support hosted authenticate OIDC mode

Author: kenjenkins

apis/ingress/v1/pomerium_types.go

@@ -28,7 +28,7 @@ type IdentityProvider struct {
 	// Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication.
 	// To use a generic provider, set to <code>oidc</code>.
 	// +kubebuilder:validation:Required
-	// +kubebuilder:validation:Enum=auth0;azure;github;gitlab;google;oidc;okta;onelogin;ping
+	// +kubebuilder:validation:Enum=apple;auth0;azure;cognito;github;gitlab;google;hosted;oidc;okta;onelogin;ping
 	Provider string `json:"provider"`
 	// URL is the base path to an identity provider's OpenID connect discovery document.
 	// See <a href="https://pomerium.com/docs/identity-providers">Identity Providers</a> guides for details.
@@ -39,7 +39,7 @@ type IdentityProvider struct {
 	URL *string `json:"url"`
 	// Secret containing IdP provider specific parameters.
 	// and must contain at least <code>client_id</code> and <code>client_secret</code> values.
-	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Optional
 	// +kubebuilder:validation:Type=string
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:Format="namespace/name"

config/crd/bases/ingress.pomerium.io_pomerium.yaml

@@ -301,11 +301,14 @@ spec:
                       Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication.
                       To use a generic provider, set to <code>oidc</code>.
                     enum:
+                    - apple
                     - auth0
                     - azure
+                    - cognito
                     - github
                     - gitlab
                     - google
+                    - hosted
                     - oidc
                     - okta
                     - onelogin
@@ -369,7 +372,6 @@ spec:
                     type: string
                 required:
                 - provider
-                - secret
                 type: object
               idpAccessTokenAllowedAudiences:
                 description: |-

controllers/settings/fetch.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/pomerium/ingress-controller/model"
 	"github.com/pomerium/ingress-controller/util"
+	"github.com/pomerium/pomerium/pkg/identity/oidc/hosted"
 )
 
 // FetchConfig returns
@@ -121,11 +122,16 @@ func fetchConfigSecrets(ctx context.Context, client client.Client, cfg *model.Co
 			if s.IdentityProvider == nil {
 				return nil
 			}
-			return applyAll(
-				apply("secret", required(&s.IdentityProvider.Secret), &cfg.IdpSecret),
+			var secrets []func() error
+			if s.IdentityProvider.Provider != hosted.Name {
+				secrets = append(secrets,
+					apply("secret", required(&s.IdentityProvider.Secret), &cfg.IdpSecret))
+			}
+			secrets = append(secrets,
 				apply("request params", optional(s.IdentityProvider.RequestParamsSecret), &cfg.RequestParams),
 				apply("service account", optional(s.IdentityProvider.ServiceAccountFromSecret), &cfg.IdpServiceAccount),
 			)
+			return applyAll(secrets...)
 		},
 		// ssh secrets
 		func() error {

deployment.yaml

@@ -443,11 +443,14 @@ spec:
                       Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication.
                       To use a generic provider, set to <code>oidc</code>.
                     enum:
+                    - apple
                     - auth0
                     - azure
+                    - cognito
                     - github
                     - gitlab
                     - google
+                    - hosted
                     - oidc
                     - okta
                     - onelogin
@@ -511,7 +514,6 @@ spec:
                     type: string
                 required:
                 - provider
-                - secret
                 type: object
               idpAccessTokenAllowedAudiences:
                 description: |-

pomerium/config.go

@@ -17,6 +17,7 @@ import (
 	"github.com/pomerium/ingress-controller/util"
 	"github.com/pomerium/pomerium/config"
 	pb "github.com/pomerium/pomerium/pkg/grpc/config"
+	"github.com/pomerium/pomerium/pkg/identity/oidc/hosted"
 )
 
 type applyOpt struct {
@@ -53,9 +54,11 @@ func ApplyConfig(ctx context.Context, dst *pb.Config, src *model.Config) error {
 		opts = append(opts, []applyOpt{
 			{"idp", applyIDP},
 			{"idp url", applyIDPProviderURL},
-			{"idp secret", applyIDPSecret},
 			{"idp request params", applyIDPRequestParams},
 		}...)
+		if src.Spec.IdentityProvider.Provider != hosted.Name {
+			opts = append(opts, applyOpt{"idp secret", applyIDPSecret})
+		}
 	}
 
 	for _, apply := range opts {