-
Notifications
You must be signed in to change notification settings - Fork 6.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move configuration from kube_oidc to own top-level configuration. Exp…
…and the entire Struct-Auth configuration and only create the configurations if the feature gate is activated.
- Loading branch information
1 parent
521f471
commit 8296a06
Showing
8 changed files
with
117 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
roles/kubernetes/control-plane/defaults/main/kube-apiserver-auth.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| --- | ||
| kube_apiserver_structured_auth_jwt_issuers: [] | ||
| # Example JWT issuer configuration: | ||
| # kube_apiserver_structured_auth_jwt_issuers: | ||
| # - issuer: | ||
| # url: "https://issuer1.example.com" | ||
| # audiences: | ||
| # - audience1 | ||
| # - audience2 | ||
| # audienceMatchPolicy: MatchAny | ||
| # claimMappings: | ||
| # username: | ||
| # expression: "claims.username" | ||
| # groups: | ||
| # expression: "claims.groups" | ||
| # uid: | ||
| # expression: "claims.uid" | ||
| # userValidationRules: | ||
| # - expression: "!user.username.startsWith('system:')" | ||
| # message: "username cannot use reserved system: prefix" | ||
| # - issuer: | ||
| # url: "https://issuer2.example.com" | ||
| # discoveryURL: "https://discovery.example.com/.well-known/openid-configuration" | ||
| # audiences: | ||
| # - audience3 | ||
| # - audience4 | ||
| # audienceMatchPolicy: MatchAny | ||
| # claimMappings: | ||
| # username: | ||
| # expression: "claims.username" | ||
| # groups: | ||
| # expression: "claims.groups" | ||
| # uid: | ||
| # expression: "claims.uid" | ||
| # userValidationRules: | ||
| # - expression: "!user.username.startsWith('kubespray:')" | ||
| # message: "username cannot use reserved kubespray: prefix" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 39 additions & 22 deletions
61
roles/kubernetes/control-plane/templates/apiserver-authentication-config.yaml.j2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,31 +1,48 @@ | ||
| --- | ||
| apiVersion: apiserver.config.k8s.io/v1beta1 | ||
| kind: AuthenticationConfiguration | ||
| {% if kube_apiserver_structured_auth_jwt_issuers | length > 0 %} | ||
| jwt: | ||
| - issuer: | ||
| audiences: {{ ([kube_oidc_client_id] + kube_oidc_audiences) | to_json }} | ||
| audienceMatchPolicy: MatchAny | ||
| {% if kube_oidc_ca_file is defined %} | ||
| certificateAuthority: "{{ kube_oidc_ca_file }}" | ||
| {% for issuer in kube_apiserver_structured_auth_jwt_issuers %} | ||
| - issuer: | ||
| url: "{{ issuer.issuer.url }}" | ||
| {% if issuer.issuer.discoveryURL is defined %} | ||
| discoveryURL: "{{ issuer.issuer.discoveryURL }}" | ||
| {% endif %} | ||
| url: "{{ kube_oidc_url }}" | ||
| claimMappings: | ||
| {% if kube_oidc_username_claim is defined %} | ||
| username: | ||
| claim: "{{ kube_oidc_username_claim }}" | ||
| prefix: "{{ kube_oidc_username_prefix }}" | ||
| audiences: | ||
| {% for audience in issuer.issuer.audiences %} | ||
| - {{ audience }} | ||
| {% endfor %} | ||
| audienceMatchPolicy: {{ issuer.issuer.audienceMatchPolicy }} | ||
| {% if issuer.claimValidationRules is defined %} | ||
| claimValidationRules: | ||
| {% for validationRule in issuer.claimValidationRules %} | ||
| expression: "{{ validationRule.expression }}" | ||
| message: "{{ validationRule.message }}" | ||
| {% endfor %} | ||
| {% endif %} | ||
| {% if kube_oidc_groups_claim is defined %} | ||
| groups: | ||
| claim: "{{ kube_oidc_groups_claim }}" | ||
| prefix: "{{ kube_oidc_groups_prefix }}" | ||
| claimMappings: | ||
| username: | ||
| expression: "{{ issuer.claimMappings.username.expression }}" | ||
| groups: | ||
| expression: "{{ issuer.claimMappings.groups.expression }}" | ||
| uid: | ||
| expression: "{{ issuer.claimMappings.uid.expression }}" | ||
| {% if issuer.claimMappings.extra is defined %} | ||
| extra: | ||
| {% for extra in issuer.claimMappings.extra %} | ||
| - key: "{{ extra.key }}" | ||
| expression: "{{ extra.expression }}" | ||
| {% endfor %} | ||
| {% endif %} | ||
| {% if kube_oidc_uid_claim is defined %} | ||
| uid: | ||
| claim: "{{ kube_oidc_uid_claim }}" | ||
| {% if issuer.userValidationRules | length > 0 %} | ||
| userValidationRules: | ||
| {% for rule in issuer.userValidationRules %} | ||
| - expression: "{{ rule.expression }}" | ||
| message: "{{ rule.message }}" | ||
| {% endfor %} | ||
| {% endif %} | ||
| userValidationRules: | ||
| {% for rule in kube_oidc_user_validation_rules + kube_oidc_additional_user_validation_rules %} | ||
| - expression: "{{ rule.expression }}" | ||
| message: "{{ rule.message }}" | ||
| {% endfor %} | ||
| {% else %} | ||
| jwt: | ||
| {% endif %} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters