Skip to content

Commit 03e754b

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4334 from shraddhabang/gwrulesauthcfgoidc
[feat gw api] Add authenticate oidc action support for L7 gateway
2 parents 7cba312 + 65f7ddf commit 03e754b

37 files changed

+2523
-340
lines changed

‎apis/gateway/v1beta1/listenerruleconfig_types.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -116,12 +116,10 @@ type FixedResponseActionConfig struct {
116116
MessageBody *string `json:"messageBody,omitempty"`
117117
}
118118

119-
// Secret holds OAuth 2.0 clientID and clientSecret. You need to create this secret and provide its name and namespace
119+
// Secret holds OAuth 2.0 clientID and clientSecret. You need to create this secret and provide its name
120120
type Secret struct {
121121
// Name is name of the secret
122122
Name string `json:"name"`
123-
// Namespace is namespace of secret. If empty it will be considered to be in same namespace as of the resource referring it
124-
Namespace *string `json:"namespace,omitempty"`
125123
}
126124

127125
// Information about an authenticate-cognito action
@@ -220,7 +218,7 @@ type AuthenticateOidcActionConfig struct {
220218
// +kubebuilder:default=604800
221219
// +kubebuilder:validation:Minimum=1
222220
// +kubebuilder:validation:Maximum=604800
223-
SessionTimeout *int32 `json:"sessionTimeout,omitempty"`
221+
SessionTimeout *int64 `json:"sessionTimeout,omitempty"`
224222

225223
// Indicates whether to use the existing client secret when modifying a listener rule. If
226224
// you are creating a listener rule, you can omit this parameter or set it to false.
@@ -294,10 +292,17 @@ type ListenerRuleConfigurationSpec struct {
294292

295293
// ListenerRuleConfigurationStatus defines the observed state of ListenerRuleConfiguration
296294
type ListenerRuleConfigurationStatus struct {
297-
298295
// The observed generation of the rule configuration
299296
// +optional
300297
ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
298+
299+
// Accepted indicates whether ListenerRuleConfiguration is valid
300+
// +optional
301+
Accepted *bool `json:"accepted,omitempty"`
302+
303+
// Message provides details about the current state
304+
// +optional
305+
Message *string `json:"message,omitempty"`
301306
}
302307

303308
// +kubebuilder:object:root=true

‎apis/gateway/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 12 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/gateway/gateway-crds.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -166,11 +166,6 @@ spec:
166166
name:
167167
description: Name is name of the secret
168168
type: string
169-
namespace:
170-
description: Namespace is namespace of secret. If empty
171-
it will be considered to be in same namespace as of
172-
the resource referring it
173-
type: string
174169
required:
175170
- name
176171
type: object
@@ -185,7 +180,7 @@ spec:
185180
description: |-
186181
The maximum duration of the authentication session, in seconds. The default is
187182
604800 seconds (7 days).
188-
format: int32
183+
format: int64
189184
maximum: 604800
190185
minimum: 1
191186
type: integer
@@ -377,6 +372,13 @@ spec:
377372
description: ListenerRuleConfigurationStatus defines the observed state
378373
of ListenerRuleConfiguration
379374
properties:
375+
accepted:
376+
description: Accepted indicates whether ListenerRuleConfiguration
377+
is valid
378+
type: boolean
379+
message:
380+
description: Message provides details about the current state
381+
type: string
380382
observedGeneration:
381383
description: The observed generation of the rule configuration
382384
format: int64

‎config/crd/gateway/gateway.k8s.aws_listenerruleconfigurations.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -167,11 +167,6 @@ spec:
167167
name:
168168
description: Name is name of the secret
169169
type: string
170-
namespace:
171-
description: Namespace is namespace of secret. If empty
172-
it will be considered to be in same namespace as of
173-
the resource referring it
174-
type: string
175170
required:
176171
- name
177172
type: object
@@ -186,7 +181,7 @@ spec:
186181
description: |-
187182
The maximum duration of the authentication session, in seconds. The default is
188183
604800 seconds (7 days).
189-
format: int32
184+
format: int64
190185
maximum: 604800
191186
minimum: 1
192187
type: integer
@@ -378,6 +373,13 @@ spec:
378373
description: ListenerRuleConfigurationStatus defines the observed state
379374
of ListenerRuleConfiguration
380375
properties:
376+
accepted:
377+
description: Accepted indicates whether ListenerRuleConfiguration
378+
is valid
379+
type: boolean
380+
message:
381+
description: Message provides details about the current state
382+
type: string
381383
observedGeneration:
382384
description: The observed generation of the rule configuration
383385
format: int64

‎controllers/gateway/eventhandlers/secret_events.go‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
package eventhandlers
2+
3+
import (
4+
"context"
5+
elbv2gw "sigs.k8s.io/aws-load-balancer-controller/apis/gateway/v1beta1"
6+
"sigs.k8s.io/aws-load-balancer-controller/pkg/gateway/routeutils"
7+
"sigs.k8s.io/controller-runtime/pkg/reconcile"
8+
9+
"github.com/go-logr/logr"
10+
corev1 "k8s.io/api/core/v1"
11+
"k8s.io/apimachinery/pkg/api/equality"
12+
"k8s.io/client-go/tools/record"
13+
"k8s.io/client-go/util/workqueue"
14+
"sigs.k8s.io/aws-load-balancer-controller/pkg/k8s"
15+
"sigs.k8s.io/controller-runtime/pkg/client"
16+
"sigs.k8s.io/controller-runtime/pkg/event"
17+
"sigs.k8s.io/controller-runtime/pkg/handler"
18+
)
19+
20+
// NewEnqueueRequestsForSecretEvent constructs new enqueueRequestsForSecretEvent.
21+
func NewEnqueueRequestsForSecretEvent(listenerRuleConfigEventChan chan<- event.TypedGenericEvent[*elbv2gw.ListenerRuleConfiguration],
22+
k8sClient client.Client, eventRecorder record.EventRecorder, logger logr.Logger) handler.TypedEventHandler[*corev1.Secret, reconcile.Request] {
23+
return &enqueueRequestsForSecretEvent{
24+
listenerRuleConfigEventChan: listenerRuleConfigEventChan,
25+
k8sClient: k8sClient,
26+
eventRecorder: eventRecorder,
27+
logger: logger,
28+
}
29+
}
30+
31+
var _ handler.TypedEventHandler[*corev1.Secret, reconcile.Request] = (*enqueueRequestsForSecretEvent)(nil)
32+
33+
type enqueueRequestsForSecretEvent struct {
34+
listenerRuleConfigEventChan chan<- event.TypedGenericEvent[*elbv2gw.ListenerRuleConfiguration]
35+
k8sClient client.Client
36+
eventRecorder record.EventRecorder
37+
logger logr.Logger
38+
}
39+
40+
func (h *enqueueRequestsForSecretEvent) Create(ctx context.Context, e event.TypedCreateEvent[*corev1.Secret], _ workqueue.TypedRateLimitingInterface[reconcile.Request]) {
41+
//No-Op : We will only start monitoring secret events after they have been created and associated with gateway specific resources. We don't watch cluster-wide secret events.
42+
}
43+
44+
func (h *enqueueRequestsForSecretEvent) Update(ctx context.Context, e event.TypedUpdateEvent[*corev1.Secret], _ workqueue.TypedRateLimitingInterface[reconcile.Request]) {
45+
secretOld := e.ObjectOld
46+
secretNew := e.ObjectNew
47+
48+
// we only care below update event:
49+
// 1. Secret data updates
50+
// 2. Secret deletions
51+
if equality.Semantic.DeepEqual(secretOld.Data, secretNew.Data) &&
52+
equality.Semantic.DeepEqual(secretOld.DeletionTimestamp.IsZero(), secretNew.DeletionTimestamp.IsZero()) {
53+
return
54+
}
55+
h.logger.V(1).Info("enqueue secret update event", "secret", secretNew.Name)
56+
h.enqueueImpactedListenerRulesConfigs(ctx, secretNew)
57+
}
58+
59+
func (h *enqueueRequestsForSecretEvent) Delete(ctx context.Context, e event.TypedDeleteEvent[*corev1.Secret], _ workqueue.TypedRateLimitingInterface[reconcile.Request]) {
60+
secretOld := e.Object
61+
h.logger.V(1).Info("enqueue secret delete event", "secret", secretOld.Name)
62+
h.enqueueImpactedListenerRulesConfigs(ctx, secretOld)
63+
}
64+
65+
func (h *enqueueRequestsForSecretEvent) Generic(ctx context.Context, e event.TypedGenericEvent[*corev1.Secret], _ workqueue.TypedRateLimitingInterface[reconcile.Request]) {
66+
secretObj := e.Object
67+
h.logger.V(1).Info("enqueue secret generic event", "secret", secretObj.Name)
68+
h.enqueueImpactedListenerRulesConfigs(ctx, secretObj)
69+
}
70+
71+
func (h *enqueueRequestsForSecretEvent) enqueueImpactedListenerRulesConfigs(ctx context.Context, secret *corev1.Secret) {
72+
listenerRuleCfgList, err := routeutils.FilterListenerRuleConfigBySecret(ctx, h.k8sClient, secret)
73+
if err != nil {
74+
h.logger.Error(err, "failed to fetch listener rule configs referring to secret", "secret", k8s.NamespacedName(secret))
75+
return
76+
}
77+
78+
for _, listenerRuleCfg := range listenerRuleCfgList {
79+
h.logger.V(1).Info("enqueue listenerRuleCfg for secret event",
80+
"secret", k8s.NamespacedName(secret),
81+
"listenerRuleCfg", k8s.NamespacedName(listenerRuleCfg))
82+
h.listenerRuleConfigEventChan <- event.TypedGenericEvent[*elbv2gw.ListenerRuleConfiguration]{
83+
Object: listenerRuleCfg,
84+
}
85+
}
86+
}

‎controllers/gateway/gateway_class_controller.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"github.com/go-logr/logr"
77
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
88
"k8s.io/apimachinery/pkg/util/sets"
9+
"k8s.io/client-go/kubernetes"
910
"k8s.io/client-go/tools/record"
1011
elbv2gw "sigs.k8s.io/aws-load-balancer-controller/apis/gateway/v1beta1"
1112
gatewayclasseventhandlers "sigs.k8s.io/aws-load-balancer-controller/controllers/gateway/eventhandlers/gatewayclass"
@@ -62,7 +63,7 @@ type gatewayClassReconciler struct {
6263
gatewayResolverFn func(ctx context.Context, k8sClient client.Client, gwClass *gwv1.GatewayClass) ([]*gwv1.Gateway, error)
6364
}
6465

65-
func (r *gatewayClassReconciler) SetupWatches(_ context.Context, ctrl controller.Controller, mgr ctrl.Manager) error {
66+
func (r *gatewayClassReconciler) SetupWatches(_ context.Context, ctrl controller.Controller, mgr ctrl.Manager, _ *kubernetes.Clientset) error {
6667

6768
gwClassEventChan := make(chan event.TypedGenericEvent[*gwv1.GatewayClass])
6869
lbEventHandler := gatewayclasseventhandlers.NewEnqueueRequestsForLoadBalancerConfigurationEvent(gwClassEventChan, r.k8sClient, r.eventRecorder, r.enabledControllers, r.logger)

0 commit comments

Comments
 (0)