Skip to content

Commit 1745e5a

Browse files
ajanikowajanikow
authored
[Feature] [Platform] Login Endpoint (#1898)
1 parent 1b3f558 commit 1745e5a

File tree

22 files changed

+1105
-202
lines changed

22 files changed

+1105
-202
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
- (Feature) (Platform) Auth User Creation
1414
- (Maintenance) Add Common Api Import
1515
- (Feature) Previous Pod Logs in DebugPackage
16+
- (Feature) (Platform) Login & Logout Endpoints
1617

1718
## [1.2.48](https://github.com/arangodb/kube-arangodb/tree/1.2.48) (2025-05-08)
1819
- (Maintenance) Extend Documentation

‎docs/cli/arangodb_operator_integration.md

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ Available Commands:
1818
help Help about any command
1919
2020
Flags:
21+
--database.endpoint string Endpoint of ArangoDB (Env: DATABASE_ENDPOINT) (default "localhost")
22+
--database.port int Port of ArangoDB (Env: DATABASE_PORT) (default 8529)
23+
--database.proto string Proto of the ArangoDB endpoint (Env: DATABASE_PROTO) (default "http")
2124
--health.address string Address to expose health service (Env: HEALTH_ADDRESS) (default "0.0.0.0:9091")
2225
--health.auth.token string Token for health service (when auth service is token) (Env: HEALTH_AUTH_TOKEN)
2326
--health.auth.type string Auth type for health service (Env: HEALTH_AUTH_TYPE) (default "None")
@@ -26,8 +29,8 @@ Flags:
2629
-h, --help help for arangodb_operator_integration
2730
--integration.authentication.v1 Enable AuthenticationV1 Integration Service (Env: INTEGRATION_AUTHENTICATION_V1)
2831
--integration.authentication.v1.enabled Defines if Authentication is enabled (Env: INTEGRATION_AUTHENTICATION_V1_ENABLED) (default true)
29-
--integration.authentication.v1.external Defones if External access to service authentication.v1 is enabled (Env: INTEGRATION_AUTHENTICATION_V1_EXTERNAL)
30-
--integration.authentication.v1.internal Defones if Internal access to service authentication.v1 is enabled (Env: INTEGRATION_AUTHENTICATION_V1_INTERNAL) (default true)
32+
--integration.authentication.v1.external Defines if External access to service authentication.v1 is enabled (Env: INTEGRATION_AUTHENTICATION_V1_EXTERNAL)
33+
--integration.authentication.v1.internal Defines if Internal access to service authentication.v1 is enabled (Env: INTEGRATION_AUTHENTICATION_V1_INTERNAL) (default true)
3134
--integration.authentication.v1.path string Path to the JWT Folder (Env: INTEGRATION_AUTHENTICATION_V1_PATH)
3235
--integration.authentication.v1.token.allowed strings Allowed users for the Token (Env: INTEGRATION_AUTHENTICATION_V1_TOKEN_ALLOWED)
3336
--integration.authentication.v1.token.max-size uint16 Max Token max size in bytes (Env: INTEGRATION_AUTHENTICATION_V1_TOKEN_MAX_SIZE) (default 64)
@@ -37,38 +40,35 @@ Flags:
3740
--integration.authentication.v1.token.user string Default user of the Token (Env: INTEGRATION_AUTHENTICATION_V1_TOKEN_USER) (default "root")
3841
--integration.authentication.v1.ttl duration TTL of the JWT cache (Env: INTEGRATION_AUTHENTICATION_V1_TTL) (default 15s)
3942
--integration.authorization.v0 Enable AuthorizationV0 Integration Service (Env: INTEGRATION_AUTHORIZATION_V0)
40-
--integration.authorization.v0.external Defones if External access to service authorization.v0 is enabled (Env: INTEGRATION_AUTHORIZATION_V0_EXTERNAL)
41-
--integration.authorization.v0.internal Defones if Internal access to service authorization.v0 is enabled (Env: INTEGRATION_AUTHORIZATION_V0_INTERNAL) (default true)
43+
--integration.authorization.v0.external Defines if External access to service authorization.v0 is enabled (Env: INTEGRATION_AUTHORIZATION_V0_EXTERNAL)
44+
--integration.authorization.v0.internal Defines if Internal access to service authorization.v0 is enabled (Env: INTEGRATION_AUTHORIZATION_V0_INTERNAL) (default true)
4245
--integration.config.v1 Enable ConfigV1 Integration Service (Env: INTEGRATION_CONFIG_V1)
43-
--integration.config.v1.external Defones if External access to service config.v1 is enabled (Env: INTEGRATION_CONFIG_V1_EXTERNAL)
44-
--integration.config.v1.internal Defones if Internal access to service config.v1 is enabled (Env: INTEGRATION_CONFIG_V1_INTERNAL) (default true)
46+
--integration.config.v1.external Defines if External access to service config.v1 is enabled (Env: INTEGRATION_CONFIG_V1_EXTERNAL)
47+
--integration.config.v1.internal Defines if Internal access to service config.v1 is enabled (Env: INTEGRATION_CONFIG_V1_INTERNAL) (default true)
4548
--integration.config.v1.module strings Module in the reference <name>=<abs path> (Env: INTEGRATION_CONFIG_V1_MODULE)
4649
--integration.envoy.auth.v3 Enable EnvoyAuthV3 Integration Service (Env: INTEGRATION_ENVOY_AUTH_V3)
47-
--integration.envoy.auth.v3.database.endpoint string Endpoint of ArangoDB (Env: INTEGRATION_ENVOY_AUTH_V3_DATABASE_ENDPOINT)
48-
--integration.envoy.auth.v3.database.port int Port of ArangoDB (Env: INTEGRATION_ENVOY_AUTH_V3_DATABASE_PORT) (default 8529)
49-
--integration.envoy.auth.v3.database.proto string Proto of the ArangoDB endpoint (Env: INTEGRATION_ENVOY_AUTH_V3_DATABASE_PROTO) (default "http")
5050
--integration.envoy.auth.v3.extensions.cookie.jwt Defines if Cookie JWT extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_COOKIE_JWT) (default true)
5151
--integration.envoy.auth.v3.extensions.jwt Defines if JWT extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_JWT) (default true)
5252
--integration.envoy.auth.v3.extensions.users.create Defines if UserCreation extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_USERS_CREATE)
53-
--integration.envoy.auth.v3.external Defones if External access to service envoy.auth.v3 is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTERNAL)
54-
--integration.envoy.auth.v3.internal Defones if Internal access to service envoy.auth.v3 is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_INTERNAL) (default true)
53+
--integration.envoy.auth.v3.external Defines if External access to service envoy.auth.v3 is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTERNAL)
54+
--integration.envoy.auth.v3.internal Defines if Internal access to service envoy.auth.v3 is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_INTERNAL) (default true)
5555
--integration.scheduler.v1 SchedulerV1 Integration (Env: INTEGRATION_SCHEDULER_V1)
56-
--integration.scheduler.v1.external Defones if External access to service scheduler.v1 is enabled (Env: INTEGRATION_SCHEDULER_V1_EXTERNAL)
57-
--integration.scheduler.v1.internal Defones if Internal access to service scheduler.v1 is enabled (Env: INTEGRATION_SCHEDULER_V1_INTERNAL) (default true)
56+
--integration.scheduler.v1.external Defines if External access to service scheduler.v1 is enabled (Env: INTEGRATION_SCHEDULER_V1_EXTERNAL)
57+
--integration.scheduler.v1.internal Defines if Internal access to service scheduler.v1 is enabled (Env: INTEGRATION_SCHEDULER_V1_INTERNAL) (default true)
5858
--integration.scheduler.v1.namespace string Kubernetes Namespace (Env: INTEGRATION_SCHEDULER_V1_NAMESPACE) (default "default")
5959
--integration.scheduler.v1.verify-access Verify the CRD Access (Env: INTEGRATION_SCHEDULER_V1_VERIFY_ACCESS) (default true)
6060
--integration.scheduler.v2 SchedulerV2 Integration (Env: INTEGRATION_SCHEDULER_V2)
6161
--integration.scheduler.v2.deployment string ArangoDeployment Name (Env: INTEGRATION_SCHEDULER_V2_DEPLOYMENT)
6262
--integration.scheduler.v2.driver string Helm Driver (Env: INTEGRATION_SCHEDULER_V2_DRIVER) (default "secret")
63-
--integration.scheduler.v2.external Defones if External access to service scheduler.v2 is enabled (Env: INTEGRATION_SCHEDULER_V2_EXTERNAL)
64-
--integration.scheduler.v2.internal Defones if Internal access to service scheduler.v2 is enabled (Env: INTEGRATION_SCHEDULER_V2_INTERNAL) (default true)
63+
--integration.scheduler.v2.external Defines if External access to service scheduler.v2 is enabled (Env: INTEGRATION_SCHEDULER_V2_EXTERNAL)
64+
--integration.scheduler.v2.internal Defines if Internal access to service scheduler.v2 is enabled (Env: INTEGRATION_SCHEDULER_V2_INTERNAL) (default true)
6565
--integration.scheduler.v2.namespace string Kubernetes Namespace (Env: INTEGRATION_SCHEDULER_V2_NAMESPACE) (default "default")
6666
--integration.shutdown.v1 ShutdownV1 Handler (Env: INTEGRATION_SHUTDOWN_V1)
67-
--integration.shutdown.v1.external Defones if External access to service shutdown.v1 is enabled (Env: INTEGRATION_SHUTDOWN_V1_EXTERNAL)
68-
--integration.shutdown.v1.internal Defones if Internal access to service shutdown.v1 is enabled (Env: INTEGRATION_SHUTDOWN_V1_INTERNAL) (default true)
67+
--integration.shutdown.v1.external Defines if External access to service shutdown.v1 is enabled (Env: INTEGRATION_SHUTDOWN_V1_EXTERNAL)
68+
--integration.shutdown.v1.internal Defines if Internal access to service shutdown.v1 is enabled (Env: INTEGRATION_SHUTDOWN_V1_INTERNAL) (default true)
6969
--integration.storage.v2 StorageBucket V2 Integration (Env: INTEGRATION_STORAGE_V2)
70-
--integration.storage.v2.external Defones if External access to service storage.v2 is enabled (Env: INTEGRATION_STORAGE_V2_EXTERNAL)
71-
--integration.storage.v2.internal Defones if Internal access to service storage.v2 is enabled (Env: INTEGRATION_STORAGE_V2_INTERNAL) (default true)
70+
--integration.storage.v2.external Defines if External access to service storage.v2 is enabled (Env: INTEGRATION_STORAGE_V2_EXTERNAL)
71+
--integration.storage.v2.internal Defines if Internal access to service storage.v2 is enabled (Env: INTEGRATION_STORAGE_V2_INTERNAL) (default true)
7272
--integration.storage.v2.s3.allow-insecure If set to true, the Endpoint certificates won't be checked (Env: INTEGRATION_STORAGE_V2_S3_ALLOW_INSECURE)
7373
--integration.storage.v2.s3.bucket.name string Bucket name (Env: INTEGRATION_STORAGE_V2_S3_BUCKET_NAME)
7474
--integration.storage.v2.s3.bucket.prefix string Bucket Prefix (Env: INTEGRATION_STORAGE_V2_S3_BUCKET_PREFIX)

‎integrations/authentication/v1/auth.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
//
2+
// DISCLAIMER
3+
//
4+
// Copyright 2025 ArangoDB GmbH, Cologne, Germany
5+
//
6+
// Licensed under the Apache License, Version 2.0 (the "License");
7+
// you may not use this file except in compliance with the License.
8+
// You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing, software
13+
// distributed under the License is distributed on an "AS IS" BASIS,
14+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
// See the License for the specific language governing permissions and
16+
// limitations under the License.
17+
//
18+
// Copyright holder is ArangoDB GmbH, Cologne, Germany
19+
//
20+
21+
package v1
22+
23+
type authRequest struct {
24+
Username string `json:"username"`
25+
Password string `json:"password"`
26+
}
27+
28+
type authResponse struct {
29+
Token string `json:"jwt"`
30+
}

‎integrations/authentication/v1/cache.go

Lines changed: 40 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2024 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2024-2025 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -21,124 +21,75 @@
2121
package v1
2222

2323
import (
24+
"context"
2425
"io"
2526
"os"
2627
"path"
2728
"sort"
2829
"time"
2930

3031
"github.com/arangodb/kube-arangodb/pkg/util"
31-
"github.com/arangodb/kube-arangodb/pkg/util/errors"
3232
)
3333

3434
const MaxSize = 128
3535

36-
type cache struct {
37-
parent *implementation
38-
39-
eol time.Time
40-
36+
type tokens struct {
4137
signingToken []byte
4238

4339
validationTokens [][]byte
4440
}
4541

46-
func (i *implementation) newCache(cfg Configuration) (*cache, error) {
47-
files, err := os.ReadDir(i.cfg.Path)
48-
if err != nil {
49-
return nil, err
50-
}
51-
52-
var keys []string
53-
var tokens = make(map[string][]byte)
54-
55-
for _, file := range files {
56-
if file.IsDir() {
57-
continue
58-
}
59-
60-
data, err := util.OpenWithRead(path.Join(i.cfg.Path, file.Name()), MaxSize)
42+
func newCache(cfg Configuration) func(ctx context.Context) (*tokens, time.Duration, error) {
43+
return func(ctx context.Context) (*tokens, time.Duration, error) {
44+
files, err := os.ReadDir(cfg.Path)
6145
if err != nil {
62-
continue
63-
}
64-
65-
if len(data) == 0 {
66-
continue
67-
}
68-
69-
buff := make([]byte, cfg.Create.MaxSize)
70-
71-
for id := range buff {
72-
buff[id] = 0
46+
return nil, 0, err
7347
}
7448

75-
copy(buff, data)
49+
var keys []string
50+
var ts = make(map[string][]byte)
7651

77-
keys = append(keys, file.Name())
78-
tokens[file.Name()] = buff
79-
}
52+
for _, file := range files {
53+
if file.IsDir() {
54+
continue
55+
}
8056

81-
if len(keys) == 0 {
82-
return nil, io.ErrUnexpectedEOF
83-
}
57+
data, err := util.OpenWithRead(path.Join(cfg.Path, file.Name()), MaxSize)
58+
if err != nil {
59+
continue
60+
}
8461

85-
sort.Strings(keys)
62+
if len(data) == 0 {
63+
continue
64+
}
8665

87-
data := make([][]byte, len(keys))
66+
buff := make([]byte, cfg.Create.MaxSize)
8867

89-
for id := range data {
90-
data[id] = tokens[keys[id]]
91-
}
68+
for id := range buff {
69+
buff[id] = 0
70+
}
9271

93-
cache := cache{
94-
parent: i,
95-
eol: time.Now().Add(i.cfg.TTL),
96-
signingToken: tokens[keys[0]],
97-
validationTokens: data,
98-
}
72+
copy(buff, data)
9973

100-
return &cache, nil
101-
}
102-
103-
func (i *implementation) localGetCache() *cache {
104-
if c := i.cache; c != nil && c.eol.After(time.Now()) {
105-
return c
106-
}
107-
108-
return nil
109-
}
110-
111-
func (i *implementation) withCache() (*cache, error) {
112-
if c := i.getCache(); c != nil {
113-
return c, nil
114-
}
115-
116-
return i.refreshCache()
117-
}
118-
119-
func (i *implementation) getCache() *cache {
120-
i.lock.RLock()
121-
defer i.lock.RUnlock()
74+
keys = append(keys, file.Name())
75+
ts[file.Name()] = buff
76+
}
12277

123-
return i.localGetCache()
124-
}
78+
if len(keys) == 0 {
79+
return nil, 0, io.ErrUnexpectedEOF
80+
}
12581

126-
func (i *implementation) refreshCache() (*cache, error) {
127-
i.lock.Lock()
128-
defer i.lock.Unlock()
82+
sort.Strings(keys)
12983

130-
if c := i.localGetCache(); c != nil {
131-
return c, nil
132-
}
84+
data := make([][]byte, len(keys))
13385

134-
// Get was not successful, retry
86+
for id := range data {
87+
data[id] = ts[keys[id]]
88+
}
13589

136-
if c, err := i.newCache(i.cfg); err != nil {
137-
return nil, err
138-
} else if c == nil {
139-
return nil, errors.Errorf("cache returned is nil")
140-
} else {
141-
i.cache = c
142-
return i.cache, nil
90+
return &tokens{
91+
signingToken: ts[keys[0]],
92+
validationTokens: data,
93+
}, cfg.TTL, nil
14394
}
14495
}

‎integrations/authentication/v1/configuration.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2024 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2024-2025 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -67,6 +67,14 @@ type Configuration struct {
6767
Path string
6868

6969
Create Token
70+
71+
Database ConfigurationDatabase
72+
}
73+
74+
type ConfigurationDatabase struct {
75+
Proto string
76+
Endpoint string
77+
Port int
7078
}
7179

7280
func (c Configuration) With(mods ...Mod) Configuration {

0 commit comments

Comments
 (0)