config: add file storage option (#1230)

## Summary
Add support for a file storage backend.

## Related issues


## Checklist

- [x] reference any related issues
- [ ] updated docs
- [ ] updated unit tests
- [ ] updated UPGRADING.md
- [x] add appropriate tag (`improvement` / `bug` / etc)
- [x] ready for review

Author: calebdoxsey

apis/ingress/v1/pomerium_types.go

@@ -79,6 +79,15 @@ type RefreshDirectorySettings struct {
 	Timeout metav1.Duration `json:"timeout"`
 }
 
+// FileStorage defines File storage options.
+type FileStorage struct {
+	// Path defines the local file system path to store data.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:MinLength=1
+	Path string `json:"path"`
+}
+
 // PostgresStorage defines Postgres connection parameters.
 type PostgresStorage struct {
 	// Secret specifies a name of a Secret that must contain
@@ -115,9 +124,12 @@ type PostgresStorage struct {
 // Storage defines persistent storage option for the databroker
 // and is only applied for all-in-one pomerium bootstrap,
 // and has no effect for the split-mode deployment.
-// If Storage is specified, the `postgresql` parameter should be set.
+// If Storage is specified, the `postgres` or `file` parameter should be set.
 // Omit setting storage to use the in-memory storage implementation.
 type Storage struct {
+	// File specifies file storage options.
+	// +kubebuilder:validation:Optional
+	File *FileStorage `json:"file"`
 	// Postgres specifies PostgreSQL database connection parameters
 	// +kubebuilder:validation:Optional
 	Postgres *PostgresStorage `json:"postgres"`

apis/ingress/v1/zz_generated.deepcopy.go

@@ -489,6 +489,17 @@ spec:
                   See <a href="https://www.pomerium.com/docs/topics/data-storage">Storage</a> for details.
                   If no storage is specified, Pomerium would use a transient in-memory storage (not recommended for production).
                 properties:
+                  file:
+                    description: File specifies file storage options.
+                    properties:
+                      path:
+                        description: Path defines the local file system path to store
+                          data.
+                        minLength: 1
+                        type: string
+                    required:
+                    - path
+                    type: object
                   postgres:
                     description: Postgres specifies PostgreSQL database connection
                       parameters

config/crd/bases/ingress.pomerium.io_pomerium.yaml

@@ -159,16 +159,20 @@ func fetchConfigSecrets(ctx context.Context, client client.Client, cfg *model.Co
 				return nil
 			}
 
+			if f := s.Storage.File; f != nil {
+				return nil
+			}
+
 			if p := s.Storage.Postgres; p != nil {
 				if err := applyAll(
 					apply("connection", required(&p.Secret), &cfg.StorageSecrets.Secret),
 					apply("tls", optional(p.TLSSecret), &cfg.StorageSecrets.TLS),
 					apply("ca", optional(p.CASecret), &cfg.StorageSecrets.CA),
 				); err != nil {
-					return fmt.Errorf("postgresql: %w", err)
+					return fmt.Errorf("postgres: %w", err)
 				}
 			} else {
-				return fmt.Errorf("if storage is specified, postgres storage should be provided")
+				return fmt.Errorf("if storage is specified, file or postgres storage should be provided")
 			}
 
 			return cfg.StorageSecrets.Validate()

controllers/settings/fetch.go

@@ -631,6 +631,17 @@ spec:
                   See <a href="https://www.pomerium.com/docs/topics/data-storage">Storage</a> for details.
                   If no storage is specified, Pomerium would use a transient in-memory storage (not recommended for production).
                 properties:
+                  file:
+                    description: File specifies file storage options.
+                    properties:
+                      path:
+                        description: Path defines the local file system path to store
+                          data.
+                        minLength: 1
+                        type: string
+                    required:
+                    - path
+                    type: object
                   postgres:
                     description: Postgres specifies PostgreSQL database connection
                       parameters

deployment.yaml

@@ -69,7 +69,7 @@ func ApplyConfig(ctx context.Context, dst *pb.Config, src *model.Config) error {
 }
 
 func checkForWarnings(ctx context.Context, _ *pb.Config, c *model.Config) error {
-	if c.Spec.Storage == nil || c.Spec.Storage.Postgres == nil {
+	if c.Spec.Storage == nil || (c.Spec.Storage.File == nil && c.Spec.Storage.Postgres == nil) {
 		util.Add(ctx, config.FieldMsg{
 			Key:           "storage",
 			DocsURL:       "https://www.pomerium.com/docs/internals/data-storage",

pomerium/config.go

@@ -86,6 +86,10 @@ func applyStorage(ctx context.Context, dst *config.Options, src *model.Config) e
 		return nil
 	}
 
+	if src.Spec.Storage.File != nil {
+		return applyStorageFile(dst, src)
+	}
+
 	if err := src.StorageSecrets.Validate(); err != nil {
 		return err
 	}
@@ -94,7 +98,13 @@ func applyStorage(ctx context.Context, dst *config.Options, src *model.Config) e
 		return applyStoragePostgres(dst, src)
 	}
 
-	return fmt.Errorf("if storage is specified, it must contain postgresql config. omit storage key for in-memory")
+	return fmt.Errorf("if storage is specified, it must contain file or postgres config. omit storage key for in-memory")
+}
+
+func applyStorageFile(dst *config.Options, src *model.Config) error {
+	dst.DataBroker.StorageType = config.StorageFileName
+	dst.DataBroker.StorageConnectionString = "file://" + src.Spec.Storage.File.Path
+	return nil
 }
 
 func applyStoragePostgres(dst *config.Options, src *model.Config) error {

pomerium/ctrl/bootstrap.go

@@ -904,6 +904,36 @@ DownstreamMTLS sets the <a href="https://www.pomerium.com/docs/reference/downstr
 
 
 
+### `file`
+
+File specifies file storage options.
+
+<table>
+    <thead>
+    </thead>
+    <tbody>
+
+        <tr>
+            <td>
+                <p>
+                <code>path</code>&#160;&#160;
+
+                    <strong>string</strong>&#160;
+
+                </p>
+                <p>
+                    <strong>Required.</strong>&#160;
+                    Path defines the local file system path to store data.
+                </p>
+
+            </td>
+        </tr>
+
+    </tbody>
+</table>
+
+
+
 ### `identityProvider`
 
 IdentityProvider configure single-sign-on authentication and user identity details by integrating with your <a href="https://www.pomerium.com/docs/identity-providers/">Identity Provider</a>
@@ -1492,6 +1522,23 @@ Storage defines persistent storage for sessions and other data. See <a href="htt
     </thead>
     <tbody>
 
+        <tr>
+            <td>
+                <p>
+                <code>file</code>&#160;&#160;
+
+                    <strong>object</strong>&#160;
+                    (<a href="#file">file</a>)
+
+                </p>
+                <p>
+
+                    File specifies file storage options.
+                </p>
+
+            </td>
+        </tr>
+
         <tr>
             <td>
                 <p>