From 9e30999d06b43d8894edd268c0b343e9e63df60d Mon Sep 17 00:00:00 2001 From: "Aldo \"xoen\" Giambelluca" Date: Fri, 15 Dec 2017 11:48:10 +0000 Subject: [PATCH] Support for OIDC 'username-prefix' and 'groups-prefix' flags See: https://kubernetes.io/docs/admin/authentication/#configuring-the-api-server This is very similar to this other PR: https://github.com/kubernetes/kops/pull/1438/files I also updated the format of the documentation for the OIDC API Server fields to follow the Go Style guide: https://blog.golang.org/godoc-documenting-go-code Fixes: https://github.com/kubernetes/kops/issues/4007 --- docs/cluster_spec.md | 3 +++ pkg/apis/kops/componentconfig.go | 23 ++++++++++++++----- pkg/apis/kops/v1alpha1/componentconfig.go | 23 ++++++++++++++----- .../kops/v1alpha1/zz_generated.conversion.go | 4 ++++ .../kops/v1alpha1/zz_generated.deepcopy.go | 18 +++++++++++++++ pkg/apis/kops/v1alpha2/componentconfig.go | 23 ++++++++++++++----- .../kops/v1alpha2/zz_generated.conversion.go | 4 ++++ .../kops/v1alpha2/zz_generated.deepcopy.go | 18 +++++++++++++++ pkg/apis/kops/zz_generated.deepcopy.go | 18 +++++++++++++++ 9 files changed, 116 insertions(+), 18 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 1226d061e8..d763057d07 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -137,8 +137,11 @@ spec: oidcIssuerURL: https://your-oidc-provider.svc.cluster.local oidcClientID: kubernetes oidcUsernameClaim: sub + oidcUsernamePrefix: "oidc:" oidcGroupsClaim: user_roles + oidcGroupsPrefix: "oidc:" oidcCAFile: /etc/kubernetes/ssl/kc-ca.pem + ``` #### audit logging diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 0885a3d604..b4ce7d7425 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -225,18 +225,29 @@ type KubeAPIServerConfig struct { KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"` // StorageBackend is the backend storage StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"` - // The OpenID claim to use as the user name. - // Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. + // OIDCUsernameClaim is the OpenID claim to use as the user name. + // Note that claims other than the default ('sub') is not guaranteed to be + // unique and immutable. OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"` - // If provided, the name of a custom OpenID Connect claim for specifying user groups. + // OIDCUsernamePrefix is the prefix prepended to username claims to prevent + // clashes with existing names (such as 'system:' users). + OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"` + // OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for + // specifying user groups. // The claim value is expected to be a string or array of strings. OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"` - // The URL of the OpenID issuer, only HTTPS scheme will be accepted. + // OIDCGroupsPrefix is the prefix prepended to group claims to prevent + // clashes with existing names (such as 'system:' groups) + OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"` + // OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will + // be accepted. // If set, it will be used to verify the OIDC JSON Web Token (JWT). OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"` - // The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set. + // OIDCClientID is the client ID for the OpenID Connect client, must be set + // if oidc-issuer-url is set. OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"` - // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file + // OIDCCAFile if set, the OpenID server's certificate will be verified by one + // of the authorities in the oidc-ca-file OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"` // The apiserver's client certificate used for outbound requests. ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"` diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 226a2b6ed5..2a5730970f 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -225,18 +225,29 @@ type KubeAPIServerConfig struct { KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"` // StorageBackend is the backend storage StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"` - // The OpenID claim to use as the user name. - // Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. + // OIDCUsernameClaim is the OpenID claim to use as the user name. + // Note that claims other than the default ('sub') is not guaranteed to be + // unique and immutable. OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"` - // If provided, the name of a custom OpenID Connect claim for specifying user groups. + // OIDCUsernamePrefix is the prefix prepended to username claims to prevent + // clashes with existing names (such as 'system:' users). + OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"` + // OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for + // specifying user groups. // The claim value is expected to be a string or array of strings. OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"` - // The URL of the OpenID issuer, only HTTPS scheme will be accepted. + // OIDCGroupsPrefix is the prefix prepended to group claims to prevent + // clashes with existing names (such as 'system:' groups) + OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"` + // OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will + // be accepted. // If set, it will be used to verify the OIDC JSON Web Token (JWT). OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"` - // The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set. + // OIDCClientID is the client ID for the OpenID Connect client, must be set + // if oidc-issuer-url is set. OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"` - // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file + // OIDCCAFile if set, the OpenID server's certificate will be verified by one + // of the authorities in the oidc-ca-file OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"` // The apiserver's client certificate used for outbound requests. ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"` diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 5504521f15..c8aa1cfb52 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1831,7 +1831,9 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes out.StorageBackend = in.StorageBackend out.OIDCUsernameClaim = in.OIDCUsernameClaim + out.OIDCUsernamePrefix = in.OIDCUsernamePrefix out.OIDCGroupsClaim = in.OIDCGroupsClaim + out.OIDCGroupsPrefix = in.OIDCGroupsPrefix out.OIDCIssuerURL = in.OIDCIssuerURL out.OIDCClientID = in.OIDCClientID out.OIDCCAFile = in.OIDCCAFile @@ -1890,7 +1892,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes out.StorageBackend = in.StorageBackend out.OIDCUsernameClaim = in.OIDCUsernameClaim + out.OIDCUsernamePrefix = in.OIDCUsernamePrefix out.OIDCGroupsClaim = in.OIDCGroupsClaim + out.OIDCGroupsPrefix = in.OIDCGroupsPrefix out.OIDCIssuerURL = in.OIDCIssuerURL out.OIDCClientID = in.OIDCClientID out.OIDCCAFile = in.OIDCCAFile diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index cf2eb7811b..479b39cfbb 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -1920,6 +1920,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCUsernamePrefix != nil { + in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCGroupsClaim != nil { in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim if *in == nil { @@ -1929,6 +1938,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCGroupsPrefix != nil { + in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCIssuerURL != nil { in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL if *in == nil { diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 4b61278732..05ad51b2e1 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -225,18 +225,29 @@ type KubeAPIServerConfig struct { KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"` // StorageBackend is the backend storage StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"` - // The OpenID claim to use as the user name. - // Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. + // OIDCUsernameClaim is the OpenID claim to use as the user name. + // Note that claims other than the default ('sub') is not guaranteed to be + // unique and immutable. OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"` - // If provided, the name of a custom OpenID Connect claim for specifying user groups. + // OIDCUsernamePrefix is the prefix prepended to username claims to prevent + // clashes with existing names (such as 'system:' users). + OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"` + // OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for + // specifying user groups. // The claim value is expected to be a string or array of strings. OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"` - // The URL of the OpenID issuer, only HTTPS scheme will be accepted. + // OIDCGroupsPrefix is the prefix prepended to group claims to prevent + // clashes with existing names (such as 'system:' groups) + OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"` + // OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will + // be accepted. // If set, it will be used to verify the OIDC JSON Web Token (JWT). OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"` - // The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set. + // OIDCClientID is the client ID for the OpenID Connect client, must be set + // if oidc-issuer-url is set. OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"` - // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file + // OIDCCAFile if set, the OpenID server's certificate will be verified by one + // of the authorities in the oidc-ca-file OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"` // The apiserver's client certificate used for outbound requests. ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"` diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 8b4d99d4e1..487c5f135a 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2093,7 +2093,9 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes out.StorageBackend = in.StorageBackend out.OIDCUsernameClaim = in.OIDCUsernameClaim + out.OIDCUsernamePrefix = in.OIDCUsernamePrefix out.OIDCGroupsClaim = in.OIDCGroupsClaim + out.OIDCGroupsPrefix = in.OIDCGroupsPrefix out.OIDCIssuerURL = in.OIDCIssuerURL out.OIDCClientID = in.OIDCClientID out.OIDCCAFile = in.OIDCCAFile @@ -2152,7 +2154,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes out.StorageBackend = in.StorageBackend out.OIDCUsernameClaim = in.OIDCUsernameClaim + out.OIDCUsernamePrefix = in.OIDCUsernamePrefix out.OIDCGroupsClaim = in.OIDCGroupsClaim + out.OIDCGroupsPrefix = in.OIDCGroupsPrefix out.OIDCIssuerURL = in.OIDCIssuerURL out.OIDCClientID = in.OIDCClientID out.OIDCCAFile = in.OIDCCAFile diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index e2eb0f5412..47d864d887 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -2046,6 +2046,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCUsernamePrefix != nil { + in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCGroupsClaim != nil { in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim if *in == nil { @@ -2055,6 +2064,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCGroupsPrefix != nil { + in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCIssuerURL != nil { in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL if *in == nil { diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 2e0b0364cc..b475c7b973 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -2265,6 +2265,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCUsernamePrefix != nil { + in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCGroupsClaim != nil { in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim if *in == nil { @@ -2274,6 +2283,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.OIDCGroupsPrefix != nil { + in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix + if *in == nil { + *out = nil + } else { + *out = new(string) + **out = **in + } + } if in.OIDCIssuerURL != nil { in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL if *in == nil {