rework settings sync to apply Core defaults (#1391)

When syncing settings via the new API we should apply any default
values explicitly, as they may not be inferred by the API
implementation.

Also remove the hard-coded default authenticate service URL, as this
should no longer be necessary.

Author: kenjenkins

pomerium/config.go

@@ -273,7 +273,6 @@ func applyCerts(_ context.Context, p *pb.Config, c *model.Config) error {
 
 func applyAuthenticate(_ context.Context, p *pb.Config, c *model.Config) error {
 	if c.Spec.Authenticate == nil {
-		p.Settings.AuthenticateServiceUrl = proto.String("https://authenticate.pomerium.app")
 		return nil
 	}
 

pomerium/sync_api.go

@@ -23,6 +23,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
+	"github.com/pomerium/pomerium/config"
 	pb "github.com/pomerium/pomerium/pkg/grpc/config"
 	"github.com/pomerium/sdk-go"
 	"github.com/pomerium/sdk-go/proto/pomerium"
@@ -341,7 +342,11 @@ func (r *APIReconciler) SetConfig(ctx context.Context, cfg *model.Config) (chang
 	pbConfig.Settings.Certificates = nil
 	pbConfig.Settings.CertificateAuthority = nil
 
-	settings, err := convertProto[*pomerium.Settings](pbConfig.Settings)
+	// Apply all Core defaults.
+	mergedSettings := config.NewDefaultOptions()
+	mergedSettings.ApplySettings(ctx, nil, pbConfig.Settings)
+
+	settings, err := convertProto[*pomerium.Settings](mergedSettings.ToProto().GetSettings())
 	if err != nil {
 		return false, err
 	}
@@ -350,18 +355,13 @@ func (r *APIReconciler) SetConfig(ctx context.Context, cfg *model.Config) (chang
 	if err != nil {
 		return false, err
 	}
-
-	// Mask any settings that cannot be set via the Pomerium CRD
 	existing := resp.Msg.Settings
-	existing.Address = nil
-	existing.Autocert = nil
-	existing.ClusterId = nil
-	existing.GrpcAddress = nil
-	existing.GrpcInsecure = nil
-	existing.Id = nil
-	existing.InsecureServer = nil
-	existing.NamespaceId = nil
-	existing.SharedSecret = nil
+
+	// Preserve any settings that cannot be set via the Pomerium CRD.
+	settings.Id = existing.Id
+	settings.AutoApplyChangesets = existing.AutoApplyChangesets
+	settings.AutocertDir = existing.AutocertDir
+	settings.RuntimeFlags = existing.RuntimeFlags
 
 	// Mask timestamp metadata.
 	existing.CreatedAt = nil

pomerium/sync_api_test.go

@@ -21,6 +21,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
 
+	"github.com/pomerium/pomerium/config"
 	"github.com/pomerium/sdk-go/proto/pomerium"
 
 	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
@@ -1028,6 +1029,9 @@ func TestAPIReconciler_SetConfig(t *testing.T) {
 		},
 	}
 
+	defaultSettings, err := convertProto[*pomerium.Settings](config.NewDefaultOptions().ToProto().GetSettings())
+	require.NoError(t, err)
+
 	t.Run("settings changed", func(t *testing.T) {
 		apiClient, _, r := setupReconciler(t)
 		ctx := t.Context()
@@ -1042,16 +1046,20 @@ func TestAPIReconciler_SetConfig(t *testing.T) {
 				},
 			}, nil)
 
+		expectedSettings := proto.CloneOf(defaultSettings)
+		expectedSettings.Id = new("settings-id-123")
+		expectedSettings.AuthenticateServiceUrl = new("https://authenticate.localhost.pomerium.io")
+		expectedSettings.AutocertDir = nil
+		expectedSettings.IdpClientId = new("CLIENT_ID")
+		expectedSettings.IdpClientSecret = new("CLIENT_SECRET")
+		expectedSettings.IdpProvider = new("oidc")
+		expectedSettings.IdpProviderUrl = new("https://idp.example.com")
+		expectedSettings.PassIdentityHeaders = new(true)
+		expectedSettings.RuntimeFlags = nil
+
 		// ...and then call UpdateSettings() once it knows there are changes to sync.
 		apiClient.EXPECT().UpdateSettings(ctx, RequestEq(&pomerium.UpdateSettingsRequest{
-			Settings: &pomerium.Settings{
-				AuthenticateServiceUrl: new("https://authenticate.localhost.pomerium.io"),
-				IdpClientId:            new("CLIENT_ID"),
-				IdpClientSecret:        new("CLIENT_SECRET"),
-				IdpProvider:            new("oidc"),
-				IdpProviderUrl:         new("https://idp.example.com"),
-				PassIdentityHeaders:    new(true),
-			},
+			Settings: expectedSettings,
 		})).Return(&connect.Response[pomerium.UpdateSettingsResponse]{
 			Msg: &pomerium.UpdateSettingsResponse{},
 		}, nil)
@@ -1065,19 +1073,25 @@ func TestAPIReconciler_SetConfig(t *testing.T) {
 		apiClient, _, r := setupReconciler(t)
 		ctx := t.Context()
 
+		existingSettings := proto.CloneOf(defaultSettings)
+		proto.Merge(existingSettings, &pomerium.Settings{
+			Id: new("settings-id-123"),
+
+			AuthenticateServiceUrl: new("https://authenticate.localhost.pomerium.io"),
+			IdpClientId:            new("CLIENT_ID"),
+			IdpClientSecret:        new("CLIENT_SECRET"),
+			IdpProvider:            new("oidc"),
+			IdpProviderUrl:         new("https://idp.example.com"),
+			PassIdentityHeaders:    new(true),
+
+			AutoApplyChangesets: new(true), // this setting should be ignored
+		})
+
 		// If the settings already match, there should be no UpdateSettings() call.
 		apiClient.EXPECT().GetSettings(ctx, connect.NewRequest(&pomerium.GetSettingsRequest{})).
 			Return(&connect.Response[pomerium.GetSettingsResponse]{
 				Msg: &pomerium.GetSettingsResponse{
-					Settings: &pomerium.Settings{
-						Id: new("settings-id-123"),
-
-						AuthenticateServiceUrl: new("https://authenticate.localhost.pomerium.io"),
-						IdpClientId:            new("CLIENT_ID"),
-						IdpClientSecret:        new("CLIENT_SECRET"),
-						IdpProvider:            new("oidc"),
-						IdpProviderUrl:         new("https://idp.example.com"),
-						PassIdentityHeaders:    new(true)},
+					Settings: existingSettings,
 				},
 			}, nil)