Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: OIDC Gateway API #2122

Merged
merged 9 commits into from
Nov 13, 2023
Merged

feat: OIDC Gateway API #2122

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
9bde314
add oidc to securitypolicy api
zhaohuabing Oct 30, 2023
0911b38
address comments
zhaohuabing Nov 10, 2023
95903a7
address comments
zhaohuabing Nov 11, 2023
2a8b7be
address comments
zhaohuabing Nov 11, 2023
30e72f9
fix test
zhaohuabing Nov 11, 2023
bafdd2d
forbid cross-namespace ref to secret for now
zhaohuabing Nov 13, 2023
223fe9d
address comments
zhaohuabing Nov 13, 2023
08fb74f
fix lint
zhaohuabing Nov 13, 2023
b23cf97
Merge branch 'main' into oidc-api
zhaohuabing Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 15 additions & 11 deletions internal/gatewayapi/securitypolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,12 @@
"k8s.io/apimachinery/pkg/types"
gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
gwv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"

Check failure on line 20 in internal/gatewayapi/securitypolicy.go

View workflow job for this annotation

GitHub Actions / lint 

File is not `goimports`-ed with -local github.com/envoyproxy/gateway/ (goimports)
egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
"github.com/envoyproxy/gateway/internal/ir"
"github.com/envoyproxy/gateway/internal/status"
"github.com/envoyproxy/gateway/internal/utils/ptr"
"github.com/tetratelabs/multierror"
)

func (t *Translator) ProcessSecurityPolicies(securityPolicies []*egv1a1.SecurityPolicy,
Expand Down Expand Up @@ -255,16 +256,15 @@
resources *Resources, xdsIR XdsIRMap) error {
// Build IR
var (
cors *ir.CORS
jwt *ir.JWT
oidc *ir.OIDC
err error
cors *ir.CORS
jwt *ir.JWT
oidc *ir.OIDC
err, errs error
)

if policy.Spec.CORS != nil {
cors, err = t.buildCORS(policy.Spec.CORS)
if err != nil {
return err
if cors, err = t.buildCORS(policy.Spec.CORS); err != nil {
errs = multierror.Append(errs, err)
}
}

Expand All @@ -273,16 +273,20 @@
}

if policy.Spec.OIDC != nil {
oidc, err = t.buildOIDC(policy, resources)
if err != nil {
return err
if oidc, err = t.buildOIDC(policy, resources); err != nil {
errs = multierror.Append(errs, err)
}
}

// Apply IR to all relevant routes
// It can be difficult to reason about the state of the system if we apply
// part of the policy and not the rest. Therefore, we either apply all of it
// or none of it (when get errors when translating the policy)

if errs != nil {
zhaohuabing marked this conversation as resolved.
Show resolved Hide resolved
return errs
}

// Apply IR to all relevant routes
prefix := irRoutePrefix(route)
for _, ir := range xdsIR {
for _, http := range ir.HTTP {
Expand Down
Loading