Skip to content

Commit 5989dc3

Browse files
OlegErshovaaronschweig
OlegErshov
and
aaronschweig
authored
feat: added workspaceAuthenticationConfiguration resource creation (#52)
* feat: added workspaceAuthenticationConfiguration resource creation On-behalf-of: SAP [email protected] * Update internal/subroutine/worksapce_authorization.go Co-authored-by: Aaron Schweig <[email protected]> * Update internal/subroutine/worksapce_authorization.go Co-authored-by: Aaron Schweig <[email protected]> * feat: added jwt configuration On-behalf-of: SAP [email protected] * feat: add BaseDomain to config and update related subroutines On-behalf-of: SAP [email protected] * feat: added username claim mapping On-behalf-of: SAP [email protected] * removed prefixes On-behalf-of: SAP [email protected] * feat: added tests On-behalf-of: SAP [email protected] * Update internal/subroutine/worksapce_authorization.go Co-authored-by: Aaron Schweig <[email protected]> * Update internal/subroutine/worksapce_authorization.go Co-authored-by: Aaron Schweig <[email protected]> * feat: moved group and username claims into configuration On-behalf-of: SAP [email protected] * improved test coverage On-behalf-of: SAP [email protected] * fix: used context with timeout instead of default one On-behalf-of: SAP [email protected] --------- Co-authored-by: Aaron Schweig <[email protected]> Co-authored-by: aaronschweig <[email protected]>
1 parent ca7a01d commit 5989dc3

File tree

9 files changed

+536
-30
lines changed

9 files changed

+536
-30
lines changed

‎cmd/operator.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"github.com/platform-mesh/golang-commons/sentry"
3333
"github.com/spf13/cobra"
3434

35+
kcptenancyv1alphav1 "github.com/kcp-dev/kcp/sdk/apis/tenancy/v1alpha1"
3536
corev1alpha1 "github.com/platform-mesh/security-operator/api/v1alpha1"
3637
"github.com/platform-mesh/security-operator/internal/controller"
3738
"github.com/platform-mesh/security-operator/internal/subroutine"
@@ -157,6 +158,7 @@ var operatorCmd = &cobra.Command{
157158
func init() {
158159
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
159160

161+
utilruntime.Must(kcptenancyv1alphav1.AddToScheme(scheme))
160162
utilruntime.Must(corev1alpha1.AddToScheme(scheme))
161163
utilruntime.Must(apisv1alpha1.AddToScheme(scheme))
162164
utilruntime.Must(kcpcorev1alpha1.AddToScheme(scheme))

‎go.mod‎

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,44 @@ module github.com/platform-mesh/security-operator
22

33
go 1.24.5
44

5+
replace sigs.k8s.io/controller-runtime => github.com/kcp-dev/controller-runtime v0.19.0-kcp.1
6+
57
replace (
6-
k8s.io/api => k8s.io/api v0.32.4
7-
k8s.io/apimachinery => k8s.io/apimachinery v0.32.4
8-
k8s.io/client-go => k8s.io/client-go v0.32.4
9-
sigs.k8s.io/controller-runtime => github.com/kcp-dev/controller-runtime v0.19.0-kcp.1
8+
k8s.io/api => github.com/kcp-dev/kubernetes/staging/src/k8s.io/api v0.0.0-20250903080753-82bf1892069b
9+
k8s.io/apimachinery => github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20250903080753-82bf1892069b
10+
k8s.io/apiserver => github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20250903080753-82bf1892069b
11+
k8s.io/client-go => github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go v0.0.0-20250903080753-82bf1892069b
12+
k8s.io/cloud-provider => github.com/kcp-dev/kubernetes/staging/src/k8s.io/cloud-provider v0.0.0-20250903080753-82bf1892069b
13+
k8s.io/cluster-bootstrap => github.com/kcp-dev/kubernetes/staging/src/k8s.io/cluster-bootstrap v0.0.0-20250903080753-82bf1892069b
14+
k8s.io/code-generator => github.com/kcp-dev/kubernetes/staging/src/k8s.io/code-generator v0.0.0-20250903080753-82bf1892069b
15+
k8s.io/component-base => github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base v0.0.0-20250903080753-82bf1892069b
16+
k8s.io/component-helpers => github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-helpers v0.0.0-20250903080753-82bf1892069b
17+
k8s.io/controller-manager => github.com/kcp-dev/kubernetes/staging/src/k8s.io/controller-manager v0.0.0-20250903080753-82bf1892069b
18+
k8s.io/cri-api => github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-api v0.0.0-20250903080753-82bf1892069b
19+
k8s.io/cri-client => github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-client v0.0.0-20250903080753-82bf1892069b
20+
k8s.io/csi-translation-lib => github.com/kcp-dev/kubernetes/staging/src/k8s.io/csi-translation-lib v0.0.0-20250903080753-82bf1892069b
21+
k8s.io/dynamic-resource-allocation => github.com/kcp-dev/kubernetes/staging/src/k8s.io/dynamic-resource-allocation v0.0.0-20250903080753-82bf1892069b
22+
k8s.io/endpointslice => github.com/kcp-dev/kubernetes/staging/src/k8s.io/endpointslice v0.0.0-20250903080753-82bf1892069b
23+
k8s.io/externaljwt => github.com/kcp-dev/kubernetes/staging/src/k8s.io/externaljwt v0.0.0-20250903080753-82bf1892069b
24+
k8s.io/kms => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kms v0.0.0-20250903080753-82bf1892069b
25+
k8s.io/kube-aggregator => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-aggregator v0.0.0-20250903080753-82bf1892069b
26+
k8s.io/kube-controller-manager => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-controller-manager v0.0.0-20250903080753-82bf1892069b
27+
k8s.io/kube-proxy => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-proxy v0.0.0-20250903080753-82bf1892069b
28+
k8s.io/kube-scheduler => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20250903080753-82bf1892069b
29+
k8s.io/kubectl => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20250903080753-82bf1892069b
30+
k8s.io/kubelet => github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20250903080753-82bf1892069b
31+
k8s.io/kubernetes => github.com/kcp-dev/kubernetes v0.0.0-20250903080753-82bf1892069b
32+
k8s.io/metrics => github.com/kcp-dev/kubernetes/staging/src/k8s.io/metrics v0.0.0-20250903080753-82bf1892069b
33+
k8s.io/mount-utils => github.com/kcp-dev/kubernetes/staging/src/k8s.io/mount-utils v0.0.0-20250903080753-82bf1892069b
34+
k8s.io/pod-security-admission => github.com/kcp-dev/kubernetes/staging/src/k8s.io/pod-security-admission v0.0.0-20250903080753-82bf1892069b
35+
k8s.io/sample-apiserver => github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-apiserver v0.0.0-20250903080753-82bf1892069b
36+
k8s.io/sample-cli-plugin => github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-cli-plugin v0.0.0-20250903080753-82bf1892069b
37+
k8s.io/sample-controller => github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-controller v0.0.0-20250903080753-82bf1892069b
1038
)
1139

1240
require (
1341
github.com/go-logr/logr v1.4.3
14-
github.com/kcp-dev/kcp/sdk v0.28.1
42+
github.com/kcp-dev/kcp/sdk v0.28.1-0.20250915073746-2b42b96efc54
1543
github.com/kcp-dev/logicalcluster/v3 v3.0.5
1644
github.com/openfga/api/proto v0.0.0-20250909173124-0ac19aac54f2
1745
github.com/openfga/language/pkg/go v0.2.0-beta.2.0.20250428093642-7aeebe78bbfe
@@ -60,10 +88,8 @@ require (
6088
github.com/go-openapi/swag v0.23.1 // indirect
6189
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
6290
github.com/gogo/protobuf v1.3.2 // indirect
63-
github.com/golang/protobuf v1.5.4 // indirect
6491
github.com/google/gnostic-models v0.6.9 // indirect
6592
github.com/google/go-cmp v0.7.0 // indirect
66-
github.com/google/gofuzz v1.2.0 // indirect
6793
github.com/google/uuid v1.6.0 // indirect
6894
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
6995
github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -72,7 +98,7 @@ require (
7298
github.com/inconshreveable/mousetrap v1.1.0 // indirect
7399
github.com/josharian/intern v1.0.0 // indirect
74100
github.com/json-iterator/go v1.1.12 // indirect
75-
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250512171935-ebb573a40077 // indirect
101+
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51 // indirect
76102
github.com/mailru/easyjson v0.9.0 // indirect
77103
github.com/mattn/go-colorable v0.1.14 // indirect
78104
github.com/mattn/go-isatty v0.0.20 // indirect

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -105,12 +105,22 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
105105
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
106106
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
107107
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
108-
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250512171935-ebb573a40077 h1:lDi9nZ75ypmRJwDFXUN70Cdu8+HxAjPU1kcnn+l4MvI=
109-
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250512171935-ebb573a40077/go.mod h1:jnMZxVnCuKlkIXc4J1Qtmy1Lyo171CDF/RQhNAo0tvA=
108+
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51 h1:l38RDS+VUMx9etvyaCgJIZa4nM7FaNevNubWN0kDZY4=
109+
github.com/kcp-dev/apimachinery/v2 v2.0.1-0.20250728122101-adbf20db3e51/go.mod h1:rF1jfvUfPjFXs+HV/LN1BtPzAz1bfjJOwVa+hAVfroQ=
110110
github.com/kcp-dev/controller-runtime v0.19.0-kcp.1 h1:mbCyVzWuJpg+pkzIkIKLltiOgOSiQ3bqWmHi2mftzgc=
111111
github.com/kcp-dev/controller-runtime v0.19.0-kcp.1/go.mod h1:jwK5sBnpu/xJJ+xdpSzzI0aM52E/EvF0uLF9bR61h/Y=
112-
github.com/kcp-dev/kcp/sdk v0.28.1 h1:bTtuHVjFRjbwFEqXTPxc1J1JP2Hc3mTYqQ2xfJsi16M=
113-
github.com/kcp-dev/kcp/sdk v0.28.1/go.mod h1:8oZpWxkoMu2TDpx5DgdIGDigByKHKkeqVMA4GiWneoI=
112+
github.com/kcp-dev/kcp/sdk v0.28.1-0.20250915073746-2b42b96efc54 h1:CUfnrqLukdY9a1KbZs0Lh0lzxeWOex5oZ+yEdHziNEs=
113+
github.com/kcp-dev/kcp/sdk v0.28.1-0.20250915073746-2b42b96efc54/go.mod h1:aC2BPGPvy8QtkI2gQNH9NfW6xpfGIKZkR93gy9O02BE=
114+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/api v0.0.0-20250903080753-82bf1892069b h1:SAsTR0XUNZXsqwbUL8HlDYCKOLLsQShhXGv9fdG6Yok=
115+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/api v0.0.0-20250903080753-82bf1892069b/go.mod h1:uiagPCm7MlCfQpIm2xwPTRf8727wbCZCMgHI9uHcMpg=
116+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20250903080753-82bf1892069b h1:tQ+jGfVfr308sUo47dLhl4ywPcneKjcVyNkviX0qXu0=
117+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery v0.0.0-20250903080753-82bf1892069b/go.mod h1:6XMZJoNYwuMArBvS2acFkTR1KqyHSp2QXRLRx9eTk5w=
118+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20250903080753-82bf1892069b h1:quaqtTA5UT7THp6ULBW4Nu/yG6yQgeN+GCXOx3oR3NE=
119+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20250903080753-82bf1892069b/go.mod h1:STCgTiD+xCCHsfLOPHn5sNVsyktakX/ctW3dMv3erh0=
120+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go v0.0.0-20250903080753-82bf1892069b h1:9vGAtJjNgtBI3tydH5MkEIuj4oQBWbTZdV2H3TggECM=
121+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go v0.0.0-20250903080753-82bf1892069b/go.mod h1:omt22adyHpxAelVTfG1bssg+xoAUc+Cg+0CXn0Oaim0=
122+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base v0.0.0-20250903080753-82bf1892069b h1:F2J0FI8baFBZuMLATCW+8JT2lUOWOlygf+OwL3atqws=
123+
github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base v0.0.0-20250903080753-82bf1892069b/go.mod h1:Z+AmCbP/esJzSqF5Otj149NR+8fqJHWBgokGrRp0a1c=
114124
github.com/kcp-dev/logicalcluster/v3 v3.0.5 h1:JbYakokb+5Uinz09oTXomSUJVQsqfxEvU4RyHUYxHOU=
115125
github.com/kcp-dev/logicalcluster/v3 v3.0.5/go.mod h1:EWBUBxdr49fUB1cLMO4nOdBWmYifLbP1LfoL20KkXYY=
116126
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -308,18 +318,8 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
308318
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
309319
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
310320
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
311-
k8s.io/api v0.32.4 h1:kw8Y/G8E7EpNy7gjB8gJZl3KJkNz8HM2YHrZPtAZsF4=
312-
k8s.io/api v0.32.4/go.mod h1:5MYFvLvweRhyKylM3Es/6uh/5hGp0dg82vP34KifX4g=
313321
k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
314322
k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
315-
k8s.io/apimachinery v0.32.4 h1:8EEksaxA7nd7xWJkkwLDN4SvWS5ot9g6Z/VZb3ju25I=
316-
k8s.io/apimachinery v0.32.4/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
317-
k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
318-
k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
319-
k8s.io/client-go v0.32.4 h1:zaGJS7xoYOYumoWIFXlcVrsiYioRPrXGO7dBfVC5R6M=
320-
k8s.io/client-go v0.32.4/go.mod h1:k0jftcyYnEtwlFW92xC7MTtFv5BNcZBr+zn9jPlT9Ic=
321-
k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
322-
k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
323323
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
324324
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
325325
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=

‎internal/config/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,6 @@ type Config struct {
99
CoreModulePath string `mapstructure:"core-module-path"`
1010
WorkspaceDir string `mapstructure:"workspace-dir" default:"/operator/"`
1111
BaseDomain string `mapstructure:"base-domain" default:"portal.dev.local"`
12+
GroupClaim string `mapstructure:"group-claim" default:"groups"`
13+
UserClaim string `mapstructure:"user-claim" default:"email"`
1214
}

‎internal/controller/initializer_controller.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ func NewLogicalClusterReconciler(log *logger.Logger, restCfg *rest.Config, cl, o
2626
lifecycle: lifecyclecontrollerruntime.NewLifecycleManager(
2727
[]lifecyclesubroutine.Subroutine{
2828
subroutine.NewWorkspaceInitializer(cl, orgClient, restCfg, cfg),
29+
subroutine.NewWorkspaceAuthConfigurationSubroutine(orgClient,cfg),
2930
subroutine.NewRealmSubroutine(inClusterClient, cfg.BaseDomain),
3031
},
3132
"logicalcluster",

0 commit comments

Comments
 (0)