25a91019c2
- When two different Issuers have the same host (i.e. they differ only by path) then they must have the same secretName. This is because it wouldn't make sense for there to be two different TLS certificates for one host. Find any that do not have the same secret name to put an error status on them and to avoid serving OIDC endpoints for them. The host comparison is case-insensitive. - Issuer hostnames should be treated as case-insensitive, because DNS hostnames are case-insensitive. So https://me.com and https://mE.cOm are duplicate issuers. However, paths are case-sensitive, so https://me.com/A and https://me.com/a are different issuers. Fixed this in the issuer validations and in the OIDC Manager's request router logic.
109 lines
4.8 KiB
YAML
Generated
109 lines
4.8 KiB
YAML
Generated
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.4.0
|
|
creationTimestamp: null
|
|
name: oidcproviderconfigs.config.pinniped.dev
|
|
spec:
|
|
group: config.pinniped.dev
|
|
names:
|
|
kind: OIDCProviderConfig
|
|
listKind: OIDCProviderConfigList
|
|
plural: oidcproviderconfigs
|
|
shortNames:
|
|
- opc
|
|
singular: oidcproviderconfig
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: OIDCProviderConfig describes the configuration of an OIDC provider.
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this
|
|
object represents. Servers may infer this from the endpoint the client
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Spec of the OIDC provider.
|
|
properties:
|
|
issuer:
|
|
description: "Issuer is the OIDC Provider's issuer, per the OIDC Discovery
|
|
Metadata document, as well as the identifier that it will use for
|
|
the iss claim in issued JWTs. This field will also be used as the
|
|
base URL for any endpoints used by the OIDC Provider (e.g., if your
|
|
issuer is https://example.com/foo, then your authorization endpoint
|
|
will look like https://example.com/foo/some/path/to/auth/endpoint).
|
|
\n See https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3
|
|
for more information."
|
|
minLength: 1
|
|
type: string
|
|
secretName:
|
|
description: SecretName is an optional name of a Secret in the same
|
|
namespace, of type `kubernetes.io/tls`, which contains the TLS serving
|
|
certificate for the HTTPS endpoints served by this OIDC Provider.
|
|
SecretName is required if you would like to use the HTTPS endpoints
|
|
(e.g. when exposing them outside the cluster using a LoadBalancer
|
|
Service), and is not required when you would like to use only the
|
|
HTTP endpoints (e.g. when terminating TLS at an Ingress). The TLS
|
|
secret must contain keys named `tls.crt` and `tls.key` that contain
|
|
the certificate and private key to use for TLS.
|
|
type: string
|
|
required:
|
|
- issuer
|
|
type: object
|
|
status:
|
|
description: Status of the OIDC provider.
|
|
properties:
|
|
jwksSecret:
|
|
description: JWKSSecret holds the name of the secret in which this
|
|
OIDC Provider's signing/verification keys are stored. If it is empty,
|
|
then the signing/verification keys are either unknown or they don't
|
|
exist.
|
|
properties:
|
|
name:
|
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
|
TODO: Add other useful fields. apiVersion, kind, uid?'
|
|
type: string
|
|
type: object
|
|
lastUpdateTime:
|
|
description: LastUpdateTime holds the time at which the Status was
|
|
last updated. It is a pointer to get around some undesirable behavior
|
|
with respect to the empty metav1.Time value (see https://github.com/kubernetes/kubernetes/issues/86811).
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Message provides human-readable details about the Status.
|
|
type: string
|
|
status:
|
|
description: Status holds an enum that describes the state of this
|
|
OIDC Provider. Note that this Status can represent success or failure.
|
|
enum:
|
|
- Success
|
|
- Duplicate
|
|
- Invalid
|
|
type: string
|
|
type: object
|
|
required:
|
|
- spec
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
status:
|
|
acceptedNames:
|
|
kind: ""
|
|
plural: ""
|
|
conditions: []
|
|
storedVersions: []
|