Commit Graph

30 Commits

Author SHA1 Message Date
Ryan Richard
83696fd023 improve errors and docs for JWTAuthenticator features, with int tests 2025-07-18 12:22:06 -07:00
Ryan Richard
64e5e20010 add usernameExpression and groupsExpression to JWTAuthenticator CRD 2025-07-16 14:56:44 -07:00
Ryan Richard
2a83d00373 add claimValidationRules, userValidationRules, and claims.extra to JWTAuthenticator CRD 2025-07-16 14:56:44 -07:00
Ryan Richard
a315cc4977 update copyright year for api generated code 2025-05-12 16:49:00 -07:00
Ryan Richard
06b7d302a2 fix typo in tmpl and run codegen 2024-08-05 11:32:21 -07:00
Ryan Richard
59c2295dfd improve api docs for TLSSpec in authenticator and IDP specs
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
2024-08-05 11:32:21 -07:00
Ryan Richard
a40c88ebf3 document allowed enum values and default values in all CR spec fields 2024-08-05 11:32:21 -07:00
Ryan Richard
e0235ed190 update docs and change struct name in types_tls.go.tmpl files
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
2024-08-05 11:32:21 -07:00
Ashish Amarnath
19c4acf391 secret/configmap with CA bundle to be created in namespace where pinniped is installed
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
2024-08-05 11:32:20 -07:00
Ryan Richard
756966c55b add "Status" printer column to JWTAuthenticator and WebhookAuthenticator 2024-08-05 11:32:19 -07:00
Ashish Amarnath
7e6dadb508 add CRD validation integration tests
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
2024-08-05 11:32:19 -07:00
Ashish Amarnath
842f14af4c update go templates for TLSSpec for concierge and supervisor
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
2024-08-05 11:32:18 -07:00
Ryan Richard
d0781c42dc make codegen work for Kube 1.30 2024-04-30 13:55:27 -07:00
Benjamin A. Petersen
590e2d18f7 Add WebhookAuthenticator integration tests, expand unit tests
- Add WebhookAuthenticator unit tests, update generated code
- Add validateTLSNegotiation(), update tests
- Update validateTLSNegotiation, add unit tests, factor out helpers
- Update generated code
2024-03-19 16:48:05 -04:00
Benjamin A. Petersen
e8482ab9e9 Update jwtauthenticator unit tests to check actions
- Add test to verify timestamps are particularly updated
- Improve diff output in tests for actions
- Make jwtauthenticator status tests parallel
- Update copyright headers in multiple files
2024-02-27 15:45:32 -08:00
Benjamin A. Petersen
a4447fa606 Add .Status to JWTAuthenticator with Conditions,Phase
- "Ready" condition & supporting conditions
- Legacy "Phase" for convenience
- Refactor newCachedJWTAuthenticator() func
  to improve ability to provide additional conditions
- Update JWTAuthenticator.Status type
- Update RBAC for SA to get/watch/update JWTAuthenticator.Status
- Update logger to plog, add tests for logs & statuses
- update Sync() to reduce enqueue when error is config/user managed, perhaps remove validateJWKSResponse()
2024-02-27 15:45:32 -08:00
Joshua Casey
64f1bff13f Use Conditions from apimachinery, specifically k8s.io/apimachinery/pkg/apis/meta/v1.Conditions 2023-09-11 10:13:39 -07:00
Ryan Richard
f501c76acc Add generated code for Kube 1.21, 1.22, and 1.23
Also:
- Make our code generator script work with Go 1.17
- Make our update.sh script work on linux
- Update the patch versions of the old Kube versions that we were using
  to generate code (see kube-versions.txt)
- Use our container images from ghcr instead of
  projects.registry.vmware.com for codegen purposes
- Make it easier to debug in the future by passing "-v" to the Kube
  codegen scripts
- Updated copyright years to make commit checks pass
2022-02-28 17:58:48 -08:00
Ryan Richard
0a31f45812 Update the AdditionalPrinterColumns of the CRDs, and add a test for it 2021-09-20 12:47:39 -07:00
Monis Khan
2e9baf9fa6 Correctly generate status subresource for all CRDs
Signed-off-by: Monis Khan <mok@vmware.com>
2021-02-10 21:52:08 -05:00
Monis Khan
d25c6d9d0a Make kubebuilder CRDs cluster scoped
Signed-off-by: Monis Khan <mok@vmware.com>
2021-02-10 21:52:08 -05:00
Monis Khan
4205e3dedc Make concierge APIs cluster scoped
Signed-off-by: Monis Khan <mok@vmware.com>
2021-02-10 21:52:07 -05:00
Ryan Richard
653224c2ad types_jwt.go.tmpl: Replace spaces with tabs 2020-12-16 12:21:30 -08:00
Ryan Richard
dcb19150fc Nest claim configs one level deeper in JWTAuthenticatorSpec
Signed-off-by: Margo Crawford <margaretc@vmware.com>
2020-12-16 09:42:19 -08:00
Ryan Richard
0e60c93cef Add UsernameClaim and GroupsClaim to JWTAuthenticator CRD spec
Signed-off-by: Margo Crawford <margaretc@vmware.com>
2020-12-15 10:36:19 -08:00
Andrew Keesler
946b0539d2 Add JWTAuthenticator API type
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
2020-12-08 15:41:48 -05:00
Matt Moyer
7f2c43cd62 Put all of our APIs into a "pinniped" category, and never use "all".
We want to have our APIs respond to `kubectl get pinniped`, and we shouldn't use `all` because we don't think most average users should have permission to see our API types, which means if we put our types there, they would get an error from `kubectl get all`.

I also added some tests to assert these properties on all `*.pinniped.dev` API resources.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-11-12 16:26:34 -06:00
Matt Moyer
821190004c Remove extraneous internal packages for CRD APIs.
These only really make sense for aggregated API types where we need `conversion-gen` to do version conversion.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-11-12 14:04:53 -06:00
Matt Moyer
0f25657a35 Rename WebhookIdentityProvider to WebhookAuthenticator.
Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-10-30 15:11:53 -05:00
Matt Moyer
e69183aa8a Rename idp.concierge.pinniped.dev to authentication.concierge.pinniped.dev.
Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-10-30 14:07:40 -05:00