Skip to content

Commit f777d4f

Browse files
ajanikowajanikow
authored
[Feature] [Platform] OpenID Integration (#1892)
1 parent 1745e5a commit f777d4f

32 files changed

+1383
-49
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
- (Maintenance) Add Common Api Import
1515
- (Feature) Previous Pod Logs in DebugPackage
1616
- (Feature) (Platform) Login & Logout Endpoints
17+
- (Feature) (Platform) OpenID Integration
1718

1819
## [1.2.48](https://github.com/arangodb/kube-arangodb/tree/1.2.48) (2025-05-08)
1920
- (Maintenance) Extend Documentation

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ Flags:
201201
--kubernetes.max-batch-size int Size of batch during objects read (default 256)
202202
--kubernetes.qps float32 Number of queries per second for k8s API (default 32)
203203
--log.format string Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
204-
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-envoy-auth-v3-impl-auth-bearer, integration-envoy-auth-v3-impl-auth-cookie, integration-envoy-auth-v3-impl-pass-mode, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes, kubernetes-access, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
204+
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-envoy-auth-v3-impl-auth-bearer, integration-envoy-auth-v3-impl-auth-cookie, integration-envoy-auth-v3-impl-custom-openid, integration-envoy-auth-v3-impl-pass-mode, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes, kubernetes-access, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
205205
--log.sampling If true, operator will try to minimize duplication of logging events (default true)
206206
--log.stdout If true, operator will log to the stdout (default true)
207207
--memory-limit uint Define memory limit for hard shutdown and the dump of goroutines. Used for testing

‎docs/api/ArangoPlatform.V1Alpha1.Authentication.OpenID.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
layout: page
3+
parent: CRD reference
4+
title: ArangoPlatform V1Alpha1 Authentication OpenID
5+
---
6+
7+
# API Reference for ArangoPlatform V1Alpha1 Authentication OpenID
8+
9+
##
10+
11+
### .client.id
12+
13+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L223)</sup>
14+
15+
ID defines OpenID Client ID
16+
17+
***
18+
19+
### .client.secret
20+
21+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L226)</sup>
22+
23+
Secret defines OpenID Client Secret
24+
25+
***
26+
27+
### .disabledPaths
28+
29+
Type: `array` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L67)</sup>
30+
31+
DisabledPaths keeps the list of SSO disabled paths. By default, "_logout" endpoint is passed through
32+
33+
***
34+
35+
### .endpoint
36+
37+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L61)</sup>
38+
39+
Endpoint defines the OpenID callback Endpoint
40+
41+
***
42+
43+
### .http.insecure
44+
45+
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L179)</sup>
46+
47+
Insecure defines if insecure HTTP Client is used
48+
49+
Default Value: `false`
50+
51+
***
52+
53+
### .provider..authorizationEndpoint
54+
55+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L210)</sup>
56+
57+
AuthorizationEndpoint defines OpenID Authorization Endpoint
58+
59+
Links:
60+
* [Documentation](https://www.ibm.com/docs/en/was-liberty/base?topic=connect-openid-endpoint-urls#rwlp_oidc_endpoint_urls__auth_endpoint__title__1)
61+
62+
***
63+
64+
### .provider..tokenEndpoint
65+
66+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L214)</sup>
67+
68+
TokenEndpoint defines OpenID Token Endpoint
69+
70+
Links:
71+
* [Documentation](https://www.ibm.com/docs/en/was-liberty/base?topic=connect-openid-endpoint-urls#rwlp_oidc_endpoint_urls__token_endpoint__title__1)
72+
73+
***
74+
75+
### .provider..userInfoEndpoint
76+
77+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L218)</sup>
78+
79+
UserInfoEndpoint defines OpenID UserInfo Endpoint
80+
81+
Links:
82+
* [Documentation](https://www.ibm.com/docs/en/was-liberty/base?topic=connect-openid-endpoint-urls#rwlp_oidc_endpoint_urls__userinfo_endpoint__title__1)
83+
84+
***
85+
86+
### .provider.issuer
87+
88+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L204)</sup>
89+
90+
Issuer defines OpenID Issuer
91+
92+
***
93+
94+
### .scope
95+
96+
Type: `array` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L64)</sup>
97+
98+
Scope defines OpenID Scopes (OpenID is added by default).
99+

‎docs/cli/arangodb_operator.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ Flags:
8585
--kubernetes.max-batch-size int Size of batch during objects read (default 256)
8686
--kubernetes.qps float32 Number of queries per second for k8s API (default 32)
8787
--log.format string Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
88-
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-envoy-auth-v3-impl-auth-bearer, integration-envoy-auth-v3-impl-auth-cookie, integration-envoy-auth-v3-impl-pass-mode, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes, kubernetes-access, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
88+
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-envoy-auth-v3-impl-auth-bearer, integration-envoy-auth-v3-impl-auth-cookie, integration-envoy-auth-v3-impl-custom-openid, integration-envoy-auth-v3-impl-pass-mode, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes, kubernetes-access, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
8989
--log.sampling If true, operator will try to minimize duplication of logging events (default true)
9090
--log.stdout If true, operator will log to the stdout (default true)
9191
--memory-limit uint Define memory limit for hard shutdown and the dump of goroutines. Used for testing

‎docs/cli/arangodb_operator_integration.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ Flags:
4747
--integration.config.v1.internal Defines if Internal access to service config.v1 is enabled (Env: INTEGRATION_CONFIG_V1_INTERNAL) (default true)
4848
--integration.config.v1.module strings Module in the reference <name>=<abs path> (Env: INTEGRATION_CONFIG_V1_MODULE)
4949
--integration.envoy.auth.v3 Enable EnvoyAuthV3 Integration Service (Env: INTEGRATION_ENVOY_AUTH_V3)
50+
--integration.envoy.auth.v3.auth.enabled Defines if Auth extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_AUTH_ENABLED)
51+
--integration.envoy.auth.v3.auth.path string Path of the config file (Env: INTEGRATION_ENVOY_AUTH_V3_AUTH_PATH)
52+
--integration.envoy.auth.v3.auth.type string Defines type of the authentication (Env: INTEGRATION_ENVOY_AUTH_V3_AUTH_TYPE) (default "OpenID")
5053
--integration.envoy.auth.v3.extensions.cookie.jwt Defines if Cookie JWT extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_COOKIE_JWT) (default true)
5154
--integration.envoy.auth.v3.extensions.jwt Defines if JWT extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_JWT) (default true)
5255
--integration.envoy.auth.v3.extensions.users.create Defines if UserCreation extension is enabled (Env: INTEGRATION_ENVOY_AUTH_V3_EXTENSIONS_USERS_CREATE)

‎docs/platform.sso.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
layout: page
3+
has_children: true
4+
title: SSO
5+
parent: ArangoDBPlatform
6+
nav_order: 4
7+
---
8+
9+
# Platform SSO

‎docs/platform.sso.openid.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
layout: page
3+
title: OpenID
4+
grand_parent: ArangoDBPlatform
5+
parent: SSO
6+
---
7+
8+
# Platform SSO with OpenID
9+
10+
## OpenID Configuration
11+
12+
[Full Configuration reference ->](./api/ArangoPlatform.V1Alpha1.Authentication.OpenID.md)
13+
14+
Example:
15+
16+
```yaml
17+
---
18+
19+
client:
20+
id: <ID>
21+
secret: <SECRET>
22+
23+
provider:
24+
issuer: <ISSUER>
25+
26+
endpoint: https://myapp.example.com
27+
```
28+
29+
## Setup
30+
31+
In order to enable OpenID on the Platform, secret with OpenID Configuration needs to be created.
32+
33+
Example setup will be followed on the example of AWS Cognito Pool.
34+
35+
Secret Creation:
36+
37+
```shell
38+
echo "---
39+
40+
client:
41+
id: 6jomgv6104au8mm41idunxxxxx
42+
secret: 1uqqtp2tcrm38b31bmu756n30nrcqthisgauba3sntmm76fxxxxxx
43+
44+
provider:
45+
issuer: https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_xxxxxxxx
46+
47+
endpoint: https://myapp.example.com" > ./config.yaml
48+
49+
kubectl create secret generic openid-secret --from-file=config=./config.yaml
50+
```
51+
52+
Once Secret has been created, ArangoDeployment can be configured to work with the new authentication:
53+
54+
```yaml
55+
apiVersion: "database.arangodb.com/v1"
56+
kind: "ArangoDeployment"
57+
metadata:
58+
name: "platform-simple-single"
59+
spec:
60+
gateway:
61+
createUsers: true # Allows user creation by default from the SSO
62+
authentication:
63+
type: OpenID # Picks the OpenID Type of the authentication
64+
secret:
65+
name: openid-secret # Created Secret based on the Documentation
66+
```

‎examples/platform-single-server-sso.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: "database.arangodb.com/v1"
2+
kind: "ArangoDeployment"
3+
metadata:
4+
name: "platform-simple-single"
5+
spec:
6+
mode: Single
7+
image: 'arangodb/enterprise:3.12.2'
8+
gateway:
9+
enabled: true
10+
dynamic: true
11+
createUsers: true # Allows user creation by default from the SSO
12+
authentication:
13+
type: OpenID # Picks the OpenID Type of the authentication
14+
secret:
15+
name: openid-secret # Created Secret based on the Documentation
16+
gateways:
17+
count: 1

‎go.mod

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,12 @@ require (
7878
github.com/arangodb-managed/apis v0.89.1
7979
github.com/arangodb-managed/integration-apis v0.2.1
8080
github.com/aws/aws-sdk-go v1.55.6
81+
github.com/coreos/go-oidc/v3 v3.14.1
8182
github.com/go-logr/zerologr v1.2.3
8283
github.com/golang-jwt/jwt/v5 v5.2.2
8384
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1
8485
github.com/jedib0t/go-pretty/v6 v6.6.5
86+
golang.org/x/oauth2 v0.28.0
8587
google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489
8688
helm.sh/helm/v3 v3.17.3
8789
k8s.io/klog/v2 v2.130.1
@@ -133,6 +135,7 @@ require (
133135
github.com/gin-contrib/sse v0.1.0 // indirect
134136
github.com/go-errors/errors v1.4.2 // indirect
135137
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
138+
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
136139
github.com/go-logr/logr v1.4.2 // indirect
137140
github.com/go-logr/stdr v1.2.2 // indirect
138141
github.com/go-openapi/jsonpointer v0.21.0 // indirect
@@ -217,7 +220,6 @@ require (
217220
golang.org/x/arch v0.3.0 // indirect
218221
golang.org/x/crypto v0.36.0 // indirect
219222
golang.org/x/net v0.38.0 // indirect
220-
golang.org/x/oauth2 v0.26.0 // indirect
221223
golang.org/x/term v0.30.0 // indirect
222224
golang.org/x/tools v0.27.0 // indirect
223225
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect

‎go.sum

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -968,6 +968,8 @@ github.com/containers/ocicrypt v1.1.6/go.mod h1:WgjxPWdTJMqYMjf3M6cuIFFA1/MpyyhI
968968
github.com/coreos/go-iptables v0.4.3/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
969969
github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
970970
github.com/coreos/go-oidc v2.2.1+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
971+
github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
972+
github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
971973
github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
972974
github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
973975
github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
@@ -1097,6 +1099,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
10971099
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
10981100
github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
10991101
github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
1102+
github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
1103+
github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
11001104
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
11011105
github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
11021106
github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
@@ -1974,6 +1978,8 @@ golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
19741978
golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
19751979
golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE=
19761980
golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
1981+
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
1982+
golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
19771983
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
19781984
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
19791985
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

0 commit comments

Comments
 (0)