Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: OIDC Gateway API #2122

Merged
merged 9 commits into from
Nov 13, 2023
Merged

feat: OIDC Gateway API #2122

merged 9 commits into from
Nov 13, 2023

Conversation

zhaohuabing
Copy link
Member

@zhaohuabing zhaohuabing commented Oct 30, 2023

What this PR does:

  • add OIDC authentication to the SecurityPolicy API
  • translate OIDC API to IR

xds translation will be in a follow-up PR.

OIDC will be done per-route. The final xds output will look like this example yaml file: https://github.com/zhaohuabing/playground/blob/main/envoy/per-route-oauth2-oidc/envoy.yaml

Related: #881

@zhaohuabing zhaohuabing requested a review from a team as a code owner October 30, 2023 09:46
@zhaohuabing zhaohuabing marked this pull request as draft October 30, 2023 09:46
@codecov
Copy link

codecov bot commented Oct 30, 2023

Codecov Report

Merging #2122 (b23cf97) into main (f2e12a5) will increase coverage by 0.05%.
The diff coverage is 60.46%.

@@            Coverage Diff             @@
##             main    #2122      +/-   ##
==========================================
+ Coverage   64.22%   64.27%   +0.05%     
==========================================
  Files         107      107              
  Lines       14665    14922     +257     
==========================================
+ Hits         9418     9591     +173     
- Misses       4677     4758      +81     
- Partials      570      573       +3     
Files Coverage Δ
internal/gatewayapi/translator.go 98.51% <100.00%> (+0.01%) ⬆️
internal/status/securitypolicy.go 0.00% <0.00%> (ø)
internal/ir/xds.go 73.90% <50.00%> (-0.48%) ⬇️
internal/status/conditions.go 95.83% <77.77%> (-4.17%) ⬇️
internal/gatewayapi/securitypolicy.go 82.54% <87.17%> (+3.94%) ⬆️
internal/gatewayapi/validate.go 86.76% <52.17%> (-2.89%) ⬇️
internal/ir/zz_generated.deepcopy.go 11.83% <0.00%> (-0.31%) ⬇️
internal/provider/kubernetes/controller.go 50.74% <6.38%> (-0.48%) ⬇️

... and 1 file with indirect coverage changes

@zhaohuabing zhaohuabing changed the title feat: add oidc to securitypolicy api feat: add OIDC to SecurityPolicy api Oct 30, 2023
@zhaohuabing zhaohuabing force-pushed the oidc-api branch 4 times, most recently from 47b72d1 to ad198e2 Compare November 3, 2023 09:18
@zhaohuabing zhaohuabing changed the title feat: add OIDC to SecurityPolicy api feat: OIDC Gateway API Nov 3, 2023
@zhaohuabing zhaohuabing marked this pull request as ready for review November 3, 2023 09:20
@zhaohuabing zhaohuabing marked this pull request as draft November 3, 2023 13:37
@zhaohuabing zhaohuabing force-pushed the oidc-api branch 4 times, most recently from d6974fa to ef5a0a2 Compare November 7, 2023 10:41
@zhaohuabing zhaohuabing marked this pull request as ready for review November 7, 2023 10:42
"name", refGrant.Name)
}
}
resourceMap.allAssociatedNamespaces[secretNamespace] = struct{}{} // TODO Zhaohuabing do we need this line?
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to check if this namespace exists?

@zhaohuabing zhaohuabing force-pushed the oidc-api branch 2 times, most recently from d7511f8 to 0164e76 Compare November 7, 2023 11:11
api/v1alpha1/oidc_types.go Outdated Show resolved Hide resolved
@arkodg
Copy link
Contributor

arkodg commented Nov 10, 2023

hey @zhaohuabing this looks good, haven't looked at the implementation yet, added some minor comments reg API

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
internal/ir/xds.go Outdated Show resolved Hide resolved
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
@zhaohuabing
Copy link
Member Author

/retest

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
api/v1alpha1/oidc_types.go Outdated Show resolved Hide resolved
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Copy link
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks !

@arkodg arkodg requested review from a team and cnvergence and removed request for a team November 13, 2023 21:11
@zirain zirain merged commit 397911d into envoyproxy:main Nov 13, 2023
18 checks passed
@zirain
Copy link
Contributor

zirain commented Nov 13, 2023

User documentation would be even better.

@zhaohuabing
Copy link
Member Author

User docs will be in a follow-up PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants