kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6453 from jeyglk/feature/add-oidc-required-claim-flag 

kube-apiserver: Add oidc-required-claim flag
This commit is contained in:
Kubernetes Prow Robot 2019-02-18 09:38:48 -08:00 committed by GitHub
parent 53189d7e6b 893742fb32
commit c243adc4e7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
9 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/cluster_spec.md
View File

@ -198,7 +198,8 @@ spec:
oidcGroupsClaim: user_roles
oidcGroupsPrefix: "oidc:"
oidcCAFile: /etc/kubernetes/ssl/kc-ca.pem
oidcRequiredClaim:
- "key=value"
```
#### audit logging

4
pkg/apis/kops/componentconfig.go
View File

@ -318,6 +318,10 @@ type KubeAPIServerConfig struct {
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// A key=value pair that describes a required claim in the ID Token.
// If set, the claim is verified to be present in the ID Token with a matching value.
// Repeat this flag to specify multiple claims.
OIDCRequiredClaim []string `json:"oidcRequiredClaim,omitempty" flag:"oidc-required-claim,repeat"`
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`

4
pkg/apis/kops/v1alpha1/componentconfig.go
View File

@ -318,6 +318,10 @@ type KubeAPIServerConfig struct {
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// A key=value pair that describes a required claim in the ID Token.
// If set, the claim is verified to be present in the ID Token with a matching value.
// Repeat this flag to specify multiple claims.
OIDCRequiredClaim []string `json:"oidcRequiredClaim,omitempty" flag:"oidc-required-claim,repeat"`
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`

2
pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View File

@ -2911,6 +2911,7 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCRequiredClaim = in.OIDCRequiredClaim
out.OIDCCAFile = in.OIDCCAFile
out.ProxyClientCertFile = in.ProxyClientCertFile
out.ProxyClientKeyFile = in.ProxyClientKeyFile
@ -2985,6 +2986,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCRequiredClaim = in.OIDCRequiredClaim
out.OIDCCAFile = in.OIDCCAFile
out.ProxyClientCertFile = in.ProxyClientCertFile
out.ProxyClientKeyFile = in.ProxyClientKeyFile

5
pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
View File

@ -1644,6 +1644,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.OIDCRequiredClaim != nil {
in, out := &in.OIDCRequiredClaim, &out.OIDCRequiredClaim
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.OIDCCAFile != nil {
in, out := &in.OIDCCAFile, &out.OIDCCAFile
*out = new(string)

4
pkg/apis/kops/v1alpha2/componentconfig.go
View File

@ -318,6 +318,10 @@ type KubeAPIServerConfig struct {
// OIDCClientID is the client ID for the OpenID Connect client, must be set
// if oidc-issuer-url is set.
OIDCClientID *string `json:"oidcClientID,omitempty" flag:"oidc-client-id"`
// A key=value pair that describes a required claim in the ID Token.
// If set, the claim is verified to be present in the ID Token with a matching value.
// Repeat this flag to specify multiple claims.
OIDCRequiredClaim []string `json:"oidcRequiredClaim,omitempty" flag:"oidc-required-claim,repeat"`
// OIDCCAFile if set, the OpenID server's certificate will be verified by one
// of the authorities in the oidc-ca-file
OIDCCAFile *string `json:"oidcCAFile,omitempty" flag:"oidc-ca-file"`

2
pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View File

@ -3181,6 +3181,7 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCRequiredClaim = in.OIDCRequiredClaim
out.OIDCCAFile = in.OIDCCAFile
out.ProxyClientCertFile = in.ProxyClientCertFile
out.ProxyClientKeyFile = in.ProxyClientKeyFile
@ -3255,6 +3256,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
out.OIDCGroupsPrefix = in.OIDCGroupsPrefix
out.OIDCIssuerURL = in.OIDCIssuerURL
out.OIDCClientID = in.OIDCClientID
out.OIDCRequiredClaim = in.OIDCRequiredClaim
out.OIDCCAFile = in.OIDCCAFile
out.ProxyClientCertFile = in.ProxyClientCertFile
out.ProxyClientKeyFile = in.ProxyClientKeyFile

5
pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
View File

@ -1715,6 +1715,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.OIDCRequiredClaim != nil {
in, out := &in.OIDCRequiredClaim, &out.OIDCRequiredClaim
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.OIDCCAFile != nil {
in, out := &in.OIDCCAFile, &out.OIDCCAFile
*out = new(string)

5
pkg/apis/kops/zz_generated.deepcopy.go
View File

@ -1897,6 +1897,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = new(string)
**out = **in
}
if in.OIDCRequiredClaim != nil {
in, out := &in.OIDCRequiredClaim, &out.OIDCRequiredClaim
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.OIDCCAFile != nil {
in, out := &in.OIDCCAFile, &out.OIDCCAFile
*out = new(string)