feat: adding oidc features to cluster-api

Author: ts-mini

api/v1beta1/conversion.go

@@ -142,3 +142,8 @@ func Convert_v1beta1_OCIManagedClusterStatus_To_v1beta2_OCIManagedClusterStatus(
 func Convert_v1beta2_OCIManagedClusterSpec_To_v1beta1_OCIManagedClusterSpec(in *v1beta2.OCIManagedClusterSpec, out *OCIManagedClusterSpec, s conversion.Scope) error {
 	return autoConvert_v1beta2_OCIManagedClusterSpec_To_v1beta1_OCIManagedClusterSpec(in, out, s)
 }
+
+// Convert_v1beta2_ClusterOptions_To_v1beta1_ClusterOptions converts v1beta2 ClusterOptions to v1beta1 ClusterOptions
+func Convert_v1beta2_ClusterOptions_To_v1beta1_ClusterOptions(in *v1beta2.ClusterOptions, out *ClusterOptions, s conversion.Scope) error {
+	return autoConvert_v1beta2_ClusterOptions_To_v1beta1_ClusterOptions(in, out, s)
+}

api/v1beta1/ocimanagedcontrolplane_conversion.go

@@ -36,6 +36,7 @@ func (src *OCIManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
 	dst.Spec.ClusterType = restored.Spec.ClusterType
 	dst.Spec.Addons = restored.Spec.Addons
 	dst.Status.AddonStatus = restored.Status.AddonStatus
+	dst.Spec.ClusterOption.OpenIdConnectDiscovery.IsOpenIdConnectDiscoveryEnabled = restored.Spec.ClusterOption.OpenIdConnectDiscovery.IsOpenIdConnectDiscoveryEnabled
 	return nil
 }
 

api/v1beta1/zz_generated.conversion.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1beta2
 
 import (
+	"github.com/oracle/oci-go-sdk/v65/containerengine"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 )
@@ -122,8 +123,66 @@ type ClusterOptions struct {
 	// AdmissionControllerOptions defines the properties that define supported admission controllers.
 	// +optional
 	AdmissionControllerOptions *AdmissionControllerOptions `json:"admissionControllerOptions,omitempty"`
+
+	// OpenIDConnectDiscovery specifies OIDC discovery settings
+	// +optional
+	OpenIdConnectDiscovery *OpenIDConnectDiscovery `json:"openIdConnectDiscovery,omitempty"`
+
+	//OpenIDConnectTokenAuthenticationConfig
+	// +optional
+	OpenIdConnectTokenAuthenticationConfig *OpenIDConnectTokenAuthenticationConfig `json:"openIdConnectTokenAuthenticationConfig,omitempty"`
+}
+
+type OpenIDConnectDiscovery struct {
+	// IsOpenIDConnectDiscoveryEnabled defines whether or not to enable the OIDC discovery.
+	// +optional
+	IsOpenIdConnectDiscoveryEnabled *bool `json:"isOpenIdConnectDiscoveryEnabled,omitempty"`
+}
+
+type OpenIDConnectTokenAuthenticationConfig struct {
+	// A Base64 encoded public RSA or ECDSA certificates used to sign your identity provider's web certificate.
+	// +optional
+	CaCertificate *string `json:"caCertificate,omitempty"`
+
+	// A client id that all tokens must be issued for.
+	// +optional
+	ClientId *string `json:"clientId,omitempty"`
+
+	// JWT claim to use as the user's group. If the claim is present it must be an array of strings.
+	// +optional
+	GroupsClaim *string `json:"groupsClaim,omitempty"`
+
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system:groups).
+	// +optional
+	GroupsPrefix *string `json:"groupsPrefix,omitempty"`
+
+	// IsOpenIdConnectAuthEnabled defines whether or not to enable the OIDC authentication.
+	IsOpenIdConnectAuthEnabled bool `json:"isOpenIdConnectAuthEnabled"`
+
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted. This is typically the provider's discovery URL, changed to have an empty path.
+	// +optional
+	IssuerUrl *string `json:"issuerUrl,omitempty"`
+
+	// A key=value pair that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value. Repeat this flag to specify multiple claims.
+	// +optional
+	RequiredClaims []KeyValue `json:"requiredClaims,omitempty"`
+
+	// The signing algorithms accepted. Default is ["RS256"].
+	// +optional
+	SigningAlgorithms []string `json:"signingAlgorithms,omitempty"`
+
+	// JWT claim to use as the user name. By default sub, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as email or name, depending on their provider. However, claims other than email will be prefixed with the issuer URL to prevent naming clashes with other plugins.
+	// +optional
+	UsernameClaim *string `json:"usernameClaim,omitempty"`
+
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system:users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	// +optional
+	UsernamePrefix *string `json:"usernamePrefix,omitempty"`
 }
 
+// KeyValue defines the properties that define a key value pair. This is alias to containerengine.KeyValue, to support the sdk type
+type KeyValue containerengine.KeyValue
+
 // AddOnOptions defines the properties that define options for supported add-ons.
 type AddOnOptions struct {
 	// IsKubernetesDashboardEnabled defines whether or not to enable the Kubernetes Dashboard add-on.