Skip to content

Commit 7a003d4

Browse files
DEiseltjschoone
DEiselt
and
jschoone
authored
Make kube-apiserver oidc flags configurable (#84)
* added: make oidc flags configurable Signed-off-by: Danny Eiselt <[email protected]> * feat(oidc-config): copy config to all versions; add upstream descriptions Signed-off-by: Jan Schoone <[email protected]> --------- Signed-off-by: Danny Eiselt <[email protected]> Signed-off-by: Jan Schoone <[email protected]> Co-authored-by: Jan Schoone <[email protected]>
1 parent 9dc3701 commit 7a003d4

File tree

4 files changed

+412
-0
lines changed

4 files changed

+412
-0
lines changed

‎providers/openstack/alpha/1-27/cluster-class/templates/cluster-class.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,82 @@ spec:
158158
default: ""
159159
example: "capi-keypair"
160160
description: "The ssh key to inject in the nodes."
161+
- name: certSANs
162+
required: false
163+
schema:
164+
openAPIV3Schema:
165+
type: array
166+
default: []
167+
example: ["mydomain.example"]
168+
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
169+
items:
170+
type: string
171+
- name: oidc_config
172+
required: false
173+
schema:
174+
openAPIV3Schema:
175+
type: object
176+
properties:
177+
client_id:
178+
type: string
179+
example: "kubectl"
180+
description: "A client id that all tokens must be issued for."
181+
issuer_url:
182+
type: string
183+
example: "https://dex.k8s.scs.community"
184+
description: "URL of the provider that allows the API server to
185+
discover public signing keys. Only URLs that use the https:// scheme are
186+
accepted. This is typically the provider's discovery URL, changed to have an
187+
empty path"
188+
username_claim:
189+
type: string
190+
example: "preferred_username"
191+
default: "sub"
192+
description: "JWT claim to use as the user name. By default sub,
193+
which is expected to be a unique identifier of the end user. Admins can choose
194+
other claims, such as email or name, depending on their provider. However,
195+
claims other than email will be prefixed with the issuer URL to prevent naming
196+
clashes with other plugins."
197+
groups_claim:
198+
type: string
199+
example: "groups"
200+
default: "groups"
201+
description: "JWT claim to use as the user's group. If the claim
202+
is present it must be an array of strings."
203+
username_prefix:
204+
type: string
205+
example: "oidc:"
206+
default: "oidc:"
207+
description: "Prefix prepended to username claims to prevent
208+
clashes with existing names (such as system: users). For example, the value
209+
oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and
210+
--oidc-username-claim is a value other than email the prefix defaults to (
211+
Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value
212+
- can be used to disable all prefixing."
213+
groups_prefix:
214+
type: string
215+
example: "oidc:"
216+
default: "oidc:"
217+
description: "Prefix prepended to group claims to prevent clashes
218+
with existing names (such as system: groups). For example, the value oidc: will
219+
create group names like oidc:engineering and oidc:infra."
161220
patches:
221+
- name: k8s_version
222+
description: "Sets the openstack node image for workers and the controlplane to the cluster-api image with the version mentioned in spec.topology.version."
223+
definitions:
224+
- selector:
225+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
226+
kind: OpenStackMachineTemplate
227+
matchResources:
228+
controlPlane: true
229+
machineDeploymentClass:
230+
names:
231+
- {{ .Release.Name }}-{{ .Chart.Version }}
232+
jsonPatches:
233+
- op: replace
234+
path: "/spec/template/spec/image/filter/name"
235+
valueFrom:
236+
template: ubuntu-capi-image-{{ `{{ .builtin.cluster.topology.version }}` }}
162237
- name: controller_flavor
163238
description: "Sets the openstack instance flavor for the KubeadmControlPlane."
164239
enabledIf: {{ `'{{ ne .controller_flavor "" }}'` }}
@@ -413,3 +488,51 @@ spec:
413488
path: "/spec/template/spec/sshKeyName"
414489
valueFrom:
415490
variable: ssh_key
491+
- name: certSANs
492+
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
493+
enabledIf: {{ `"{{ if .certSANs }}true{{end}}"` }}
494+
definitions:
495+
- selector:
496+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
497+
kind: KubeadmControlPlaneTemplate
498+
matchResources:
499+
controlPlane: true
500+
jsonPatches:
501+
- op: add
502+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/certSANs"
503+
valueFrom:
504+
variable: certSANs
505+
- name: oidc_config
506+
description: "Configure API Server to use external authentication service."
507+
enabledIf: {{ `"{{ if and .oidc_config .oidc_config.client_id .oidc_config.issuer_url }}true{{end}}"` }}
508+
definitions:
509+
- selector:
510+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
511+
kind: KubeadmControlPlaneTemplate
512+
matchResources:
513+
controlPlane: true
514+
jsonPatches:
515+
- op: add
516+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-client-id"
517+
valueFrom:
518+
variable: oidc_config.client_id
519+
- op: add
520+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-issuer-url"
521+
valueFrom:
522+
variable: oidc_config.issuer_url
523+
- op: add
524+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-claim"
525+
valueFrom:
526+
variable: oidc_config.username_claim
527+
- op: add
528+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-claim"
529+
valueFrom:
530+
variable: oidc_config.groups_claim
531+
- op: add
532+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-prefix"
533+
valueFrom:
534+
variable: oidc_config.username_prefix
535+
- op: add
536+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-prefix"
537+
valueFrom:
538+
variable: oidc_config.groups_prefix

‎providers/openstack/alpha/1-28/cluster-class/templates/cluster-class.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,82 @@ spec:
158158
default: ""
159159
example: "capi-keypair"
160160
description: "The ssh key to inject in the nodes."
161+
- name: certSANs
162+
required: false
163+
schema:
164+
openAPIV3Schema:
165+
type: array
166+
default: []
167+
example: ["mydomain.example"]
168+
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
169+
items:
170+
type: string
171+
- name: oidc_config
172+
required: false
173+
schema:
174+
openAPIV3Schema:
175+
type: object
176+
properties:
177+
client_id:
178+
type: string
179+
example: "kubectl"
180+
description: "A client id that all tokens must be issued for."
181+
issuer_url:
182+
type: string
183+
example: "https://dex.k8s.scs.community"
184+
description: "URL of the provider that allows the API server to
185+
discover public signing keys. Only URLs that use the https:// scheme are
186+
accepted. This is typically the provider's discovery URL, changed to have an
187+
empty path"
188+
username_claim:
189+
type: string
190+
example: "preferred_username"
191+
default: "sub"
192+
description: "JWT claim to use as the user name. By default sub,
193+
which is expected to be a unique identifier of the end user. Admins can choose
194+
other claims, such as email or name, depending on their provider. However,
195+
claims other than email will be prefixed with the issuer URL to prevent naming
196+
clashes with other plugins."
197+
groups_claim:
198+
type: string
199+
example: "groups"
200+
default: "groups"
201+
description: "JWT claim to use as the user's group. If the claim
202+
is present it must be an array of strings."
203+
username_prefix:
204+
type: string
205+
example: "oidc:"
206+
default: "oidc:"
207+
description: "Prefix prepended to username claims to prevent
208+
clashes with existing names (such as system: users). For example, the value
209+
oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and
210+
--oidc-username-claim is a value other than email the prefix defaults to (
211+
Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value
212+
- can be used to disable all prefixing."
213+
groups_prefix:
214+
type: string
215+
example: "oidc:"
216+
default: "oidc:"
217+
description: "Prefix prepended to group claims to prevent clashes
218+
with existing names (such as system: groups). For example, the value oidc: will
219+
create group names like oidc:engineering and oidc:infra."
161220
patches:
221+
- name: k8s_version
222+
description: "Sets the openstack node image for workers and the controlplane to the cluster-api image with the version mentioned in spec.topology.version."
223+
definitions:
224+
- selector:
225+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
226+
kind: OpenStackMachineTemplate
227+
matchResources:
228+
controlPlane: true
229+
machineDeploymentClass:
230+
names:
231+
- {{ .Release.Name }}-{{ .Chart.Version }}
232+
jsonPatches:
233+
- op: replace
234+
path: "/spec/template/spec/image/filter/name"
235+
valueFrom:
236+
template: ubuntu-capi-image-{{ `{{ .builtin.cluster.topology.version }}` }}
162237
- name: controller_flavor
163238
description: "Sets the openstack instance flavor for the KubeadmControlPlane."
164239
enabledIf: {{ `'{{ ne .controller_flavor "" }}'` }}
@@ -413,3 +488,51 @@ spec:
413488
path: "/spec/template/spec/sshKeyName"
414489
valueFrom:
415490
variable: ssh_key
491+
- name: certSANs
492+
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
493+
enabledIf: {{ `"{{ if .certSANs }}true{{end}}"` }}
494+
definitions:
495+
- selector:
496+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
497+
kind: KubeadmControlPlaneTemplate
498+
matchResources:
499+
controlPlane: true
500+
jsonPatches:
501+
- op: add
502+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/certSANs"
503+
valueFrom:
504+
variable: certSANs
505+
- name: oidc_config
506+
description: "Configure API Server to use external authentication service."
507+
enabledIf: {{ `"{{ if and .oidc_config .oidc_config.client_id .oidc_config.issuer_url }}true{{end}}"` }}
508+
definitions:
509+
- selector:
510+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
511+
kind: KubeadmControlPlaneTemplate
512+
matchResources:
513+
controlPlane: true
514+
jsonPatches:
515+
- op: add
516+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-client-id"
517+
valueFrom:
518+
variable: oidc_config.client_id
519+
- op: add
520+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-issuer-url"
521+
valueFrom:
522+
variable: oidc_config.issuer_url
523+
- op: add
524+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-claim"
525+
valueFrom:
526+
variable: oidc_config.username_claim
527+
- op: add
528+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-claim"
529+
valueFrom:
530+
variable: oidc_config.groups_claim
531+
- op: add
532+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-prefix"
533+
valueFrom:
534+
variable: oidc_config.username_prefix
535+
- op: add
536+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-prefix"
537+
valueFrom:
538+
variable: oidc_config.groups_prefix

‎providers/openstack/alpha/1-29/cluster-class/templates/cluster-class.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,55 @@ spec:
168168
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
169169
items:
170170
type: string
171+
- name: oidc_config
172+
required: false
173+
schema:
174+
openAPIV3Schema:
175+
type: object
176+
properties:
177+
client_id:
178+
type: string
179+
example: "kubectl"
180+
description: "A client id that all tokens must be issued for."
181+
issuer_url:
182+
type: string
183+
example: "https://dex.k8s.scs.community"
184+
description: "URL of the provider that allows the API server to
185+
discover public signing keys. Only URLs that use the https:// scheme are
186+
accepted. This is typically the provider's discovery URL, changed to have an
187+
empty path"
188+
username_claim:
189+
type: string
190+
example: "preferred_username"
191+
default: "sub"
192+
description: "JWT claim to use as the user name. By default sub,
193+
which is expected to be a unique identifier of the end user. Admins can choose
194+
other claims, such as email or name, depending on their provider. However,
195+
claims other than email will be prefixed with the issuer URL to prevent naming
196+
clashes with other plugins."
197+
groups_claim:
198+
type: string
199+
example: "groups"
200+
default: "groups"
201+
description: "JWT claim to use as the user's group. If the claim
202+
is present it must be an array of strings."
203+
username_prefix:
204+
type: string
205+
example: "oidc:"
206+
default: "oidc:"
207+
description: "Prefix prepended to username claims to prevent
208+
clashes with existing names (such as system: users). For example, the value
209+
oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and
210+
--oidc-username-claim is a value other than email the prefix defaults to (
211+
Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value
212+
- can be used to disable all prefixing."
213+
groups_prefix:
214+
type: string
215+
example: "oidc:"
216+
default: "oidc:"
217+
description: "Prefix prepended to group claims to prevent clashes
218+
with existing names (such as system: groups). For example, the value oidc: will
219+
create group names like oidc:engineering and oidc:infra."
171220
patches:
172221
- name: k8s_version
173222
description: "Sets the openstack node image for workers and the controlplane to the cluster-api image with the version mentioned in spec.topology.version."
@@ -453,3 +502,37 @@ spec:
453502
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/certSANs"
454503
valueFrom:
455504
variable: certSANs
505+
- name: oidc_config
506+
description: "Configure API Server to use external authentication service."
507+
enabledIf: {{ `"{{ if and .oidc_config .oidc_config.client_id .oidc_config.issuer_url }}true{{end}}"` }}
508+
definitions:
509+
- selector:
510+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
511+
kind: KubeadmControlPlaneTemplate
512+
matchResources:
513+
controlPlane: true
514+
jsonPatches:
515+
- op: add
516+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-client-id"
517+
valueFrom:
518+
variable: oidc_config.client_id
519+
- op: add
520+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-issuer-url"
521+
valueFrom:
522+
variable: oidc_config.issuer_url
523+
- op: add
524+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-claim"
525+
valueFrom:
526+
variable: oidc_config.username_claim
527+
- op: add
528+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-claim"
529+
valueFrom:
530+
variable: oidc_config.groups_claim
531+
- op: add
532+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-prefix"
533+
valueFrom:
534+
variable: oidc_config.username_prefix
535+
- op: add
536+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-prefix"
537+
valueFrom:
538+
variable: oidc_config.groups_prefix

0 commit comments

Comments
 (0)