Skip to content

Commit 58d4cb0

Browse files
Merge pull request #258 from camptocamp/cert-auth
Add CRDs for TLS certificate auth method
2 parents b8b747e + 2db0dcc commit 58d4cb0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+2220
-76
lines changed

Makefile

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ HELM_VERSION ?= v3.11.0
55
KIND_VERSION ?= v0.20.0
66
KUBECTL_VERSION ?= v1.27.3
77
K8S_MAJOR_VERSION ?= 1.27
8-
KUSTOMIZE_VERSION ?= v3.8.7
8+
KUSTOMIZE_VERSION ?= v3.10.0
99
CONTROLLER_TOOLS_VERSION ?= v0.11.1
1010
# Note changes to the vault version should also match image tags within the integration/vault-values.yaml and config/local-development/vault-values.yaml files
1111
VAULT_VERSION ?= 1.14.0
@@ -141,7 +141,7 @@ deploy-ingress: kubectl helm
141141

142142
.PHONY: deploy-vault
143143
deploy-vault: kubectl helm
144-
$(KUBECTL) create namespace vault --dry-run=client -o yaml | $(KUBECTL) apply -f -
144+
$(KUBECTL) create namespace vault --dry-run=client -o yaml | $(KUBECTL) apply -f -
145145
$(KUBECTL) apply -f ./integration/rolebinding-admin.yaml -n vault
146146
$(HELM) repo add hashicorp https://helm.releases.hashicorp.com
147147
$(HELM) show chart hashicorp/vault --version $(VAULT_CHART_VERSION)
@@ -153,16 +153,16 @@ kind-setup: kind
153153
$(KIND) delete cluster
154154
$(KIND) create cluster --image docker.io/kindest/node:$(KUBECTL_VERSION) --config=./integration/cluster-kind.yaml
155155

156-
.PHONY: ldap-setup
156+
.PHONY: ldap-setup
157157
ldap-setup: kind-setup vault
158158
## Deploy LDAP Instance in ldap namespace
159-
$(KUBECTL) create namespace ldap
159+
$(KUBECTL) create namespace ldap
160160
$(KUBECTL) apply -f ./integration/ldap -n ldap
161161
$(KUBECTL) wait --for=condition=ready -n ldap pod $$($(KUBECTL) get pods -n ldap -l=app=ldap -o json | jq '.items[].metadata.name') --timeout=5m
162162
$(KUBECTL) port-forward -n vault vault-0 8201:8200
163163
$(KUBECTL) port-forward $$($(KUBECTL) get pods -n ldap -l=app=ldap -o json | jq '.items[].metadata.name') 8555:389 -n ldap
164164
export VAULT_ADDR=http://localhost:8201
165-
export VAULT_SKIP_VERIFY=true
165+
export VAULT_SKIP_VERIFY=true
166166
$(KUBECTL) apply -f ./test/ldapauthengine/ldap-auth-engine-mount.yaml
167167
$(KUBECTL) apply -f ./test/ldapauthengine/ldap-auth-engine-config.yaml
168168
## Create new Group in LDAP
@@ -308,7 +308,7 @@ helmchart: helmchart-clean kustomize helm
308308
sed -i '1s/^/{{- if .Values.enableMonitoring }}\n/' ./charts/${OPERATOR_NAME}/templates/monitoring.coreos.com_v1_servicemonitor_${OPERATOR_NAME}-controller-manager-metrics-monitor.yaml
309309
echo {{- end }} >> ./charts/${OPERATOR_NAME}/templates/monitoring.coreos.com_v1_servicemonitor_${OPERATOR_NAME}-controller-manager-metrics-monitor.yaml
310310
sed -i 's/name: vault-config-operator-certs/{{- if .Values.enableCertManager }}\n name: vault-config-operator-metrics-service-cert\n {{- else }}\n name: vault-config-operator-certs\n {{- end }}/' ./charts/${OPERATOR_NAME}/templates/monitoring.coreos.com_v1_servicemonitor_${OPERATOR_NAME}-controller-manager-metrics-monitor.yaml
311-
$(HELM) lint ./charts/${OPERATOR_NAME}
311+
$(HELM) lint ./charts/${OPERATOR_NAME}
312312

313313
.PHONY: helmchart-repo
314314
helmchart-repo: helmchart
@@ -317,7 +317,7 @@ helmchart-repo: helmchart
317317
$(HELM) repo index --url ${CHART_REPO_URL} ${HELM_REPO_DEST}
318318

319319
.PHONY: helmchart-repo-push
320-
helmchart-repo-push: helmchart-repo
320+
helmchart-repo-push: helmchart-repo
321321
git -C ${HELM_REPO_DEST} add .
322322
git -C ${HELM_REPO_DEST} status
323323
git -C ${HELM_REPO_DEST} commit -m "Release ${VERSION}"

PROJECT

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,7 +424,7 @@ resources:
424424
webhooks:
425425
defaulting: true
426426
validation: true
427-
webhookVersion: v1
427+
webhookVersion: v1
428428
- api:
429429
crdVersion: v1
430430
namespaced: true
@@ -438,4 +438,30 @@ resources:
438438
defaulting: true
439439
validation: true
440440
webhookVersion: v1
441+
- api:
442+
crdVersion: v1
443+
namespaced: true
444+
controller: true
445+
domain: redhat.io
446+
group: redhatcop
447+
kind: CertAuthEngineConfig
448+
path: github.com/redhat-cop/vault-config-operator/api/v1alpha1
449+
version: v1alpha1
450+
webhooks:
451+
defaulting: true
452+
validation: true
453+
webhookVersion: v1
454+
- api:
455+
crdVersion: v1
456+
namespaced: true
457+
controller: true
458+
domain: redhat.io
459+
group: redhatcop
460+
kind: CertAuthEngineRole
461+
path: github.com/redhat-cop/vault-config-operator/api/v1alpha1
462+
version: v1alpha1
463+
webhooks:
464+
defaulting: true
465+
validation: true
466+
webhookVersion: v1
441467
version: "3"
Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
/*
2+
Copyright 2021.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
"context"
21+
"reflect"
22+
23+
"github.com/redhat-cop/vault-config-operator/api/v1alpha1/utils"
24+
vaultutils "github.com/redhat-cop/vault-config-operator/api/v1alpha1/utils"
25+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
)
28+
29+
// CertAuthEngineConfigSpec defines the desired state of CertAuthEngineConfig
30+
type CertAuthEngineConfigSpec struct {
31+
// Connection represents the information needed to connect to Vault. This operator uses the standard Vault environment variables to connect to Vault. If you need to override those settings and for example connect to a different Vault instance, you can do with this section of the CR.
32+
// +kubebuilder:validation:Optional
33+
Connection *vaultutils.VaultConnection `json:"connection,omitempty"`
34+
35+
// Authentication is the kube auth configuration to be used to execute this request
36+
// +kubebuilder:validation:Required
37+
Authentication vaultutils.KubeAuthConfiguration `json:"authentication,omitempty"`
38+
39+
// Path at which to make the configuration.
40+
// The final path in Vault will be {[spec.authentication.namespace]}/auth/{spec.path}/{metadata.name}/config.
41+
// The authentication role must have the following capabilities = [ "create", "read", "update", "delete"] on that path.
42+
// +kubebuilder:validation:Required
43+
Path vaultutils.Path `json:"path,omitempty"`
44+
45+
// The name of the object created in Vault. If this is specified it takes precedence over {metatada.name}
46+
// +kubebuilder:validation:Optional
47+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
48+
Name string `json:"name,omitempty"`
49+
50+
// +kubebuilder:validation:Required
51+
CertAuthEngineConfigInternal `json:",inline"`
52+
}
53+
54+
// CertAuthEngineConfigStatus defines the observed state of CertAuthEngineConfig
55+
type CertAuthEngineConfigStatus struct {
56+
// +patchMergeKey=type
57+
// +patchStrategy=merge
58+
// +listType=map
59+
// +listMapKey=type
60+
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
61+
}
62+
63+
//+kubebuilder:object:root=true
64+
//+kubebuilder:subresource:status
65+
66+
// CertAuthEngineConfig is the Schema for the certauthengineconfigs API
67+
type CertAuthEngineConfig struct {
68+
metav1.TypeMeta `json:",inline"`
69+
metav1.ObjectMeta `json:"metadata,omitempty"`
70+
71+
Spec CertAuthEngineConfigSpec `json:"spec,omitempty"`
72+
Status CertAuthEngineConfigStatus `json:"status,omitempty"`
73+
}
74+
75+
//+kubebuilder:object:root=true
76+
77+
// CertAuthEngineConfigList contains a list of CertAuthEngineConfig
78+
type CertAuthEngineConfigList struct {
79+
metav1.TypeMeta `json:",inline"`
80+
metav1.ListMeta `json:"metadata,omitempty"`
81+
Items []CertAuthEngineConfig `json:"items"`
82+
}
83+
84+
type CertAuthEngineConfigInternal struct {
85+
// If set, during renewal, skips the matching of presented client identity with the client identity used during login.
86+
// +kubebuilder:validation:Optional
87+
// +kubebuilder:default:=false
88+
DisableBinding bool `json:"disableBinding,omitempty"`
89+
90+
// If set, metadata of the certificate including the metadata corresponding to allowedMetadataExtensions will be stored in the alias.
91+
// +kubebuilder:validation:Optional
92+
// +kubebuilder:default:=false
93+
EnableIdentityAliasMetadata bool `json:"enableIdentityAliasMetadata,omitempty"`
94+
95+
// The size of the OCSP response LRU cache. Note that this cache is used for all configured certificates.
96+
// +kubebuilder:validation:Optional
97+
// +kubebuilder:default:=100
98+
OCSPCacheSize int `json:"ocspCacheSize,omitempty"`
99+
100+
// The size of the role cache. Use -1 to disable role caching.
101+
// +kubebuilder:validation:Optional
102+
// +kubebuilder:default:=200
103+
RoleCacheSize int `json:"roleCacheSize,omitempty"`
104+
}
105+
106+
func (c *CertAuthEngineConfigInternal) toMap() map[string]any {
107+
payload := make(map[string]any)
108+
payload["disable_binding"] = c.DisableBinding
109+
payload["enable_identity_alias_metadata"] = c.EnableIdentityAliasMetadata
110+
payload["ocsp_cache_size"] = c.OCSPCacheSize
111+
payload["role_cache_size"] = c.RoleCacheSize
112+
113+
return payload
114+
}
115+
116+
var _ vaultutils.VaultObject = &CertAuthEngineConfig{}
117+
var _ vaultutils.ConditionsAware = &CertAuthEngineConfig{}
118+
119+
func (r *CertAuthEngineConfig) GetPath() string {
120+
if r.Spec.Name != "" {
121+
return vaultutils.CleansePath("auth/" + string(r.Spec.Path) + "/" + r.Spec.Name + "/config")
122+
}
123+
124+
return vaultutils.CleansePath("auth/" + string(r.Spec.Path) + "/" + r.Name + "/config")
125+
}
126+
127+
func (r *CertAuthEngineConfig) GetPayload() map[string]interface{} {
128+
return r.Spec.CertAuthEngineConfigInternal.toMap()
129+
}
130+
131+
// IsEquivalentToDesiredState returns wether the passed payload is equivalent to the payload that the current object would generate. When this is a engine object the tune payload will be compared
132+
func (r *CertAuthEngineConfig) IsEquivalentToDesiredState(payload map[string]interface{}) bool {
133+
desiredState := r.Spec.CertAuthEngineConfigInternal.toMap()
134+
135+
return reflect.DeepEqual(desiredState, payload)
136+
}
137+
138+
func (r *CertAuthEngineConfig) IsInitialized() bool {
139+
return true
140+
}
141+
142+
func (r *CertAuthEngineConfig) IsValid() (bool, error) {
143+
return true, nil
144+
}
145+
146+
func (r *CertAuthEngineConfig) IsDeletable() bool {
147+
return true
148+
}
149+
150+
func (r *CertAuthEngineConfig) PrepareInternalValues(context context.Context, object client.Object) error {
151+
return nil
152+
}
153+
154+
func (r *CertAuthEngineConfig) PrepareTLSConfig(context context.Context, object client.Object) error {
155+
return nil
156+
}
157+
158+
func (r *CertAuthEngineConfig) GetKubeAuthConfiguration() *utils.KubeAuthConfiguration {
159+
return &r.Spec.Authentication
160+
}
161+
162+
func (r *CertAuthEngineConfig) GetVaultConnection() *utils.VaultConnection {
163+
return r.Spec.Connection
164+
}
165+
166+
func (r *CertAuthEngineConfig) GetConditions() []metav1.Condition {
167+
return r.Status.Conditions
168+
}
169+
170+
func (r *CertAuthEngineConfig) SetConditions(conditions []metav1.Condition) {
171+
r.Status.Conditions = conditions
172+
}
173+
174+
func init() {
175+
SchemeBuilder.Register(&CertAuthEngineConfig{}, &CertAuthEngineConfigList{})
176+
}
Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
/*
2+
Copyright 2021.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
"errors"
21+
22+
"k8s.io/apimachinery/pkg/runtime"
23+
ctrl "sigs.k8s.io/controller-runtime"
24+
logf "sigs.k8s.io/controller-runtime/pkg/log"
25+
"sigs.k8s.io/controller-runtime/pkg/webhook"
26+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
27+
)
28+
29+
// log is for logging in this package.
30+
var certauthengineconfiglog = logf.Log.WithName("certauthengineconfig-resource")
31+
32+
func (r *CertAuthEngineConfig) SetupWebhookWithManager(mgr ctrl.Manager) error {
33+
return ctrl.NewWebhookManagedBy(mgr).
34+
For(r).
35+
Complete()
36+
}
37+
38+
//+kubebuilder:webhook:path=/mutate-redhatcop-redhat-io-v1alpha1-certauthengineconfig,mutating=true,failurePolicy=fail,sideEffects=None,groups=redhatcop.redhat.io,resources=certauthengineconfigs,verbs=create;update,versions=v1alpha1,name=mcertauthengineconfig.kb.io,admissionReviewVersions=v1
39+
40+
var _ webhook.Defaulter = &CertAuthEngineConfig{}
41+
42+
// Default implements webhook.Defaulter so a webhook will be registered for the type
43+
func (r *CertAuthEngineConfig) Default() {
44+
certauthengineconfiglog.Info("default", "name", r.Name)
45+
}
46+
47+
//+kubebuilder:webhook:path=/validate-redhatcop-redhat-io-v1alpha1-certauthengineconfig,mutating=false,failurePolicy=fail,sideEffects=None,groups=redhatcop.redhat.io,resources=certauthengineconfigs,verbs=create;update,versions=v1alpha1,name=vcertauthengineconfig.kb.io,admissionReviewVersions=v1
48+
49+
var _ webhook.Validator = &CertAuthEngineConfig{}
50+
51+
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
52+
func (r *CertAuthEngineConfig) ValidateCreate() (admission.Warnings, error) {
53+
certauthengineconfiglog.Info("validate create", "name", r.Name)
54+
55+
return nil, nil
56+
}
57+
58+
// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
59+
func (r *CertAuthEngineConfig) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
60+
certauthengineconfiglog.Info("validate update", "name", r.Name)
61+
62+
if r.Spec.Path != old.(*CertAuthEngineConfig).Spec.Path {
63+
return nil, errors.New("spec.path cannot be updated")
64+
}
65+
66+
if r.Spec.Name != old.(*CertAuthEngineConfig).Spec.Name {
67+
return nil, errors.New("spec.name cannot be updated")
68+
}
69+
70+
return nil, nil
71+
}
72+
73+
// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
74+
func (r *CertAuthEngineConfig) ValidateDelete() (admission.Warnings, error) {
75+
certauthengineconfiglog.Info("validate delete", "name", r.Name)
76+
77+
return nil, nil
78+
}

0 commit comments

Comments
 (0)