Skip to content

Commit 34bfe5f

Browse files
ShazaAldawamnehShazaAldawamneh
committed
Promote ExternalOIDCWithUpstreamParity to Default feature set
Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
1 parent a3d85be commit 34bfe5f

10 files changed

Lines changed: 570 additions & 30 deletions

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Default.crd.yaml‎

Lines changed: 139 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,19 @@ spec:
195195
claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled.
196196
maxLength: 256
197197
type: string
198+
expression:
199+
description: |-
200+
expression is an optional CEL expression used to derive
201+
group values from JWT claims.
202+
203+
CEL expressions have access to the token claims through a CEL variable, 'claims'.
204+
205+
expression must be at least 1 character and must not exceed 1024 characters in length .
206+
207+
When specified, claim must not be set or be explicitly set to the empty string (`""`).
208+
maxLength: 1024
209+
minLength: 1
210+
type: string
198211
prefix:
199212
description: |-
200213
prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
@@ -206,8 +219,15 @@ spec:
206219
type: string
207220
type: object
208221
x-kubernetes-validations:
209-
- message: claim is required
210-
rule: has(self.claim)
222+
- message: prefix must not be set to a non-empty value when
223+
expression is set
224+
rule: 'has(self.expression) && size(self.expression) >
225+
0 ? (!has(self.prefix) || size(self.prefix) == 0) :
226+
true'
227+
- message: expression must not be set if claim is specified
228+
and is not an empty string
229+
rule: '(size(self.?claim.orValue("")) > 0) ? !has(self.expression)
230+
: true'
211231
uid:
212232
description: |-
213233
uid is an optional field for configuring the claim mapping used to construct the uid for the cluster identity.
@@ -266,6 +286,19 @@ spec:
266286
maxLength: 256
267287
minLength: 1
268288
type: string
289+
expression:
290+
description: |-
291+
expression is an optional CEL expression used to derive
292+
the username from JWT claims.
293+
294+
CEL expressions have access to the token claims
295+
through a CEL variable, 'claims'.
296+
297+
expression must be at least 1 character and must not exceed 1024 characters in length.
298+
expression must not be set when claim is set.
299+
maxLength: 1024
300+
minLength: 1
301+
type: string
269302
prefix:
270303
description: |-
271304
prefix configures the prefix that should be prepended to the value of the JWT claim.
@@ -309,8 +342,14 @@ spec:
309342
type: string
310343
type: object
311344
x-kubernetes-validations:
312-
- message: claim is required
313-
rule: has(self.claim)
345+
- message: precisely one of claim or expression must be
346+
set
347+
rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
348+
- message: prefixPolicy must not be set to 'Prefix' when
349+
expression is set
350+
rule: 'has(self.expression) && size(self.expression) >
351+
0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
352+
''Prefix'' : true'
314353
- message: prefix must be set if prefixPolicy is 'Prefix',
315354
but must remain unset otherwise
316355
rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
@@ -330,6 +369,30 @@ spec:
330369
If type is RequiredClaim, requiredClaim must be set.
331370
If Type is CEL, CEL must be set and RequiredClaim must be omitted.
332371
properties:
372+
cel:
373+
description: |-
374+
cel holds the CEL expression and message for validation.
375+
Must be set when Type is "CEL", and forbidden otherwise.
376+
properties:
377+
expression:
378+
description: |-
379+
expression is a CEL expression evaluated against token claims.
380+
expression is required, must be at least 1 character in length and must not exceed 1024 characters.
381+
The expression must return a boolean value where 'true' signals a valid token and 'false' an invalid one.
382+
maxLength: 1024
383+
minLength: 1
384+
type: string
385+
message:
386+
description: |-
387+
message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails.
388+
message must be at least 1 character in length and must not exceed 256 characters.
389+
maxLength: 256
390+
minLength: 1
391+
type: string
392+
required:
393+
- expression
394+
- message
395+
type: object
333396
requiredClaim:
334397
description: |-
335398
requiredClaim allows configuring a required claim name and its expected value.
@@ -367,11 +430,16 @@ spec:
367430
When set to 'CEL', the Kubernetes API server will be configured to validate the incoming JWT against the configured CEL expression.
368431
enum:
369432
- RequiredClaim
433+
- CEL
370434
type: string
371435
required:
372436
- type
373437
type: object
374438
x-kubernetes-validations:
439+
- message: cel must be set when type is 'CEL', and forbidden
440+
otherwise
441+
rule: 'has(self.type) && self.type == ''CEL'' ? has(self.cel)
442+
: !has(self.cel)'
375443
- message: requiredClaim must be set when type is 'RequiredClaim',
376444
and forbidden otherwise
377445
rule: 'has(self.type) && self.type == ''RequiredClaim''
@@ -397,6 +465,29 @@ spec:
397465
minItems: 1
398466
type: array
399467
x-kubernetes-list-type: set
468+
discoveryURL:
469+
description: |-
470+
discoveryURL is an optional field that, if specified, overrides the default discovery endpoint used to retrieve OIDC configuration metadata.
471+
By default, the discovery URL is derived from `issuerURL` as "{issuerURL}/.well-known/openid-configuration".
472+
473+
The discoveryURL must be a valid absolute HTTPS URL.
474+
It must not contain query parameters, user information, or fragments.
475+
Additionally, it must differ from the value of `issuerURL` (ignoring trailing slashes).
476+
The discoveryURL value must be at least 1 character long and no longer than 2048 characters.
477+
maxLength: 2048
478+
minLength: 1
479+
type: string
480+
x-kubernetes-validations:
481+
- message: discoveryURL must be a valid URL
482+
rule: isURL(self)
483+
- message: discoveryURL must be a valid https URL
484+
rule: url(self).getScheme() == 'https'
485+
- message: discoveryURL must not contain query parameters
486+
rule: url(self).getQuery().size() == 0
487+
- message: discoveryURL must not contain fragments
488+
rule: self.matches('^[^#]*$')
489+
- message: discoveryURL must not contain user info
490+
rule: '!self.matches(''^https://.+:.+@.+/.*$'')'
400491
issuerCertificateAuthority:
401492
description: |-
402493
issuerCertificateAuthority is an optional field that configures the certificate authority, used by the Kubernetes API server, to validate the connection to the identity provider when fetching discovery information.
@@ -437,6 +528,11 @@ spec:
437528
- audiences
438529
- issuerURL
439530
type: object
531+
x-kubernetes-validations:
532+
- message: discoveryURL must be different from issuerURL
533+
rule: 'self.?discoveryURL.orValue("").size() > 0 ? (self.issuerURL.size()
534+
== 0 || self.discoveryURL.find(''^.+[^/]'') != self.issuerURL.find(''^.+[^/]''))
535+
: true'
440536
name:
441537
description: |-
442538
name is a required field that configures the unique human-readable identifier associated with the identity provider.
@@ -521,6 +617,45 @@ spec:
521617
- componentNamespace
522618
- componentName
523619
x-kubernetes-list-type: map
620+
userValidationRules:
621+
description: |-
622+
userValidationRules is an optional field that configures the set of rules used to validate the cluster user identity that was constructed via mapping token claims to user identity attributes.
623+
Rules are CEL expressions that must evaluate to 'true' for authentication to succeed.
624+
If any rule in the chain of rules evaluates to 'false', authentication will fail.
625+
When specified, at least one rule must be specified and no more than 64 rules may be specified.
626+
items:
627+
description: |-
628+
TokenUserValidationRule provides a CEL-based rule used to validate a token subject.
629+
Each rule contains a CEL expression that is evaluated against the token’s claims.
630+
properties:
631+
expression:
632+
description: |-
633+
expression is a required CEL expression that performs a validation on cluster user identity attributes like username, groups, etc.
634+
635+
The expression must evaluate to a boolean value.
636+
When the expression evaluates to 'true', the cluster user identity is considered valid.
637+
When the expression evaluates to 'false', the cluster user identity is not considered valid.
638+
expression must be at least 1 character in length and must not exceed 1024 characters.
639+
maxLength: 1024
640+
minLength: 1
641+
type: string
642+
message:
643+
description: |-
644+
message is a required human-readable message to be logged by the Kubernetes API server if the CEL expression defined in 'expression' fails.
645+
message must be at least 1 character in length and must not exceed 256 characters.
646+
maxLength: 256
647+
minLength: 1
648+
type: string
649+
required:
650+
- expression
651+
- message
652+
type: object
653+
maxItems: 64
654+
minItems: 1
655+
type: array
656+
x-kubernetes-list-map-keys:
657+
- expression
658+
x-kubernetes-list-type: map
524659
required:
525660
- claimMappings
526661
- issuer

0 commit comments

Comments
 (0)