kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Support for OIDC 'username-prefix' and 'groups-prefix' flags 

See: https://kubernetes.io/docs/admin/authentication/#configuring-the-api-server

This is very similar to this other PR: https://github.com/kubernetes/kops/pull/1438/files

I also updated the format of the documentation for the OIDC API Server fields
to follow the Go Style guide: https://blog.golang.org/godoc-documenting-go-code

Fixes: https://github.com/kubernetes/kops/issues/4007
This commit is contained in:
Aldo "xoen" Giambelluca 2017-12-15 11:48:10 +00:00
parent d533714aa8
commit 9e30999d06
9 changed files with 116 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/cluster_spec.md
View File

@ -137,8 +137,11 @@ spec:
oidcIssuerURL: https://your-oidc-provider.svc.cluster.local
oidcClientID: kubernetes
oidcUsernameClaim: sub
oidcUsernamePrefix: "oidc:"
oidcGroupsClaim: user_roles
oidcGroupsPrefix: "oidc:"
oidcCAFile: /etc/kubernetes/ssl/kc-ca.pem
```
#### audit logging

23
pkg/apis/kops/componentconfig.go
View File

@ -225,18 +225,29 @@ type KubeAPIServerConfig struct {
KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"`
// StorageBackend is the backend storage
StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"`
// The OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be unique and immutable.
// OIDCUsernameClaim is the OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be
// unique and immutable.
OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"`
// If provided, the name of a custom OpenID Connect claim for specifying user groups.
// OIDCUsernamePrefix is the prefix prepended to username claims to prevent
// clashes with existing names (such as 'system:' users).
OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"`
// OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for
// specifying user groups.
// The claim value is expected to be a string or array of strings.
OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"`
// The URL of the OpenID issuer, only HTTPS scheme will be accepted.
// OIDCGroupsPrefix is the prefix prepended to group claims to prevent
// clashes with existing names (such as 'system:' groups)
OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"`
// OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will
// be accepted.
// If set, it will be used to verify the OIDC JSON Web Token (JWT).
OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"`
// The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`
// The apiserver's client certificate used for outbound requests.
ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"`

23
pkg/apis/kops/v1alpha1/componentconfig.go
View File

@ -225,18 +225,29 @@ type KubeAPIServerConfig struct {
KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"`
// StorageBackend is the backend storage
StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"`
// The OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be unique and immutable.
// OIDCUsernameClaim is the OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be
// unique and immutable.
OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"`
// If provided, the name of a custom OpenID Connect claim for specifying user groups.
// OIDCUsernamePrefix is the prefix prepended to username claims to prevent
// clashes with existing names (such as 'system:' users).
OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"`
// OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for
// specifying user groups.
// The claim value is expected to be a string or array of strings.
OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"`
// The URL of the OpenID issuer, only HTTPS scheme will be accepted.
// OIDCGroupsPrefix is the prefix prepended to group claims to prevent
// clashes with existing names (such as 'system:' groups)
OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"`
// OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will
// be accepted.
// If set, it will be used to verify the OIDC JSON Web Token (JWT).
OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"`
// The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`
// The apiserver's client certificate used for outbound requests.
ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"`

4
pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View File

@ -1831,7 +1831,9 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes
out.StorageBackend = in.StorageBackend
out.OIDCUsernameClaim = in.OIDCUsernameClaim
out.OIDCUsernamePrefix = in.OIDCUsernamePrefix
out.OIDCGroupsClaim = in.OIDCGroupsClaim
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCCAFile = in.OIDCCAFile
@ -1890,7 +1892,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes
out.StorageBackend = in.StorageBackend
out.OIDCUsernameClaim = in.OIDCUsernameClaim
out.OIDCUsernamePrefix = in.OIDCUsernamePrefix
out.OIDCGroupsClaim = in.OIDCGroupsClaim
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCCAFile = in.OIDCCAFile

18
pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
View File

@ -1920,6 +1920,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCUsernamePrefix != nil {
in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCGroupsClaim != nil {
in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim
if *in == nil {
@ -1929,6 +1938,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCGroupsPrefix != nil {
in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCIssuerURL != nil {
in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL
if *in == nil {

23
pkg/apis/kops/v1alpha2/componentconfig.go
View File

@ -225,18 +225,29 @@ type KubeAPIServerConfig struct {
KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"`
// StorageBackend is the backend storage
StorageBackend *string `json:"storageBackend,omitempty" flag:"storage-backend"`
// The OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be unique and immutable.
// OIDCUsernameClaim is the OpenID claim to use as the user name.
// Note that claims other than the default ('sub') is not guaranteed to be
// unique and immutable.
OIDCUsernameClaim *string `json:"oidcUsernameClaim,omitempty" flag:"oidc-username-claim"`
// If provided, the name of a custom OpenID Connect claim for specifying user groups.
// OIDCUsernamePrefix is the prefix prepended to username claims to prevent
// clashes with existing names (such as 'system:' users).
OIDCUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" flag:"oidc-username-prefix"`
// OIDCGroupsClaim if provided, the name of a custom OpenID Connect claim for
// specifying user groups.
// The claim value is expected to be a string or array of strings.
OIDCGroupsClaim *string `json:"oidcGroupsClaim,omitempty" flag:"oidc-groups-claim"`
// The URL of the OpenID issuer, only HTTPS scheme will be accepted.
// OIDCGroupsPrefix is the prefix prepended to group claims to prevent
// clashes with existing names (such as 'system:' groups)
OIDCGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" flag:"oidc-groups-prefix"`
// OIDCIssuerURL is the URL of the OpenID issuer, only HTTPS scheme will
// be accepted.
// If set, it will be used to verify the OIDC JSON Web Token (JWT).
OIDCIssuerURL *string `json:"oidcIssuerURL,omitempty" flag:"oidc-issuer-url"`
// The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`
// The apiserver's client certificate used for outbound requests.
ProxyClientCertFile *string `json:"proxyClientCertFile,omitempty" flag:"proxy-client-cert-file"`

4
pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View File

@ -2093,7 +2093,9 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes
out.StorageBackend = in.StorageBackend
out.OIDCUsernameClaim = in.OIDCUsernameClaim
out.OIDCUsernamePrefix = in.OIDCUsernamePrefix
out.OIDCGroupsClaim = in.OIDCGroupsClaim
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCCAFile = in.OIDCCAFile
@ -2152,7 +2154,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
out.KubeletPreferredAddressTypes = in.KubeletPreferredAddressTypes
out.StorageBackend = in.StorageBackend
out.OIDCUsernameClaim = in.OIDCUsernameClaim
out.OIDCUsernamePrefix = in.OIDCUsernamePrefix
out.OIDCGroupsClaim = in.OIDCGroupsClaim
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCCAFile = in.OIDCCAFile

18
pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
View File

@ -2046,6 +2046,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCUsernamePrefix != nil {
in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCGroupsClaim != nil {
in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim
if *in == nil {
@ -2055,6 +2064,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCGroupsPrefix != nil {
in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCIssuerURL != nil {
in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL
if *in == nil {

18
pkg/apis/kops/zz_generated.deepcopy.go
View File

@ -2265,6 +2265,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCUsernamePrefix != nil {
in, out := &in.OIDCUsernamePrefix, &out.OIDCUsernamePrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCGroupsClaim != nil {
in, out := &in.OIDCGroupsClaim, &out.OIDCGroupsClaim
if *in == nil {
@ -2274,6 +2283,15 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
**out = **in
}
}
if in.OIDCGroupsPrefix != nil {
in, out := &in.OIDCGroupsPrefix, &out.OIDCGroupsPrefix
if *in == nil {
*out = nil
} else {
*out = new(string)
**out = **in
}
}
if in.OIDCIssuerURL != nil {
in, out := &in.OIDCIssuerURL, &out.OIDCIssuerURL
if *in == nil {