Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AuthConfig v1beta2 #417

Merged
merged 35 commits into from
Sep 19, 2023
Merged

AuthConfig v1beta2 #417

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
8b7acdd
AuthConfig v1beta2 CRD
guicassolato Jul 21, 2023
1eaead9
conversion webhook
guicassolato Jul 25, 2023
7d4603c
fix one-of restriction for pattern expression of pattern ref
guicassolato Jul 27, 2023
3aada04
Conversion webhook service managed by the Operator
guicassolato Aug 29, 2023
9a216b0
fix: unexport spicedb conversion functions
guicassolato Aug 29, 2023
86455df
add tests for the conversion + fix conversion of a couple nil arrays/…
guicassolato Aug 29, 2023
aca78c6
One-of constraints for fields of AuthConfig v1beta2
guicassolato Aug 29, 2023
0599684
Use Authorino Operator install script
guicassolato Aug 31, 2023
af96b5b
fix: set status field hostReady in the conversion
guicassolato Sep 4, 2023
d968a60
docs: updated README, architecture and features pages for the v1beta2…
guicassolato Sep 4, 2023
99e5ecf
remove: unimplemented spec.authentication.jwt.jwksUrl
guicassolato Sep 5, 2023
8eaeca1
remove: unimplemented spec.authentication.credentials.customHeader.pr…
guicassolato Sep 5, 2023
d99b225
remove: unimplemented spec.(metadata|authorization.opa.externalPolicy…
guicassolato Sep 5, 2023
6202b26
Add description to not use unimplemented fields of the OPA external p…
guicassolato Sep 5, 2023
c22d500
docs: fixup: opa.externalPolicy
guicassolato Sep 5, 2023
b556c26
docs: fixup: wristband.issuer example
guicassolato Sep 5, 2023
3527edf
Add deprecation notice of v1beta1 reponse.wrapperKey field
guicassolato Sep 5, 2023
c70f9b6
Revert "docs: fixup: wristband.issuer example"
guicassolato Sep 5, 2023
cf14ba3
remove: unimplemented spec.response.success.headers.prefix
guicassolato Sep 5, 2023
b61838f
Add field spec.response.success.(headers|dynamicMetadata).key
guicassolato Sep 5, 2023
7e92eaf
docs: update for v1beta2: 'Getting started'
guicassolato Sep 5, 2023
3207f52
docs: fixup: inlineRego → rego
guicassolato Sep 5, 2023
3b12430
docs: update for v1beta2: user guides
guicassolato Sep 5, 2023
6b3ed14
docs: fix broken links to feature description
guicassolato Sep 5, 2023
278acb9
fix: conversion of v1beta2.ValueOrSelector type missing to parse stri…
guicassolato Sep 5, 2023
07a2a2f
docs: fixup: 'Using Authorino as ValidatingWebhook service' user guide
guicassolato Sep 5, 2023
c4416d1
fix: set default http header custom response wrapper when converting …
guicassolato Sep 6, 2023
bb89344
e2e tests for v1beta2
guicassolato Sep 6, 2023
6c22f27
Remove unnecessary steps to install cert-manager when relying on the …
guicassolato Sep 6, 2023
2fa28d7
docs: fixup: 'Edge Authentication Architecture (EAA)' user guide
guicassolato Sep 6, 2023
166c088
docs: fixup: 'Authenticated rate limiting (with Envoy Dynamic Metadat…
guicassolato Sep 6, 2023
bf6e068
fix: docs: typo in the oauth2 token introspection user guide
guicassolato Sep 13, 2023
5059dca
fix: docs: use net.cidr_contains instead of regex.match in opa exampl…
guicassolato Sep 13, 2023
4343ef8
fix: docs: wrong kubectl command in the cleanup section of a user guide
guicassolato Sep 13, 2023
90ce6fe
docs: urls with interpolated json paths within authconfig resources w…
guicassolato Sep 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 23 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ endif
PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
export PATH := $(PROJECT_DIR)/bin:$(PATH)

# Authorino manifests bundle (CRDs, RBAC)
# Authorino manifests bundle (CRDs, RBAC, Webhook service)
AUTHORINO_MANIFESTS ?= $(PROJECT_DIR)/install/manifests.yaml

# The Kubernetes namespace where to deploy the Authorino instance
Expand Down Expand Up @@ -109,7 +109,7 @@ generate: vendor controller-gen ## Generates types deepcopy code
$(MAKE) fmt vet

manifests: controller-gen kustomize ## Generates the manifests in $PROJECT_DIR/install
controller-gen crd:crdVersions=v1 rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=install/crd output:rbac:artifacts:config=install/rbac && kustomize build install > $(AUTHORINO_MANIFESTS)
controller-gen crd:crdVersions=v1 rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=install/crd output:rbac:artifacts:config=install/rbac && $(KUSTOMIZE) build install > $(AUTHORINO_MANIFESTS)

run: generate manifests ## Runs the application against the Kubernetes cluster configured in ~/.kube/config
go run -ldflags "-X main.version=$(VERSION)" ./main.go server
Expand Down Expand Up @@ -188,7 +188,9 @@ limitador: ## Deploys Limitador from kuadrant/authorino-examples into the Kubern

##@ Installation

.PHONY: install-operator uninstall-operator install uninstall
.PHONY: install-operator uninstall-operator install-webhooks uninstall-webhooks install uninstall

AUTHORINO_OPERATOR_NAMESPACE ?= authorino-operator

ifeq (latest,$(OPERATOR_VERSION))
OPERATOR_BRANCH = main
Expand All @@ -197,15 +199,29 @@ OPERATOR_BRANCH = $(OPERATOR_VERSION)
endif
install-operator: ## Installs Authorino Operator and corresponding version of the manifests into the Kubernetes cluster configured in ~/.kube/config
kubectl apply -f https://github.com/raw/Kuadrant/authorino-operator/$(OPERATOR_BRANCH)/config/deploy/manifests.yaml
kubectl -n authorino-operator wait --timeout=300s --for=condition=Available deployments --all
kubectl -n $(AUTHORINO_OPERATOR_NAMESPACE) wait --timeout=300s --for=condition=Available deployments --all

uninstall-operator: ## Uninstalls Authorino Operator and corresponding version of the manifests from the Kubernetes cluster configured in ~/.kube/config
kubectl delete -f https://github.com/raw/Kuadrant/authorino-operator/$(OPERATOR_BRANCH)/config/deploy/manifests.yaml

install: manifests ## Installs the current manifests (CRD, RBAC) into the Kubernetes cluster configured in ~/.kube/config
WEBHOOK_SERVICE_NAMESPACE ?= $(AUTHORINO_OPERATOR_NAMESPACE)

install-webhooks: ## Creates the Authorino webhook service
cd install/webhooks && $(KUSTOMIZE) edit set namespace ${WEBHOOK_SERVICE_NAMESPACE}
$(KUSTOMIZE) build install/webhooks | kubectl -n $(WEBHOOK_SERVICE_NAMESPACE) apply -f -
# rollback kustomize edit
cd install/webhooks && $(KUSTOMIZE) edit set namespace authorino-webhooks

uninstall-webhooks: ## Uninstalls the Authorino webhook service
cd install/webhooks && $(KUSTOMIZE) edit set namespace ${WEBHOOK_SERVICE_NAMESPACE}
$(KUSTOMIZE) build install/webhooks | kubectl -n $(WEBHOOK_SERVICE_NAMESPACE) delete -f -
# rollback kustomize edit
cd install/webhooks && $(KUSTOMIZE) edit set namespace authorino-webhooks

install: manifests ## Installs the current manifests (CRD, RBAC, Webhook service) into the Kubernetes cluster configured in ~/.kube/config
kubectl apply -f $(AUTHORINO_MANIFESTS)

uninstall: manifests ## Uninstalls the current manifests (CRD, RBAC) from the Kubernetes cluster configured in ~/.kube/config
uninstall: manifests ## Uninstalls the current manifests (CRD, RBAC, Webhook service) from the Kubernetes cluster configured in ~/.kube/config
kubectl delete -f $(AUTHORINO_MANIFESTS)

##@ Deployment
Expand Down Expand Up @@ -250,7 +266,7 @@ cluster: kind ## Starts a local Kubernetes cluster using Kind
local-build: kind docker-build ## Builds an image based on the current branch and pushes it to the registry into the local Kubernetes cluster started with Kind
$(KIND) load docker-image $(AUTHORINO_IMAGE) --name $(KIND_CLUSTER_NAME)

local-setup: cluster local-build cert-manager install-operator install namespace deploy user-apps ## Sets up a test/dev local Kubernetes server using Kind, loaded up with a freshly built Authorino image and apps
local-setup: cluster local-build cert-manager install-operator install install-webhooks namespace deploy user-apps ## Sets up a test/dev local Kubernetes server using Kind, loaded up with a freshly built Authorino image and apps
kubectl -n $(NAMESPACE) wait --timeout=300s --for=condition=Available deployments --all
@{ \
echo "Now you can export the envoy service by doing:"; \
Expand Down
3 changes: 3 additions & 0 deletions PROJECT
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ resources:
- group: config
kind: AuthConfig
version: v1beta1
- group: config
kind: AuthConfig
version: v1beta2
version: 3-alpha
plugins:
go.sdk.operatorframework.io/v2-alpha: {}
4 changes: 4 additions & 0 deletions api/v1beta1/auth_config_conversion.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
package v1beta1

// Hub marks this version as a conversion hub.
func (a *AuthConfig) Hub() {}
1 change: 1 addition & 0 deletions api/v1beta1/auth_config_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -774,6 +774,7 @@ func (s *AuthConfigStatus) Ready() bool {
// AuthConfig is the schema for Authorino's AuthConfig API
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

considered adding kubebuilder:deprecatedversion ??

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should not be done in this step. check my comment above.

// +kubebuilder:storageversion
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't be v1beta2 the one to be stored?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not necessarily. Usually, first you introduce a new version of the API and allow time for users to adapt; then the newer version becomes the stored one in a subsequent rolling update. This way, when they install the new version of the CRD, previously existing CRs based on the old version won't be a blocker.

For ref: https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/#version-removal

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am missing something. If the stored version is the old one, even the clients of the new version will store CR with the old version. then the newer version becomes the stored one in a subsequent rolling update. Then, there will be the same situation, all the CR stored versions would be the old one and the CRD's stored one will be the new one. I do not see any advantage of postponing the stored version.

What I was assuming, and correct me if I am wrong, whenever a client updates / creates an object, if the object's version is not the stored one, the webhook conversion API will be called and the object converted.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at the Versions in CustomResourceDefinitions, the workflow for upgrading CRD version would be (high level):

  • Release 1: Add a new version to the version list. The old version is the stored one. Both versions will be served. No deprecation flag.
  • Release 2 (or later): Old version deprecation. The old version is served, but not stored and added deprecation warning. The new version is the stored (and served) one. Just after installing the new CRD with the changes, the stored (in old version) CR's need to be migrated. This is procedure needs to be run by some cluster admin.
  • Release 3 (or later): Version removal. When all the clients have migrated to the new version (one option is checking kube-apiserver logs), the old version can either be disabled for serving (served: false) or just removed from the CRD spec.versions list.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent summary, @eguzki. Thank you for this!

// +kubebuilder:printcolumn:name="Ready",type=string,JSONPath=`.status.summary.ready`,description="Ready for all hosts"
// +kubebuilder:printcolumn:name="Hosts",type=string,JSONPath=`.status.summary.numHostsReady`,description="Number of hosts ready"
// +kubebuilder:printcolumn:name="Authentication",type=integer,JSONPath=`.status.summary.numIdentitySources`,description="Number of trusted identity sources",priority=2
Expand Down
Loading
Loading