-
Notifications
You must be signed in to change notification settings - Fork 270
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into feat/operator-java-opts
- Loading branch information
Showing
24 changed files
with
4,559 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
47 changes: 47 additions & 0 deletions
47
...r/controller/src/main/java/io/apicurio/registry/operator/feat/security/AdminOverride.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package io.apicurio.registry.operator.feat.security; | ||
|
|
||
| import io.apicurio.registry.operator.EnvironmentVariables; | ||
| import io.apicurio.registry.operator.api.v1.spec.auth.AdminOverrideSpec; | ||
| import io.fabric8.kubernetes.api.model.EnvVar; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| import static io.apicurio.registry.operator.utils.Utils.createEnvVar; | ||
| import static io.apicurio.registry.operator.utils.Utils.putIfNotBlank; | ||
|
|
||
| /** | ||
| * Helper class used to handle Admin Overide related configuration. | ||
| */ | ||
| public class AdminOverride { | ||
|
|
||
| /** | ||
| * Configures admin-override-related environment variables for the Apicurio Registry. | ||
| * | ||
| * @param env The map of environment variables to be configured. | ||
| * @param adminOverrideSpec The adminOverride specification containing required admin override settings. | ||
| * If null, no changes will be made to envVars. | ||
| */ | ||
| public static void configureAdminOverride(AdminOverrideSpec adminOverrideSpec, Map<String, EnvVar> env) { | ||
| if (adminOverrideSpec == null) { | ||
| return; | ||
| } | ||
|
|
||
| if (adminOverrideSpec.getEnabled() != null && adminOverrideSpec.getEnabled()) { | ||
| env.put(EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_ENABLED, | ||
| createEnvVar(EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_ENABLED, | ||
| adminOverrideSpec.getEnabled().toString())); | ||
|
|
||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_ROLE, | ||
| adminOverrideSpec.getRole()); | ||
|
|
||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_FROM, | ||
| adminOverrideSpec.getFrom()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_TYPE, | ||
| adminOverrideSpec.getType()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_CLAIM, | ||
| adminOverrideSpec.getClaimName()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ADMIN_OVERRIDE_CLAIM_VALUE, | ||
| adminOverrideSpec.getClaimValue()); | ||
| } | ||
| } | ||
| } |
59 changes: 59 additions & 0 deletions
59
operator/controller/src/main/java/io/apicurio/registry/operator/feat/security/Auth.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| package io.apicurio.registry.operator.feat.security; | ||
|
|
||
| import io.apicurio.registry.operator.EnvironmentVariables; | ||
| import io.apicurio.registry.operator.api.v1.spec.auth.AuthSpec; | ||
| import io.fabric8.kubernetes.api.model.EnvVar; | ||
| import io.fabric8.kubernetes.api.model.apps.Deployment; | ||
|
|
||
| import java.util.Map; | ||
| import java.util.Optional; | ||
|
|
||
| import static io.apicurio.registry.operator.utils.Utils.createEnvVar; | ||
| import static io.apicurio.registry.operator.utils.Utils.putIfNotBlank; | ||
|
|
||
| /** | ||
| * Helper class used to handle AUTH related configuration. | ||
| */ | ||
| public class Auth { | ||
|
|
||
| /** | ||
| * Configures authentication-related environment variables for the Apicurio Registry. | ||
| * | ||
| * @param env The map of environment variables to be configured. | ||
| * @param deployment The application deployment to configure TLS. | ||
| * @param authSpec The authentication specification containing required auth settings. If null, no changes | ||
| * will be made to envVars. | ||
| */ | ||
| public static void configureAuth(AuthSpec authSpec, Deployment deployment, Map<String, EnvVar> env) { | ||
| if (authSpec == null) { | ||
| return; | ||
| } | ||
|
|
||
| env.put(EnvironmentVariables.APICURIO_REGISTRY_AUTH_ENABLED, | ||
| createEnvVar(EnvironmentVariables.APICURIO_REGISTRY_AUTH_ENABLED, | ||
| Optional.ofNullable(authSpec.getEnabled()).orElse(Boolean.FALSE).toString())); | ||
|
|
||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_REGISTRY_APP_CLIENT_ID, authSpec.getAppClientId()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_REGISTRY_UI_CLIENT_ID, authSpec.getUiClientId()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_UI_AUTH_OIDC_REDIRECT_URI, | ||
| authSpec.getRedirectURI()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_UI_AUTH_OIDC_LOGOUT_URL, authSpec.getLogoutURL()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_REGISTRY_AUTH_SERVER_URL, | ||
| authSpec.getAuthServerUrl()); | ||
|
|
||
| if (authSpec.getAnonymousReads() != null && authSpec.getAnonymousReads()) { | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ANONYMOUS_READ_ACCESS_ENABLED, | ||
| authSpec.getAnonymousReads().toString()); | ||
| } | ||
|
|
||
| if (authSpec.getBasicAuth() != null && authSpec.getBasicAuth().getEnabled()) { | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTHN_BASIC_CLIENT_CREDENTIALS_ENABLED, | ||
| authSpec.getBasicAuth().getEnabled().toString()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTHN_BASIC_CLIENT_CREDENTIALS_CACHE_EXPIRATION, | ||
| authSpec.getBasicAuth().getCacheExpiration()); | ||
| } | ||
|
|
||
| AuthTLS.configureAuthTLS(authSpec, deployment, env); | ||
| Authz.configureAuthz(authSpec.getAuthz(), env); | ||
| } | ||
| } |
51 changes: 51 additions & 0 deletions
51
operator/controller/src/main/java/io/apicurio/registry/operator/feat/security/AuthTLS.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package io.apicurio.registry.operator.feat.security; | ||
|
|
||
| import io.apicurio.registry.operator.EnvironmentVariables; | ||
| import io.apicurio.registry.operator.api.v1.spec.auth.AuthSpec; | ||
| import io.apicurio.registry.operator.api.v1.spec.auth.AuthTLSSpec; | ||
| import io.apicurio.registry.operator.utils.SecretKeyRefTool; | ||
| import io.fabric8.kubernetes.api.model.EnvVar; | ||
| import io.fabric8.kubernetes.api.model.apps.Deployment; | ||
|
|
||
| import java.util.Map; | ||
| import java.util.Optional; | ||
|
|
||
| import static io.apicurio.registry.operator.EnvironmentVariables.*; | ||
| import static io.apicurio.registry.operator.api.v1.ContainerNames.REGISTRY_APP_CONTAINER_NAME; | ||
| import static io.apicurio.registry.operator.resource.app.AppDeploymentResource.addEnvVar; | ||
| import static io.apicurio.registry.operator.utils.Utils.putIfNotBlank; | ||
| import static java.util.Optional.ofNullable; | ||
|
|
||
| public class AuthTLS { | ||
|
|
||
| /** | ||
| * Configure TLS for OIDC authentication | ||
| */ | ||
| public static void configureAuthTLS(AuthSpec authSpec, Deployment deployment, Map<String, EnvVar> env) { | ||
|
|
||
| putIfNotBlank(env, EnvironmentVariables.OIDC_TLS_VERIFICATION, | ||
| authSpec.getTls().getTlsVerificationType()); | ||
|
|
||
| // spotless:off | ||
| var truststore = new SecretKeyRefTool(getAuthTLSSpec(authSpec) | ||
| .map(AuthTLSSpec::getTruststoreSecretRef) | ||
| .orElse(null), "ca.p12"); | ||
|
|
||
| var truststorePassword = new SecretKeyRefTool(getAuthTLSSpec(authSpec) | ||
| .map(AuthTLSSpec::getTruststorePasswordSecretRef) | ||
| .orElse(null), "ca.password"); | ||
| // spotless:on | ||
| if (truststore.isValid() && truststorePassword.isValid()) { | ||
| truststore.applySecretVolume(deployment, REGISTRY_APP_CONTAINER_NAME); | ||
| addEnvVar(env, OIDC_TLS_TRUSTSTORE_LOCATION, truststore.getSecretVolumeKeyPath()); | ||
| truststorePassword.applySecretEnvVar(env, OIDC_TLS_TRUSTSTORE_PASSWORD); | ||
| } | ||
| } | ||
|
|
||
| private static Optional<AuthTLSSpec> getAuthTLSSpec(AuthSpec primary) { | ||
| // spotless:off | ||
| return ofNullable(primary) | ||
| .map(AuthSpec::getTls); | ||
| // spotless:on | ||
| } | ||
| } |
60 changes: 60 additions & 0 deletions
60
operator/controller/src/main/java/io/apicurio/registry/operator/feat/security/Authz.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| package io.apicurio.registry.operator.feat.security; | ||
|
|
||
| import io.apicurio.registry.operator.EnvironmentVariables; | ||
| import io.apicurio.registry.operator.api.v1.spec.auth.AuthzSpec; | ||
| import io.fabric8.kubernetes.api.model.EnvVar; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| import static io.apicurio.registry.operator.utils.Utils.createEnvVar; | ||
| import static io.apicurio.registry.operator.utils.Utils.putIfNotBlank; | ||
|
|
||
| /** | ||
| * Helper class used to handle AUTHZ related configuration. | ||
| */ | ||
| public class Authz { | ||
|
|
||
| /** | ||
| * Configures authorization-related environment variables for the Apicurio Registry. | ||
| * | ||
| * @param env The map of environment variables to be configured. | ||
| * @param authzSpec The auhtorization specification containing required authz settings. If null, no | ||
| * changes will be made to envVars. | ||
| */ | ||
| public static void configureAuthz(AuthzSpec authzSpec, Map<String, EnvVar> env) { | ||
| if (authzSpec == null) { | ||
| return; | ||
| } | ||
|
|
||
| if (authzSpec.getEnabled()) { | ||
| env.put(EnvironmentVariables.APICURIO_AUTH_ROLE_BASED_AUTHORIZATION, | ||
| createEnvVar(EnvironmentVariables.APICURIO_AUTH_ROLE_BASED_AUTHORIZATION, | ||
| authzSpec.getEnabled().toString())); | ||
|
|
||
| if (authzSpec.getGroupAccess() != null && authzSpec.getGroupAccess()) { | ||
| putIfNotBlank(env, | ||
| EnvironmentVariables.APICURIO_AUTH_OWNER_ONLY_AUTHORIZATION_LIMIT_GROUP_ACCESS, | ||
| authzSpec.getGroupAccess().toString()); | ||
| } | ||
|
|
||
| if (authzSpec.getOwnerOnly() != null && authzSpec.getOwnerOnly()) { | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_OWNER_ONLY_AUTHORIZATION, | ||
| authzSpec.getOwnerOnly().toString()); | ||
| } | ||
|
|
||
| if (authzSpec.getReadAccess() != null && authzSpec.getReadAccess()) { | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_AUTHENTICATED_READ_ACCESS_ENABLED, | ||
| authzSpec.getReadAccess().toString()); | ||
| } | ||
|
|
||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ROLE_SOURCE, authzSpec.getRoleSource()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ROLES_ADMIN, authzSpec.getAdminRole()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ROLES_DEVELOPER, | ||
| authzSpec.getDeveloperRole()); | ||
| putIfNotBlank(env, EnvironmentVariables.APICURIO_AUTH_ROLES_READONLY, | ||
| authzSpec.getReadOnlyRole()); | ||
|
|
||
| AdminOverride.configureAdminOverride(authzSpec.getAdminOverride(), env); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.