Skip to content

Commit 8d85071

Browse files
kellyyankellyyan
committed
Add authenticationConfiguration to IngressClassParams
1 parent d0df42b commit 8d85071

15 files changed

+1142
-69
lines changed

Diff for: ‎apis/elbv2/v1beta1/ingressclassparams_types.go

+102-2
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,108 @@ type IPAMConfiguration struct {
114114
IPv4IPAMPoolId *string `json:"ipv4IPAMPoolId,omitempty"`
115115
}
116116

117+
type AuthType string
118+
119+
const (
120+
AuthTypeNone AuthType = "none"
121+
AuthTypeCognito AuthType = "cognito"
122+
AuthTypeOIDC AuthType = "oidc"
123+
)
124+
125+
// Amazon Cognito user pools configuration
126+
type AuthIDPConfigCognito struct {
127+
// The Amazon Resource Name (ARN) of the Amazon Cognito user pool.
128+
UserPoolARN string `json:"userPoolARN"`
129+
130+
// The ID of the Amazon Cognito user pool client.
131+
UserPoolClientID string `json:"userPoolClientID"`
132+
133+
// The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
134+
// If you are using Amazon Cognito Domain, the userPoolDomain should be set to the domain prefix (my-domain) instead of full domain (https://my-domain.auth.us-west-2.amazoncognito.com).
135+
UserPoolDomain string `json:"userPoolDomain"`
136+
137+
// The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
138+
// +kubebuilder:validation:MinProperties=1
139+
// +kubebuilder:validation:MaxProperties=10
140+
// +optional
141+
AuthenticationRequestExtraParams map[string]string `json:"authenticationRequestExtraParams,omitempty"`
142+
}
143+
144+
// OpenID Connect (OIDC) identity provider (IdP) configuration
145+
type AuthIDPConfigOIDC struct {
146+
// The OIDC issuer identifier of the IdP.
147+
Issuer string `json:"issuer"`
148+
149+
// The authorization endpoint of the IdP.
150+
AuthorizationEndpoint string `json:"authorizationEndpoint"`
151+
152+
// The token endpoint of the IdP.
153+
TokenEndpoint string `json:"tokenEndpoint"`
154+
155+
// The user info endpoint of the IdP.
156+
UserInfoEndpoint string `json:"userInfoEndpoint"`
157+
158+
// The k8s secret name. The secret must be in the 'default' namespace.
159+
// Example format:
160+
// apiVersion: v1
161+
// kind: Secret
162+
// metadata:
163+
// namespace: default
164+
// name: my-k8s-secret
165+
// data:
166+
// clientID: base64 of your plain text clientId
167+
// clientSecret: base64 of your plain text clientSecret
168+
SecretName string `json:"secretName"`
169+
170+
// The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
171+
// +kubebuilder:validation:MinProperties=1
172+
// +kubebuilder:validation:MaxProperties=10
173+
// +optional
174+
AuthenticationRequestExtraParams map[string]string `json:"authenticationRequestExtraParams,omitempty"`
175+
}
176+
177+
// Authentication configuration for Ingress
178+
type AuthConfig struct {
179+
// The authentication type on targets.
180+
// +kubebuilder:validation:Enum=none;oidc;cognito
181+
Type AuthType `json:"type"`
182+
183+
// The Cognito IdP configuration.
184+
// +optional
185+
IDPConfigCognito *AuthIDPConfigCognito `json:"idpCognitoConfiguration,omitempty"`
186+
187+
// The OIDC IdP configuration.
188+
// +optional
189+
IDPConfigOIDC *AuthIDPConfigOIDC `json:"idpOidcConfiguration,omitempty"`
190+
191+
// The behavior if the user is not authenticated.
192+
// +kubebuilder:validation:Enum=authenticate;deny;allow
193+
// +optional
194+
OnUnauthenticatedRequest string `json:"onUnauthenticatedRequest,omitempty"`
195+
196+
// The set of user claims to be requested from the Cognito IdP or OIDC IdP, in a space-separated list.
197+
// * Options: phone, email, profile, openid, aws.cognito.signin.user.admin
198+
// * Ex. 'email openid'
199+
// +optional
200+
Scope string `json:"scope,omitempty"`
201+
202+
// The name of the cookie used to maintain session information.
203+
// +optional
204+
SessionCookieName string `json:"sessionCookie,omitempty"`
205+
206+
// The maximum duration of the authentication session, in seconds.
207+
// +optional
208+
SessionTimeout *int64 `json:"sessionTimeout,omitempty"`
209+
}
210+
117211
// IngressClassParamsSpec defines the desired state of IngressClassParams
118212
type IngressClassParamsSpec struct {
119213
// CertificateArn specifies the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
120214
// +optional
121215
CertificateArn []string `json:"certificateArn,omitempty"`
122216

123217
// NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams.
124-
// * if absent or present but empty, it selects all namespaces.
218+
// * If absent or present but empty, it selects all namespaces.
125219
// +optional
126220
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
127221

@@ -145,11 +239,12 @@ type IngressClassParamsSpec struct {
145239
// +optional
146240
Subnets *SubnetSelector `json:"subnets,omitempty"`
147241

148-
// IPAddressType defines the ip address type for all Ingresses that belong to IngressClass with this IngressClassParams.
242+
// IPAddressType defines the IP address type for all Ingresses that belong to IngressClass with this IngressClassParams.
149243
// +optional
150244
IPAddressType *IPAddressType `json:"ipAddressType,omitempty"`
151245

152246
// Tags defines list of Tags on AWS resources provisioned for Ingresses that belong to IngressClass with this IngressClassParams.
247+
// +optional
153248
Tags []Tag `json:"tags,omitempty"`
154249

155250
// LoadBalancerAttributes define the custom attributes to LoadBalancers for all Ingress that that belong to IngressClass with this IngressClassParams.
@@ -169,7 +264,12 @@ type IngressClassParamsSpec struct {
169264
IPAMConfiguration *IPAMConfiguration `json:"ipamConfiguration,omitempty"`
170265

171266
// PrefixListsIDs defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
267+
// +optional
172268
PrefixListsIDs []string `json:"PrefixListsIDs,omitempty"`
269+
270+
// AuthenticationConfiguration defines the authentication configuration for a Load Balancer. Application Load Balancer (ALB) supports authentication with Cognito or OIDC.
271+
// +optional
272+
AuthConfig *AuthConfig `json:"authenticationConfiguration,omitempty"`
173273
}
174274

175275
// +kubebuilder:object:root=true

Diff for: ‎apis/elbv2/v1beta1/zz_generated.deepcopy.go

+79
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

+109-2
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,113 @@ spec:
6161
items:
6262
type: string
6363
type: array
64+
authenticationConfiguration:
65+
description: AuthenticationConfiguration defines the authentication
66+
configuration for a Load Balancer. Application Load Balancer (ALB)
67+
supports authentication with Cognito or OIDC.
68+
properties:
69+
idpCognitoConfiguration:
70+
description: The Cognito IdP configuration.
71+
properties:
72+
authenticationRequestExtraParams:
73+
additionalProperties:
74+
type: string
75+
description: The query parameters (up to 10) to include in
76+
the redirect request to the authorization endpoint.
77+
maxProperties: 10
78+
minProperties: 1
79+
type: object
80+
userPoolARN:
81+
description: The Amazon Resource Name (ARN) of the Amazon
82+
Cognito user pool.
83+
type: string
84+
userPoolClientID:
85+
description: The ID of the Amazon Cognito user pool client.
86+
type: string
87+
userPoolDomain:
88+
description: |-
89+
The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
90+
If you are using Amazon Cognito Domain, the userPoolDomain should be set to the domain prefix (my-domain) instead of full domain (https://my-domain.auth.us-west-2.amazoncognito.com).
91+
type: string
92+
required:
93+
- userPoolARN
94+
- userPoolClientID
95+
- userPoolDomain
96+
type: object
97+
idpOidcConfiguration:
98+
description: The OIDC IdP configuration.
99+
properties:
100+
authenticationRequestExtraParams:
101+
additionalProperties:
102+
type: string
103+
description: The query parameters (up to 10) to include in
104+
the redirect request to the authorization endpoint.
105+
maxProperties: 10
106+
minProperties: 1
107+
type: object
108+
authorizationEndpoint:
109+
description: The authorization endpoint of the IdP.
110+
type: string
111+
issuer:
112+
description: The OIDC issuer identifier of the IdP.
113+
type: string
114+
secretName:
115+
description: |-
116+
The k8s secret name. The secret must be in the 'default' namespace.
117+
Example format:
118+
apiVersion: v1
119+
kind: Secret
120+
metadata:
121+
namespace: default
122+
name: my-k8s-secret
123+
data:
124+
clientID: base64 of your plain text clientId
125+
clientSecret: base64 of your plain text clientSecret
126+
type: string
127+
tokenEndpoint:
128+
description: The token endpoint of the IdP.
129+
type: string
130+
userInfoEndpoint:
131+
description: The user info endpoint of the IdP.
132+
type: string
133+
required:
134+
- authorizationEndpoint
135+
- issuer
136+
- secretName
137+
- tokenEndpoint
138+
- userInfoEndpoint
139+
type: object
140+
onUnauthenticatedRequest:
141+
description: The behavior if the user is not authenticated.
142+
enum:
143+
- authenticate
144+
- deny
145+
- allow
146+
type: string
147+
scope:
148+
description: |-
149+
The set of user claims to be requested from the Cognito IdP or OIDC IdP, in a space-separated list.
150+
* Options: phone, email, profile, openid, aws.cognito.signin.user.admin
151+
* Ex. 'email openid'
152+
type: string
153+
sessionCookie:
154+
description: The name of the cookie used to maintain session information.
155+
type: string
156+
sessionTimeout:
157+
description: The maximum duration of the authentication session,
158+
in seconds.
159+
format: int64
160+
type: integer
161+
type:
162+
description: The authentication type on targets.
163+
enum:
164+
- none
165+
- oidc
166+
- cognito
167+
type: string
168+
required:
169+
- type
170+
type: object
64171
certificateArn:
65172
description: CertificateArn specifies the ARN of the certificates
66173
for all Ingresses that belong to IngressClass with this IngressClassParams.
@@ -84,7 +191,7 @@ spec:
84191
type: string
85192
type: array
86193
ipAddressType:
87-
description: IPAddressType defines the ip address type for all Ingresses
194+
description: IPAddressType defines the IP address type for all Ingresses
88195
that belong to IngressClass with this IngressClassParams.
89196
enum:
90197
- ipv4
@@ -163,7 +270,7 @@ spec:
163270
namespaceSelector:
164271
description: |-
165272
NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams.
166-
* if absent or present but empty, it selects all namespaces.
273+
* If absent or present but empty, it selects all namespaces.
167274
properties:
168275
matchExpressions:
169276
description: matchExpressions is a list of label selector requirements.

0 commit comments

Comments
 (0)