New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement proposal to allow Pinniped custom resources to ref configmaps or secrets for CA bundles #1996

Merged

cfryanr merged 99 commits into vmware-tanzu:main from ashish-amarnath:ca-bundles-ref

Aug 5, 2024

Member

ashish-amarnath commented Jun 20, 2024 •

edited by cfryanr

Loading

Implement proposal to allow Pinniped CRs to source CA bundles, for client-side TLS validation, from secrets and configMaps

Fixes #1886

This PR also adds a new "Status" printer column to the table output for WebhookAuthenticator and JWTAuthenticator. The value shown in the column is the status.Phase of the resource.

This PR also fixes a bug for JWTAuthenticators and WebhookAuthenticators where their status was not always being updated after its initial creation.

Release note:

TBD

vmwclabot added the cla-not-required label

ashish-amarnath self-assigned this

ashish-amarnath requested a review from cfryanr

June 20, 2024 18:07

cfryanr reviewed

View reviewed changes

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl Outdated Show resolved Hide resolved

ashish-amarnath force-pushed the ca-bundles-ref branch from 1eea7f3 to 60d32a4 Compare

June 24, 2024 18:18

cfryanr reviewed

View reviewed changes

test/integration/concierge_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_tls_spec_test.go Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_tls_spec_test.go Show resolved Hide resolved

ashish-amarnath force-pushed the ca-bundles-ref branch from 60d32a4 to cc4dbdc Compare

June 24, 2024 21:54

cfryanr reviewed

View reviewed changes

apis/concierge/authentication/v1alpha1/types_tls.go.tmpl Outdated Show resolved Hide resolved

cfryanr reviewed

View reviewed changes

test/integration/concierge_tls_spec_test.go Outdated Show resolved Hide resolved

ashish-amarnath force-pushed the ca-bundles-ref branch 2 times, most recently from f17b0de to a6e4b2c Compare

June 25, 2024 17:42

cfryanr reviewed

View reviewed changes

test/integration/supervisor_tls_spec_test.go Outdated Show resolved Hide resolved

ashish-amarnath force-pushed the ca-bundles-ref branch from a6e4b2c to 1f28d70 Compare

June 25, 2024 18:23

ashish-amarnath commented

View reviewed changes

internal/controller/tlsconfigutil/tls_config_util.go Outdated Show resolved Hide resolved

ashish-amarnath commented

View reviewed changes

internal/controller/tlsconfigutil/tls_config_util.go Outdated Show resolved Hide resolved

ashish-amarnath commented

View reviewed changes

internal/controller/tlsconfigutil/tls_config_util.go Outdated Show resolved Hide resolved

ashish-amarnath force-pushed the ca-bundles-ref branch 3 times, most recently from 239fa85 to f9c6882 Compare

July 2, 2024 06:13

ashish-amarnath force-pushed the ca-bundles-ref branch from f9c6882 to ff1cdfa Compare

July 8, 2024 17:11

joshuatcasey and others added 21 commits

August 5, 2024 11:32


          jwtcachefiller now tests for exact log lines and prints when it choos…

d6d66fa

…es to not update the status


          update expectation conditions message when CA bundle is not configured

a0c259f

fix a typo where we intended to use a configmap instead of a secret

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>

Co-authored-by: Ryan Richard <richardry@vmware.com>


          webhookcachefiller and jwtcachefiller always update status when needed

ed50294

Even when the authenticator is found in the cache, try to update its
status. Failing to do so would mean that the actual status will not
be overwritten by the controller's newly computed desired status.

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          secret/configmap with CA bundle to be created in namespace where pinn…

19c4acf

…iped is installed

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          update generated api docs

43964ff

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          document new CA bundle source option in howto docs

91ef689


          small refactors

02e41ba


          update docs and change struct name in types_tls.go.tmpl files

e0235ed

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          refactor test helpers in supervisor_login_test.go

Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          Add integration tests for tls spec validation in JWTAuthenticator and…

c340509

… WebhookAuthenticator

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          add integration test for TLS config validation in OIDCIdentityProvider

59402bc

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          add integration test for TLS config validation in GitHubIdentityProvider

23129da

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          document allowed enum values and default values in all CR spec fields

a40c88e


          ran codegen on previous commit's changes

67de14a


          minor test refactor

2ebf9d3


          assert on condition message in concierge_tls_spec_test.go and supervi…

db2d7c8

…sor_tls_spec_test.go


          test more condition message cases in concierge_tls_spec_test.go and s…

4eb9a09

…upervisor_tls_spec_test.go


          improve api docs for TLSSpec in authenticator and IDP specs

59c2295

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          run codegen for changes in previous commit

d4ac69d


          refactor to use new certificateAuthorityDataSourceKind enum

b70db9d

Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com>


          fix typo in tmpl and run codegen

06b7d30

cfryanr force-pushed the ca-bundles-ref branch from 3927c48 to 06b7d30 Compare

August 5, 2024 18:32

This was referenced Aug 5, 2024

fix WS1 doc typo #2028

Merged

[Placeholder] Ensure that controllers use the Unknown status condition type when they are unable to perform a validation #2031

Closed

cfryanr added 3 commits

August 5, 2024 12:52


          Revert "Add integration tests for tls spec validation in JWTAuthentic…

23fd15f

…ator and WebhookAuthenticator"

This reverts commit c340509.


          Revert "add integration test for TLS config validation in OIDCIdentit…

fdeca2c

…yProvider"

This reverts commit 59402bc.


          Revert "add integration test for TLS config validation in GitHubIdent…

2af510a

…ityProvider"

This reverts commit 23129da.

cfryanr enabled auto-merge

August 5, 2024 21:15

cfryanr merged commit 0787301 into vmware-tanzu:main

43 checks passed

ashish-amarnath deleted the ca-bundles-ref branch

August 5, 2024 21:29

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-not-required