Skip to content

Commit 03276e7

Browse files
d34dh0r53d34dh0r53
committed
Add OIDC Federation Settings
This templates the OIDC federation settings needed to configure Keystone to perform federation authentication.
1 parent 2e94eb1 commit 03276e7

File tree

8 files changed

+384
-23
lines changed

8 files changed

+384
-23
lines changed

‎api/bases/keystone.openstack.org_keystoneapis.yaml‎

Lines changed: 90 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ spec:
8484
files. Those get added to the service config dir in /etc/<service>
8585
. TODO: -> implement'
8686
type: object
87+
enableFederation:
88+
default: false
89+
description: Enablement of Federation configuration
90+
type: boolean
8791
enableSecureRBAC:
8892
default: true
8993
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
@@ -119,6 +123,76 @@ spec:
119123
description: NodeSelector to target subset of worker nodes running
120124
this service
121125
type: object
126+
oidcFederation:
127+
description: KeystoneFederationSpec to provide the configuration values
128+
for OIDC Federation
129+
properties:
130+
keystoneFederationIdentityProviderName:
131+
default: ""
132+
description: KeystoneFederationIdentityProviderName
133+
type: string
134+
oidcCacheType:
135+
default: memcache
136+
description: OIDCCacheType
137+
type: string
138+
oidcClaimDelimiter:
139+
default: ;
140+
description: OIDCClaimDelimiter
141+
type: string
142+
oidcClaimPrefix:
143+
default: OIDC-
144+
description: OIDCClaimPrefix
145+
type: string
146+
oidcClientID:
147+
default: ""
148+
description: OIDCClientID
149+
type: string
150+
oidcIntrospectionEndpoint:
151+
default: ""
152+
description: OIDCIntrospectionEndpoint
153+
type: string
154+
oidcMemCacheServers:
155+
description: OIDCMemCacheServers
156+
type: string
157+
oidcPassClaimsAs:
158+
default: both
159+
description: OIDCPassClaimsAs
160+
type: string
161+
oidcPassUserInfoAs:
162+
default: claims
163+
description: OIDCPassUserInfoAs
164+
type: string
165+
oidcProviderMetadataURL:
166+
default: ""
167+
description: OIDCProviderMetadataURL
168+
type: string
169+
oidcResponseType:
170+
default: id_token
171+
description: OIDCResponseType
172+
type: string
173+
oidcScope:
174+
default: openid email profile
175+
description: OIDCScope
176+
type: string
177+
remoteIDAttribute:
178+
default: HTTP_OIDC_ISS
179+
description: RemoteIDAttribute
180+
type: string
181+
required:
182+
- keystoneFederationIdentityProviderName
183+
- oidcCacheType
184+
- oidcClaimDelimiter
185+
- oidcClaimPrefix
186+
- oidcClientID
187+
- oidcIntrospectionEndpoint
188+
- oidcMemCacheServers
189+
- oidcPassClaimsAs
190+
- oidcPassUserInfoAs
191+
- oidcProviderMetadataURL
192+
- oidcResponseType
193+
- oidcScope
194+
- remoteIDAttribute
195+
type: object
122196
override:
123197
description: Override, provides the ability to override the generated
124198
manifest of several child resources.
@@ -296,14 +370,27 @@ spec:
296370
passwordSelectors:
297371
default:
298372
admin: AdminPassword
299-
description: PasswordSelectors - Selectors to identify the AdminUser
300-
password from the Secret
373+
keystoneOIDCClientSecret: KeystoneClientSecret
374+
keystoneOIDCCryptoPassphrase: KeystoneCryptoPassphrase
375+
description: PasswordSelectors - Selectors to identify the AdminUser,
376+
KeystoneOIDCClient, and KeystoneOIDCCryptoPassphrase passwords from
377+
the Secret
301378
properties:
302379
admin:
303380
default: AdminPassword
304381
description: Admin - Selector to get the keystone Admin password
305382
from the Secret
306383
type: string
384+
keystoneOIDCClientSecret:
385+
default: KeystoneClientSecret
386+
description: OIDCClientSecret - Selector to get the IdP client
387+
secret from the Secret
388+
type: string
389+
keystoneOIDCCryptoPassphrase:
390+
default: KeystoneCryptoPassphrase
391+
description: OIDCCryptoPassphrase - Selector to get the OIDC crypto
392+
passphrase from the Secret
393+
type: string
307394
type: object
308395
preserveJobs:
309396
default: false
@@ -426,6 +513,7 @@ spec:
426513
required:
427514
- containerImage
428515
- databaseInstance
516+
- enableFederation
429517
- memcachedInstance
430518
- rabbitMqClusterName
431519
- secret

‎api/v1beta1/keystoneapi_types.go‎

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -132,8 +132,8 @@ type KeystoneAPISpecCore struct {
132132
FernetMaxActiveKeys *int32 `json:"fernetMaxActiveKeys"`
133133

134134
// +kubebuilder:validation:Optional
135-
// +kubebuilder:default={admin: AdminPassword}
136-
// PasswordSelectors - Selectors to identify the AdminUser password from the Secret
135+
// +kubebuilder:default={admin: AdminPassword, keystoneOIDCClientSecret: KeystoneClientSecret, keystoneOIDCCryptoPassphrase: KeystoneCryptoPassphrase}
136+
// PasswordSelectors - Selectors to identify the AdminUser, KeystoneOIDCClient, and KeystoneOIDCCryptoPassphrase passwords from the Secret
137137
PasswordSelectors PasswordSelector `json:"passwordSelectors"`
138138

139139
// +kubebuilder:validation:Optional
@@ -180,6 +180,15 @@ type KeystoneAPISpecCore struct {
180180
// +operator-sdk:csv:customresourcedefinitions:type=spec
181181
// TLS - Parameters related to the TLS
182182
TLS tls.API `json:"tls,omitempty"`
183+
184+
// +kubebuilder:validation:Required
185+
// +kubebuilder:default=false
186+
// Enablement of Federation configuration
187+
EnableFederation bool `json:"enableFederation"`
188+
189+
// +kubebuilder:validation:Optional
190+
// +OIDCFederation - parameters to configure keystone for OIDC federation
191+
OIDCFederation KeystoneFederationSpec `json:"oidcFederation,omitempty"`
183192
}
184193

185194
// APIOverrideSpec to override the generated manifest of several child resources.
@@ -195,6 +204,83 @@ type PasswordSelector struct {
195204
// +kubebuilder:default="AdminPassword"
196205
// Admin - Selector to get the keystone Admin password from the Secret
197206
Admin string `json:"admin"`
207+
208+
// +kubebuilder:validation:Optional
209+
// +kubebuilder:default="KeystoneClientSecret"
210+
// OIDCClientSecret - Selector to get the IdP client secret from the Secret
211+
KeystoneOIDCClientSecret string `json:"keystoneOIDCClientSecret"`
212+
213+
// +kubebuilder:validation:Optional
214+
// +kubebuilder:default="KeystoneCryptoPassphrase"
215+
// OIDCCryptoPassphrase - Selector to get the OIDC crypto passphrase from the Secret
216+
KeystoneOIDCCryptoPassphrase string `json:"keystoneOIDCCryptoPassphrase"`
217+
}
218+
219+
// KeystoneFederationSpec to provide the configuration values for OIDC Federation
220+
type KeystoneFederationSpec struct {
221+
// +kubebuilder:validation:Required
222+
// +kubebuilder:default="OIDC-"
223+
// OIDCClaimPrefix
224+
OIDCClaimPrefix string `json:"oidcClaimPrefix"`
225+
226+
// +kubebuilder:validation:Required
227+
// +kubebuilder:default="id_token"
228+
// OIDCResponseType
229+
OIDCResponseType string `json:"oidcResponseType"`
230+
231+
// +kubebuilder:validation:Required
232+
// +kubebuilder:default="openid email profile"
233+
// OIDCScope
234+
OIDCScope string `json:"oidcScope"`
235+
236+
// +kubebuilder:validation:Required
237+
// +kubebuilder:default=""
238+
// OIDCProviderMetadataURL
239+
OIDCProviderMetadataURL string `json:"oidcProviderMetadataURL"`
240+
241+
// +kubebuilder:validation:Required
242+
// +kubebuilder:default=""
243+
// OIDCIntrospectionEndpoint
244+
OIDCIntrospectionEndpoint string `json:"oidcIntrospectionEndpoint"`
245+
246+
// +kubebuilder:validation:Required
247+
// +kubebuilder:default=""
248+
// OIDCClientID
249+
OIDCClientID string `json:"oidcClientID"`
250+
251+
// +kubebuilder:validation:Required
252+
// +kubebuilder:default=";"
253+
// OIDCClaimDelimiter
254+
OIDCClaimDelimiter string `json:"oidcClaimDelimiter"`
255+
256+
// +kubebuilder:validation:Required
257+
// +kubebuilder:default="claims"
258+
// OIDCPassUserInfoAs
259+
OIDCPassUserInfoAs string `json:"oidcPassUserInfoAs"`
260+
261+
// +kubebuilder:validation:Required
262+
// +kubebuilder:default="both"
263+
// OIDCPassClaimsAs
264+
OIDCPassClaimsAs string `json:"oidcPassClaimsAs"`
265+
266+
// +kubebuilder:validation:Required
267+
// +kubebuilder:default="memcache"
268+
// OIDCCacheType
269+
OIDCCacheType string `json:"oidcCacheType"`
270+
271+
// +kubebuilder:validaton:Required
272+
// OIDCMemCacheServers
273+
OIDCMemCacheServers string `json:"oidcMemCacheServers"`
274+
275+
// +kubebuilder:validation:Required
276+
// +kubebuilder:default="HTTP_OIDC_ISS"
277+
// RemoteIDAttribute
278+
RemoteIDAttribute string `json:"remoteIDAttribute"`
279+
280+
// +kubebuilder:validation:Required
281+
// +kubebuilder:default=""
282+
// KeystoneFederationIdentityProviderName
283+
KeystoneFederationIdentityProviderName string `json:"keystoneFederationIdentityProviderName"`
198284
}
199285

200286
// KeystoneAPIStatus defines the observed state of KeystoneAPI
@@ -220,7 +306,7 @@ type KeystoneAPIStatus struct {
220306
// TransportURLSecret - Secret containing RabbitMQ transportURL
221307
TransportURLSecret string `json:"transportURLSecret,omitempty"`
222308

223-
//ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes.
309+
// ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes.
224310
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
225311
}
226312

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 16 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)