update crds validation

Author: AlexFenlon

config/crd/bases/k8s.nginx.org_policies.yaml

@@ -882,6 +882,9 @@ spec:
                 - clientID
                 - issuer
                 type: object
+                x-kubernetes-validations:
+                - message: trustedCertSecret can be set only if sslVerify is true
+                  rule: (self.sslVerify == true) || (self.sslVerify == false && !has(self.trustedCertSecret))
               rateLimit:
                 description: The rate limit policy controls the rate of processing
                   requests per a defined key.

deploy/crds.yaml

@@ -1053,6 +1053,9 @@ spec:
                 - clientID
                 - issuer
                 type: object
+                x-kubernetes-validations:
+                - message: trustedCertSecret can be set only if sslVerify is true
+                  rule: (self.sslVerify == true) || (self.sslVerify == false && !has(self.trustedCertSecret))
               rateLimit:
                 description: The rate limit policy controls the rate of processing
                   requests per a defined key.

docs/crd/k8s.nginx.org_policies.md

@@ -134,7 +134,7 @@ The `.spec` object supports the following fields:
 | `oidcNative.logoutTokenHint` | `boolean` | Adds the id_token_hint argument to the Provider's Logout Endpoint when redirecting user during logout. Required by some providers. |
 | `oidcNative.logoutURI` | `string` | Defines the URI path for initiating session logout. Upon session termination, the user is redirected to the Provider's logout endpoint or the post logout page. |
 | `oidcNative.pkce` | `string` | Explicitly enables or disables PKCE. By default, PKCE is automatically enabled based on OpenID Provider metadata. Allowed values: `"on"`, `"off"`. |
-| `oidcNative.postLogoutRedirectURI` | `string` | Defines the path where the user is redirected after logout. Must be a path on the same VirtualServer host — absolute URLs are not supported. When set, NIC also auto-generates an unauthenticated location at this path serving a plain-text confirmation response. |
+| `oidcNative.postLogoutRedirectURI` | `string` | Defines the path where the user is redirected after logout. Must be a path on the same host — absolute URLs are not supported. When set, NIC also auto-generates an unauthenticated location at this path serving a plain-text confirmation response. If multiple OIDCNative providers on the same host set the same path, only one auto-generated location is rendered; providers whose other generated locations (redirectURI, or the internal IdP proxy location) collide are rejected instead. |
 | `oidcNative.proxyBufferSize` | `string` | Buffer size used when proxying requests to the OpenID Provider. Applies to `proxy_buffer_size` and each buffer in `proxy_buffers`. Default is `32k`. |
 | `oidcNative.redirectURI` | `string` | Allows overriding the default redirect URI. The module defaults to /oidc_callback. |
 | `oidcNative.scope` | `string` | List of OpenID Connect scopes, space-separated. The scope openid is always required. Example: "openid profile email". The module defaults to "openid". |