Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crd: add runtimeFlags (#1010) #1012

Merged
merged 1 commit into from
Jul 11, 2024
Merged

crd: add runtimeFlags (#1010) #1012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 39 additions & 36 deletions apis/ingress/v1/pomerium_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,16 +186,16 @@ type Cookie struct {

// PomeriumSpec defines Pomerium-specific configuration parameters.
type PomeriumSpec struct {
// AccessLogFields sets the <a href="https://www.pomerium.com/docs/reference/access-log-fields">access fields</a> to log.
AccessLogFields *[]string `json:"accessLogFields,omitempty"`

// Authenticate sets authenticate service parameters.
// If not specified, a Pomerium-hosted authenticate service would be used.
// +kubebuilder:validation:Optional
Authenticate *Authenticate `json:"authenticate"`

// IdentityProvider configure single-sign-on authentication and user identity details
// by integrating with your <a href="https://www.pomerium.com/docs/identity-providers/">Identity Provider</a>
//
// +kubebuilder:validation:Optional
IdentityProvider *IdentityProvider `json:"identityProvider"`
// AuthorizeLogFields sets the <a href="https://www.pomerium.com/docs/reference/authorize-log-fields">authorize fields</a> to log.
AuthorizeLogFields *[]string `json:"authorizeLogFields,omitempty"`

// Certificates is a list of secrets of type TLS to use
// +kubebuilder:validation:Format="namespace/name"
Expand All @@ -206,6 +206,35 @@ type PomeriumSpec struct {
// +optional
CASecrets []string `json:"caSecrets"`

// Cookie defines Pomerium session cookie options.
// +optional
Cookie *Cookie `json:"cookie,omitempty"`

// IdentityProvider configure single-sign-on authentication and user identity details
// by integrating with your <a href="https://www.pomerium.com/docs/identity-providers/">Identity Provider</a>
//
// +kubebuilder:validation:Optional
IdentityProvider *IdentityProvider `json:"identityProvider"`

// JWTClaimHeaders convert claims from the assertion token
// into HTTP headers and adds them into JWT assertion header.
// Please make sure to read
// <a href="https://www.pomerium.com/docs/topics/getting-users-identity">
// Getting User Identity</a> guide.
//
// +optional
JWTClaimHeaders map[string]string `json:"jwtClaimHeaders,omitempty"`

// PassIdentityHeaders sets the <a href="https://www.pomerium.com/docs/reference/pass-identity-headers">pass identity headers</a> option.
PassIdentityHeaders *bool `json:"passIdentityHeaders,omitempty"`

// ProgrammaticRedirectDomains specifies a list of domains that can be used for
// <a href="https://www.pomerium.com/docs/capabilities/programmatic-access">programmatic redirects</a>.
ProgrammaticRedirectDomains []string `json:"programmaticRedirectDomains,omitempty"`

// RuntimeFlags sets the <a href="https://www.pomerium.com/docs/reference/runtime-flags">runtime flags</a> to enable/disable certain features.
RuntimeFlags map[string]bool `json:"runtimeFlags,omitempty"`

// Secrets references a Secret with Pomerium bootstrap parameters.
//
// <p>
Expand Down Expand Up @@ -237,49 +266,23 @@ type PomeriumSpec struct {
// +kubebuilder:validation:Format="namespace/name"
Secrets string `json:"secrets"`

// SetResponseHeaders specifies a mapping of HTTP Header to be added globally to all managed routes and pomerium's authenticate service.
// +optional
// See <a href="https://www.pomerium.com/docs/reference/set-response-headers">Set Response Headers</a>
SetResponseHeaders map[string]string `json:"setResponseHeaders,omitempty"`

// Storage defines persistent storage for sessions and other data.
// See <a href="https://www.pomerium.com/docs/topics/data-storage">Storage</a> for details.
// If no storage is specified, Pomerium would use a transient in-memory storage (not recommended for production).
//
// +kubebuilder:validation:Optional
Storage *Storage `json:"storage,omitempty"`

// Cookie defines Pomerium session cookie options.
// +optional
Cookie *Cookie `json:"cookie,omitempty"`

// JWTClaimHeaders convert claims from the assertion token
// into HTTP headers and adds them into JWT assertion header.
// Please make sure to read
// <a href="https://www.pomerium.com/docs/topics/getting-users-identity">
// Getting User Identity</a> guide.
//
// +optional
JWTClaimHeaders map[string]string `json:"jwtClaimHeaders,omitempty"`

// SetResponseHeaders specifies a mapping of HTTP Header to be added globally to all managed routes and pomerium's authenticate service.
// +optional
// See <a href="https://www.pomerium.com/docs/reference/set-response-headers">Set Response Headers</a>
SetResponseHeaders map[string]string `json:"setResponseHeaders,omitempty"`

// ProgrammaticRedirectDomains specifies a list of domains that can be used for
// <a href="https://www.pomerium.com/docs/capabilities/programmatic-access">programmatic redirects</a>.
ProgrammaticRedirectDomains []string `json:"programmaticRedirectDomains,omitempty"`

// Timeout specifies the <a href="https://www.pomerium.com/docs/reference/global-timeouts">global timeouts</a> for all routes.
Timeouts *Timeouts `json:"timeouts,omitempty"`

// UseProxyProtocol enables <a href="https://www.pomerium.com/docs/reference/use-proxy-protocol">Proxy Protocol</a> support.
UseProxyProtocol *bool `json:"useProxyProtocol,omitempty"`

// AccessLogFields sets the <a href="https://www.pomerium.com/docs/reference/access-log-fields">access fields</a> to log.
AccessLogFields *[]string `json:"accessLogFields,omitempty"`

// AuthorizeLogFields sets the <a href="https://www.pomerium.com/docs/reference/authorize-log-fields">authorize fields</a> to log.
AuthorizeLogFields *[]string `json:"authorizeLogFields,omitempty"`

// PassIdentityHeaders sets the <a href="https://www.pomerium.com/docs/reference/pass-identity-headers">pass identity headers</a> option.
PassIdentityHeaders *bool `json:"passIdentityHeaders,omitempty"`
}

// Timeouts allows to configure global timeouts for all routes.
Expand Down
79 changes: 43 additions & 36 deletions apis/ingress/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions config/crd/bases/ingress.pomerium.io_pomerium.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,12 @@ spec:
items:
type: string
type: array
runtimeFlags:
additionalProperties:
type: boolean
description: RuntimeFlags sets the <a href="https://www.pomerium.com/docs/reference/runtime-flags">runtime
flags</a> to enable/disable certain features.
type: object
secrets:
description: "Secrets references a Secret with Pomerium bootstrap
parameters.\n\n\n<p>\n<ul>\n\t<li><a href=\"https://pomerium.com/docs/reference/shared-secret\"><code>shared_secret</code></a>\n\t\t-
Expand Down
6 changes: 6 additions & 0 deletions deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,12 @@ spec:
items:
type: string
type: array
runtimeFlags:
additionalProperties:
type: boolean
description: RuntimeFlags sets the <a href="https://www.pomerium.com/docs/reference/runtime-flags">runtime
flags</a> to enable/disable certain features.
type: object
secrets:
description: "Secrets references a Secret with Pomerium bootstrap
parameters.\n\n\n<p>\n<ul>\n\t<li><a href=\"https://pomerium.com/docs/reference/shared-secret\"><code>shared_secret</code></a>\n\t\t-
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ require (
github.com/iancoleman/strcase v0.3.0
github.com/martinlindhe/base36 v1.1.1
github.com/open-policy-agent/opa v0.64.1
github.com/pomerium/csrf v1.7.0
github.com/pomerium/pomerium v0.26.1
github.com/rs/zerolog v1.32.0
github.com/sergi/go-diff v1.3.1
Expand Down Expand Up @@ -154,7 +155,6 @@ require (
github.com/philhofer/fwd v1.0.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/pomerium/csrf v1.7.0 // indirect
github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524 // indirect
github.com/pomerium/webauthn v0.0.0-20240603205124-0428df511172 // indirect
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
Expand Down
11 changes: 11 additions & 0 deletions pomerium/ctrl/bootstrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ func Apply(ctx context.Context, dst *config.Options, src *model.Config) error {
{"authenticate", applyAuthenticate},
{"secrets", applySecrets},
{"storage", applyStorage},
{"runtime flags", applyRuntimeFlags},
} {
if err := apply.fn(ctx, dst, src); err != nil {
return fmt.Errorf("%s: %w", apply.name, err)
Expand Down Expand Up @@ -66,6 +67,16 @@ func applyAuthenticate(_ context.Context, dst *config.Options, src *model.Config
return nil
}

func applyRuntimeFlags(_ context.Context, dst *config.Options, src *model.Config) error {
dst.RuntimeFlags = config.DefaultRuntimeFlags()

for k, v := range src.Spec.RuntimeFlags {
dst.RuntimeFlags[config.RuntimeFlag(k)] = v
}

return nil
}

func applyStorage(ctx context.Context, dst *config.Options, src *model.Config) error {
if err := storageFiles.DeleteFiles(); err != nil {
log.FromContext(ctx).V(1).Error(err, "failed to delete existing files")
Expand Down
Loading