mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-01-05 13:07:14 +00:00
First draft of a GitHubIdentityProvider CRD
This commit is contained in:
Joshua Casey
@@ -0,0 +1,321 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.14.0
|
||||
name: githubidentityproviders.idp.supervisor.pinniped.dev
|
||||
spec:
|
||||
group: idp.supervisor.pinniped.dev
|
||||
names:
|
||||
categories:
|
||||
- pinniped
|
||||
- pinniped-idp
|
||||
- pinniped-idps
|
||||
kind: GitHubIdentityProvider
|
||||
listKind: GitHubIdentityProviderList
|
||||
plural: githubidentityproviders
|
||||
singular: githubidentityprovider
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.githubAPI.host
|
||||
name: Host
|
||||
type: string
|
||||
- jsonPath: .status.phase
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
|
||||
This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
|
||||
|
||||
|
||||
Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
|
||||
as OIDCClients.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec for configuring the identity provider.
|
||||
properties:
|
||||
allowAuthentication:
|
||||
description: AllowAuthentication allows customization of who can authenticate
|
||||
using this IDP and how.
|
||||
properties:
|
||||
organizations:
|
||||
description: Organizations allows customization of which organizations
|
||||
can authenticate using this IDP.
|
||||
properties:
|
||||
allowed:
|
||||
description: |-
|
||||
Allowed, when specified, indicates that only users with membership in at least one of the listed
|
||||
GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include
|
||||
teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be
|
||||
provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP.
|
||||
|
||||
|
||||
The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations,
|
||||
otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams
|
||||
within that organization.
|
||||
|
||||
|
||||
If no organizations are listed, you must set organizations: AllGitHubUsers.
|
||||
items:
|
||||
type: string
|
||||
maxItems: 64
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
policy:
|
||||
default: OnlyUsersFromAllowedOrganizations
|
||||
description: |-
|
||||
Policy must be set to "AllGitHubUsers" if allowed is empty.
|
||||
|
||||
|
||||
This field only exists to ensure that Pinniped administrators are aware that an empty list of
|
||||
allowedOrganizations means all GitHub users are allowed to log in.
|
||||
enum:
|
||||
- OnlyUsersFromAllowedOrganizations
|
||||
- AllGitHubUsers
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: spec.allowAuthentication.organizations.policy must
|
||||
be 'OnlyUsersFromAllowedOrganizations' when spec.allowAuthentication.organizations.allowed
|
||||
has organizations listed
|
||||
rule: '!(has(self.allowed) && size(self.allowed) > 0 && self.policy
|
||||
== ''AllGitHubUsers'')'
|
||||
- message: spec.allowAuthentication.organizations.policy must
|
||||
be 'AllGitHubUsers' when spec.allowAuthentication.organizations.allowed
|
||||
is empty
|
||||
rule: '!((!has(self.allowed) || size(self.allowed) == 0) &&
|
||||
self.policy == ''OnlyUsersFromAllowedOrganizations'')'
|
||||
required:
|
||||
- organizations
|
||||
type: object
|
||||
claims:
|
||||
description: Claims allows customization of the username and groups
|
||||
claims.
|
||||
properties:
|
||||
groups:
|
||||
default: slug
|
||||
description: |-
|
||||
Groups configures which property of the GitHub team record shall determine the group names in Kubernetes.
|
||||
|
||||
|
||||
Can be either "name" or "slug". Defaults to "slug".
|
||||
|
||||
|
||||
GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!").
|
||||
|
||||
|
||||
GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins").
|
||||
|
||||
|
||||
Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a
|
||||
forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters
|
||||
or single hyphens, so the first forward slash `/` will be the separator between the organization login name and
|
||||
the team name or slug.
|
||||
|
||||
|
||||
If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
|
||||
FederationDomain to further customize how these group names are presented to Kubernetes.
|
||||
|
||||
|
||||
See the response schema for
|
||||
[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
|
||||
enum:
|
||||
- name
|
||||
- slug
|
||||
type: string
|
||||
username:
|
||||
default: login:id
|
||||
description: |-
|
||||
Username configures which property of the GitHub user record shall determine the username in Kubernetes.
|
||||
|
||||
|
||||
Can be either "id", "login", or "login:id". Defaults to "login:id".
|
||||
|
||||
|
||||
GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens,
|
||||
and may not start or end with hyphens. GitHub users are allowed to change their login name,
|
||||
although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar",
|
||||
then a second user might change their name from "baz" to "foo" in order to take the old
|
||||
username of the first user. For this reason, it is not as safe to make authorization decisions
|
||||
based only on the user's login attribute.
|
||||
|
||||
|
||||
If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's
|
||||
FederationDomain to further customize how these usernames are presented to Kubernetes.
|
||||
|
||||
|
||||
Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and
|
||||
unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value
|
||||
from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable
|
||||
choice to concatenate the two values.
|
||||
|
||||
|
||||
See the response schema for
|
||||
[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
|
||||
enum:
|
||||
- id
|
||||
- login
|
||||
- login:id
|
||||
type: string
|
||||
type: object
|
||||
client:
|
||||
description: Client identifies the secret with credentials for a GitHub
|
||||
App or GitHub OAuth2 App (a GitHub client).
|
||||
properties:
|
||||
secretName:
|
||||
description: |-
|
||||
SecretName contains the name of a namespace-local Secret object that provides the clientID and
|
||||
clientSecret for an GitHub App or GitHub OAuth2 client.
|
||||
|
||||
|
||||
This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret".
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
githubAPI:
|
||||
default: {}
|
||||
description: GitHubAPI allows configuration for GitHub Enterprise
|
||||
Server
|
||||
properties:
|
||||
host:
|
||||
default: github.com
|
||||
description: |-
|
||||
Host is required only for GitHub Enterprise Server.
|
||||
Defaults to using GitHub's public API (github.com).
|
||||
Do not specify a protocol or scheme since 'https://' will always be used.
|
||||
minLength: 1
|
||||
type: string
|
||||
tls:
|
||||
description: TLS configuration for GitHub Enterprise Server.
|
||||
properties:
|
||||
certificateAuthorityData:
|
||||
description: X.509 Certificate Authority (base64-encoded PEM
|
||||
bundle). If omitted, a default set of system roots will
|
||||
be trusted.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- allowAuthentication
|
||||
- client
|
||||
type: object
|
||||
status:
|
||||
description: Status of the identity provider.
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represents the observations of an identity
|
||||
provider's current state.
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
phase:
|
||||
default: Pending
|
||||
description: Phase summarizes the overall status of the GitHubIdentityProvider.
|
||||
enum:
|
||||
- Pending
|
||||
- Ready
|
||||
- Error
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,4 +1,4 @@
|
||||
#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
|
||||
#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
#! SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
#@ load("@ytt:data", "data")
|
||||
@@ -56,6 +56,14 @@ rules:
|
||||
- #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
|
||||
resources: [activedirectoryidentityproviders/status]
|
||||
verbs: [get, patch, update]
|
||||
- apiGroups:
|
||||
- #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
|
||||
resources: [githubidentityproviders]
|
||||
verbs: [get, list, watch]
|
||||
- apiGroups:
|
||||
- #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
|
||||
resources: [githubidentityproviders/status]
|
||||
verbs: [get, patch, update]
|
||||
#! We want to be able to read pods/replicasets/deployment so we can learn who our deployment is to set
|
||||
#! as an owner reference.
|
||||
- apiGroups: [""]
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
|
||||
#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
||||
#! SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
#@ load("@ytt:overlay", "overlay")
|
||||
@@ -41,6 +41,15 @@ metadata:
|
||||
spec:
|
||||
group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
|
||||
|
||||
#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"githubidentityproviders.idp.supervisor.pinniped.dev"}}), expects=1
|
||||
---
|
||||
metadata:
|
||||
#@overlay/match missing_ok=True
|
||||
labels: #@ labels()
|
||||
name: #@ pinnipedDevAPIGroupWithPrefix("githubidentityproviders.idp.supervisor")
|
||||
spec:
|
||||
group: #@ pinnipedDevAPIGroupWithPrefix("idp.supervisor")
|
||||
|
||||
#@overlay/match by=overlay.subset({"kind": "CustomResourceDefinition", "metadata":{"name":"oidcclients.config.supervisor.pinniped.dev"}}), expects=1
|
||||
---
|
||||
metadata:
|
||||
|
||||
Reference in New Issue
Block a user