Skip to content

Commit ebbceec

Browse files
kellyyankellyyan
committed
Add authenticationConfiguration to Ingress Class Params
1 parent d0df42b commit ebbceec

14 files changed

+1131
-70
lines changed

‎apis/elbv2/v1beta1/ingressclassparams_types.go

Lines changed: 104 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,110 @@ type IPAMConfiguration struct {
114114
IPv4IPAMPoolId *string `json:"ipv4IPAMPoolId,omitempty"`
115115
}
116116

117+
type AuthType string
118+
119+
const (
120+
AuthTypeNone AuthType = "none"
121+
AuthTypeCognito AuthType = "cognito"
122+
AuthTypeOIDC AuthType = "oidc"
123+
)
124+
125+
// Amazon Cognito user pools configuration
126+
type AuthIDPConfigCognito struct {
127+
// The Amazon Resource Name (ARN) of the Amazon Cognito user pool.
128+
UserPoolARN string `json:"userPoolARN"`
129+
130+
// The ID of the Amazon Cognito user pool client.
131+
UserPoolClientID string `json:"userPoolClientID"`
132+
133+
// The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
134+
// If you are using Amazon Cognito Domain, the userPoolDomain should be set to the domain prefix (my-domain) instead of full domain (https://my-domain.auth.us-west-2.amazoncognito.com).
135+
UserPoolDomain string `json:"userPoolDomain"`
136+
137+
// The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
138+
// +kubebuilder:validation:MinProperties=1
139+
// +kubebuilder:validation:MaxProperties=10
140+
// +optional
141+
AuthenticationRequestExtraParams map[string]string `json:"authenticationRequestExtraParams,omitempty"`
142+
}
143+
144+
// OpenID Connect (OIDC) identity provider (IdP) configuration
145+
type AuthIDPConfigOIDC struct {
146+
// The OIDC issuer identifier of the IdP.
147+
Issuer string `json:"issuer"`
148+
149+
// The authorization endpoint of the IdP.
150+
AuthorizationEndpoint string `json:"authorizationEndpoint"`
151+
152+
// The token endpoint of the IdP.
153+
TokenEndpoint string `json:"tokenEndpoint"`
154+
155+
// The user info endpoint of the IdP.
156+
UserInfoEndpoint string `json:"userInfoEndpoint"`
157+
158+
// The k8s secret name.
159+
// * Secret must be created in the same namespace as the Ingress.
160+
// * Secret must contain base64 encoded clientID and clientSecret.
161+
// * Example format:
162+
// apiVersion: v1
163+
// kind: Secret
164+
// metadata:
165+
// namespace: testcase
166+
// name: my-k8s-secret
167+
// data:
168+
// clientID: base64 of your plain text clientId
169+
// clientSecret: base64 of your plain text clientSecret
170+
SecretName string `json:"secretName"`
171+
172+
// The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
173+
// +kubebuilder:validation:MinProperties=1
174+
// +kubebuilder:validation:MaxProperties=10
175+
// +optional
176+
AuthenticationRequestExtraParams map[string]string `json:"authenticationRequestExtraParams,omitempty"`
177+
}
178+
179+
// Auth config for Service / Ingresses
180+
type AuthConfig struct {
181+
// The authentication type on targets.
182+
// +kubebuilder:validation:Enum=none;oidc;cognito
183+
Type AuthType `json:"type"`
184+
185+
// The Cognito IdP configuration.
186+
// +optional
187+
IDPConfigCognito *AuthIDPConfigCognito `json:"idpCognitoConfiguration,omitempty"`
188+
189+
// The OIDC IdP configuration.
190+
// +optional
191+
IDPConfigOIDC *AuthIDPConfigOIDC `json:"idpOidcConfiguration,omitempty"`
192+
193+
// The behavior if the user is not authenticated.
194+
// +kubebuilder:validation:Enum=authenticate;deny;allow
195+
// +optional
196+
OnUnauthenticatedRequest string `json:"onUnauthenticatedRequest,omitempty"`
197+
198+
// The set of user claims to be requested from the Cognito IdP or OIDC IdP, in a space-separated list.
199+
// * Options: phone, email, profile, openid, aws.cognito.signin.user.admin
200+
// * Ex. 'email openid'
201+
// +optional
202+
Scope string `json:"scope,omitempty"`
203+
204+
// The name of the cookie used to maintain session information.
205+
// +optional
206+
SessionCookieName string `json:"sessionCookie,omitempty"`
207+
208+
// The maximum duration of the authentication session, in seconds.
209+
// +optional
210+
SessionTimeout *int64 `json:"sessionTimeout,omitempty"`
211+
}
212+
117213
// IngressClassParamsSpec defines the desired state of IngressClassParams
118214
type IngressClassParamsSpec struct {
119215
// CertificateArn specifies the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
120216
// +optional
121217
CertificateArn []string `json:"certificateArn,omitempty"`
122218

123219
// NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams.
124-
// * if absent or present but empty, it selects all namespaces.
220+
// * If absent or present but empty, it selects all namespaces.
125221
// +optional
126222
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
127223

@@ -145,11 +241,12 @@ type IngressClassParamsSpec struct {
145241
// +optional
146242
Subnets *SubnetSelector `json:"subnets,omitempty"`
147243

148-
// IPAddressType defines the ip address type for all Ingresses that belong to IngressClass with this IngressClassParams.
244+
// IPAddressType defines the IP address type for all Ingresses that belong to IngressClass with this IngressClassParams.
149245
// +optional
150246
IPAddressType *IPAddressType `json:"ipAddressType,omitempty"`
151247

152248
// Tags defines list of Tags on AWS resources provisioned for Ingresses that belong to IngressClass with this IngressClassParams.
249+
// +optional
153250
Tags []Tag `json:"tags,omitempty"`
154251

155252
// LoadBalancerAttributes define the custom attributes to LoadBalancers for all Ingress that that belong to IngressClass with this IngressClassParams.
@@ -169,7 +266,12 @@ type IngressClassParamsSpec struct {
169266
IPAMConfiguration *IPAMConfiguration `json:"ipamConfiguration,omitempty"`
170267

171268
// PrefixListsIDs defines the security group prefix lists for all Ingresses that belong to IngressClass with this IngressClassParams.
269+
// +optional
172270
PrefixListsIDs []string `json:"PrefixListsIDs,omitempty"`
271+
272+
// AuthenticationConfiguration defines the authentication configuration for a Load Balancer. Application Load Balancer (ALB) supports authentication with Cognito or OIDC.
273+
// +optional
274+
AuthConfig *AuthConfig `json:"authenticationConfiguration,omitempty"`
173275
}
174276

175277
// +kubebuilder:object:root=true

‎apis/elbv2/v1beta1/zz_generated.deepcopy.go

Lines changed: 79 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/elbv2.k8s.aws_ingressclassparams.yaml

Lines changed: 111 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,115 @@ spec:
6161
items:
6262
type: string
6363
type: array
64+
authenticationConfiguration:
65+
description: AuthenticationConfiguration defines the authentication
66+
configuration for a Load Balancer. Application Load Balancer (ALB)
67+
supports authentication with Cognito or OIDC.
68+
properties:
69+
idpCognitoConfiguration:
70+
description: The Cognito IdP configuration.
71+
properties:
72+
authenticationRequestExtraParams:
73+
additionalProperties:
74+
type: string
75+
description: The query parameters (up to 10) to include in
76+
the redirect request to the authorization endpoint.
77+
maxProperties: 10
78+
minProperties: 1
79+
type: object
80+
userPoolARN:
81+
description: The Amazon Resource Name (ARN) of the Amazon
82+
Cognito user pool.
83+
type: string
84+
userPoolClientID:
85+
description: The ID of the Amazon Cognito user pool client.
86+
type: string
87+
userPoolDomain:
88+
description: |-
89+
The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
90+
If you are using Amazon Cognito Domain, the userPoolDomain should be set to the domain prefix (my-domain) instead of full domain (https://my-domain.auth.us-west-2.amazoncognito.com).
91+
type: string
92+
required:
93+
- userPoolARN
94+
- userPoolClientID
95+
- userPoolDomain
96+
type: object
97+
idpOidcConfiguration:
98+
description: The OIDC IdP configuration.
99+
properties:
100+
authenticationRequestExtraParams:
101+
additionalProperties:
102+
type: string
103+
description: The query parameters (up to 10) to include in
104+
the redirect request to the authorization endpoint.
105+
maxProperties: 10
106+
minProperties: 1
107+
type: object
108+
authorizationEndpoint:
109+
description: The authorization endpoint of the IdP.
110+
type: string
111+
issuer:
112+
description: The OIDC issuer identifier of the IdP.
113+
type: string
114+
secretName:
115+
description: |-
116+
The k8s secret name.
117+
* Secret must be created in the same namespace as the Ingress.
118+
* Secret must contain base64 encoded clientID and clientSecret.
119+
* Example format:
120+
apiVersion: v1
121+
kind: Secret
122+
metadata:
123+
namespace: testcase
124+
name: my-k8s-secret
125+
data:
126+
clientID: base64 of your plain text clientId
127+
clientSecret: base64 of your plain text clientSecret
128+
type: string
129+
tokenEndpoint:
130+
description: The token endpoint of the IdP.
131+
type: string
132+
userInfoEndpoint:
133+
description: The user info endpoint of the IdP.
134+
type: string
135+
required:
136+
- authorizationEndpoint
137+
- issuer
138+
- secretName
139+
- tokenEndpoint
140+
- userInfoEndpoint
141+
type: object
142+
onUnauthenticatedRequest:
143+
description: The behavior if the user is not authenticated.
144+
enum:
145+
- authenticate
146+
- deny
147+
- allow
148+
type: string
149+
scope:
150+
description: |-
151+
The set of user claims to be requested from the Cognito IdP or OIDC IdP, in a space-separated list.
152+
* Options: phone, email, profile, openid, aws.cognito.signin.user.admin
153+
* Ex. 'email openid'
154+
type: string
155+
sessionCookie:
156+
description: The name of the cookie used to maintain session information.
157+
type: string
158+
sessionTimeout:
159+
description: The maximum duration of the authentication session,
160+
in seconds.
161+
format: int64
162+
type: integer
163+
type:
164+
description: The authentication type on targets.
165+
enum:
166+
- none
167+
- oidc
168+
- cognito
169+
type: string
170+
required:
171+
- type
172+
type: object
64173
certificateArn:
65174
description: CertificateArn specifies the ARN of the certificates
66175
for all Ingresses that belong to IngressClass with this IngressClassParams.
@@ -84,7 +193,7 @@ spec:
84193
type: string
85194
type: array
86195
ipAddressType:
87-
description: IPAddressType defines the ip address type for all Ingresses
196+
description: IPAddressType defines the IP address type for all Ingresses
88197
that belong to IngressClass with this IngressClassParams.
89198
enum:
90199
- ipv4
@@ -163,7 +272,7 @@ spec:
163272
namespaceSelector:
164273
description: |-
165274
NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams.
166-
* if absent or present but empty, it selects all namespaces.
275+
* If absent or present but empty, it selects all namespaces.
167276
properties:
168277
matchExpressions:
169278
description: matchExpressions is a list of label selector requirements.

0 commit comments

Comments
 (0)