 4096
175+
maxLength: 1024
176176
minLength: 1
177177
type: string
178178
required:
179179
- key
180180
- valueExpression
181181
type: object
182-
maxItems: 64
182+
maxItems: 32
183183
type: array
184184
x-kubernetes-list-map-keys:
185185
- key
@@ -255,8 +255,8 @@ spec:
255255
Precisely one of claim or expression must be set.
256256
expression must not be specified when claim is set.
257257
When specified, expression must be at least 1 character in length
258-
and must not exceed 4096 characters in length.
259-
maxLength: 4096
258+
and must not exceed 1024 characters in length.
259+
maxLength: 1024
260260
minLength: 1
261261
type: string
262262
type: object

‎config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ spec:
9090
used to construct the extra attribute for the cluster identity.
9191
When omitted, no extra attributes will be present on the cluster identity.
9292
key values for extra mappings must be unique.
93-
A maximum of 64 extra attribute mappings may be provided.
93+
A maximum of 32 extra attribute mappings may be provided.
9494
items:
9595
description: |-
9696
ExtraMapping allows specifying a key and CEL expression
@@ -171,16 +171,16 @@ spec:
171171
For example, the 'sub' claim value can be accessed as 'claims.sub'.
172172
Nested claims can be accessed using dot notation ('claims.foo.bar').
173173
174-
valueExpression must not exceed 4096 characters in length.
174+
valueExpression must not exceed 1024 characters in length.
175175
valueExpression must not be empty.
176-
maxLength: 4096
176+
maxLength: 1024
177177
minLength: 1
178178
type: string
179179
required:
180180
- key
181181
- valueExpression
182182
type: object
183-
maxItems: 64
183+
maxItems: 32
184184
type: array
185185
x-kubernetes-list-map-keys:
186186
- key
@@ -256,8 +256,8 @@ spec:
256256
Precisely one of claim or expression must be set.
257257
expression must not be specified when claim is set.
258258
When specified, expression must be at least 1 character in length
259-
and must not exceed 4096 characters in length.
260-
maxLength: 4096
259+
and must not exceed 1024 characters in length.
260+
maxLength: 1024
261261
minLength: 1
262262
type: string
263263
type: object

0 commit comments

Comments
 (0)