8000 Create -enable-oidc command line argument for OIDC policy (#2580) · nginx/kubernetes-ingress@b60f25e · GitHub
[go: up one dir, main page]
Skip to content

Commit b60f25e

Browse files
haywoodshciarams87lucacomepleshakov
authored
Create -enable-oidc command line argument for OIDC policy (#2580)
* Add new cli flag * Remove preview from description * update flag * Fix linting * Update documentation * Remove all preview references from codebase. * Revert the whitespace changes to the Helm README * Update deployments/helm-chart/README.md Co-authored-by: Luca Comellini <luca.com@gmail.com> * Apply suggestions from code review Co-authored-by: Michael Pleshakov <pleshakov@users.noreply.github.com> Co-authored-by: Ciara Stacke <c.stacke@f5.com> Co-authored-by: Ciara Stacke <18287516+ciarams87@users.noreply.github.com> Co-authored-by: Luca Comellini <luca.com@gmail.com> Co-authored-by: Michael Pleshakov <pleshakov@users.noreply.github.com>
1 parent 192c76f commit b60f25e

File tree

19 files changed

+104
-160
lines changed

19 files changed

+104
-160
lines changed

‎cmd/nginx-ingress/main.go‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,10 @@ var (
163163
"Enable custom resources")
164164

165165
enablePreviewPolicies = flag.Bool("enable-preview-policies", false,
166-
"Enable preview policies")
166+
"Enable preview policies. This flag is deprecated. To enable OIDC Policies please use -enable-oidc instead.")
167+
168+
enableOIDC = flag.Bool("enable-oidc", false,
169+
"Enable OIDC Policies.")
167170

168171
enableSnippets = flag.Bool("enable-snippets", false,
169172
"Enable custom NGINX configuration snippets in Ingress, VirtualServer, VirtualServerRoute and TransportServer resources.")
@@ -250,6 +253,11 @@ func main() {
250253
glog.Fatal("enable-tls-passthrough flag requires -enable-custom-resources")
251254
}
252255

256+
if *enablePreviewPolicies {
257+
glog.Warning("enable-preview-policies is universally deprecated. To enable OIDC Policies please use -enable-oidc instead.")
258+
}
259+
*enableOIDC = *enablePreviewPolicies || *enableOIDC
260+
253261
if *appProtect && !*nginxPlus {
254262
glog.Fatal("NGINX App Protect support is for NGINX Plus only")
255263
}
@@ -580,7 +588,7 @@ func main() {
580588
MainAppProtectLoadModule: *appProtect,
581589
MainAppProtectDosLoadModule: *appProtectDos,
582590
EnableLatencyMetrics: *enableLatencyMetrics,
583-
EnablePreviewPolicies: *enablePreviewPolicies,
591+
EnableOIDC: *enableOIDC,
584592
SSLRejectHandshake: sslRejectHandshake,
585593
EnableCertManager: *enableCertManager,
586594
}
@@ -690,7 +698,7 @@ func main() {
690698
ConfigMaps: *nginxConfigMaps,
691699
GlobalConfiguration: *globalConfiguration,
692700
AreCustomResourcesEnabled: *enableCustomResources,
693-
EnablePreviewPolicies: *enablePreviewPolicies,
701+
EnableOIDC: *enableOIDC,
694702
MetricsCollector: controllerCollector,
695703
GlobalConfigurationValidator: globalConfigurationValidator,
696704
TransportServerValidator: transportServerValidator,

‎deployments/common/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ spec:
9999
token:
100100
type: string
101101
oidc:
102-
description: 'OIDC defines an Open ID Connect policy. policy status: preview'
102+
description: OIDC defines an Open ID Connect policy.
103103
type: object
104104
properties:
105105
authEndpoint:

‎deployments/helm-chart/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,8 @@ Parameter | Description | Default
182182
`controller.setAsDefaultIngress` | New Ingresses without an `"ingressClassName"` field specified will be assigned the class specified in `controller.ingressClass`. | false
183183
`controller.watchNamespace` | Namespace to watch for Ingress resources. By default the Ingress controller watches all namespaces. | ""
184184
`controller.enableCustomResources` | Enable the custom resources. | true
185-
`controller.enablePreviewPolicies` | Enable preview policies. | false
185+
`controller.enablePreviewPolicies` | Enable preview policies. This parameter is deprecated. To enable OIDC Policies please use `controller.enableOIDC` instead. | false
186+
`controller.enableOIDC` | Enable OIDC policies. | false
186187
`controller.enableTLSPassthrough` | Enable TLS Passthrough on port 443. Requires `controller.enableCustomResources`. | false
187188
`controller.enableCertManager` | Enable x509 automated certificate management for VirtualServer resources using cert-manager (cert-manager.io). Requires `controller.enableCustomResources`. | false
188189
`controller.globalConfiguration.create` | Creates the GlobalConfiguration custom resource. Requires `controller.enableCustomResources`. | false
@@ -216,7 +217,7 @@ Parameter | Description | Default
216217
`controller.serviceAccount.imagePullSec 6F26 retName` | The name of the secret containing docker registry credentials. Secret must exist in the same namespace as the helm release. | ""
217218
`controller.reportIngressStatus.enable` | Updates the address field in the status of Ingress resources with an external address of the Ingress controller. You must also specify the source of the external address either through an external service via `controller.reportIngressStatus.externalService`, `controller.reportIngressStatus.ingressLink` or the `external-status-address` entry in the ConfigMap via `controller.config.entries`. **Note:** `controller.config.entries.external-status-address` takes precedence over the others. | true
218219
`controller.reportIngressStatus.externalService` | Specifies the name of the service with the type LoadBalancer through which the Ingress controller is exposed externally. The external address of the service is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. `controller.reportIngressStatus.enable` must be set to `true`. The default is autogenerated and enabled when `controller.service.create` is set to `true` and `controller.service.type` is set to `LoadBalancer`. | Autogenerated
219-
`controller.reportIngressStatus.ingressLink` | Specifies the name of the IngressLink resource, which exposes the Ingress Controller pods via a BIG-IP system. The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. `controller.reportIngressStatus.enable` must be set to `true`. | ""
220+
`controller.reportIngressStatus.ingressLink` | Specifies the name of the IngressLink resource, which exposes the Ingress Controller pods via a BIG-IP system. The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. `controller.reportIngressStatus.enable` must be set to `true`. | ""
220221
`controller.reportIngressStatus.enableLeaderElection` | Enable Leader election to avoid multiple replicas of the controller reporting the status of Ingress resources. `controller.reportIngressStatus.enable` must be set to `true`. | true
221222
`controller.reportIngressStatus.leaderElectionLockName` | Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. controller.reportIngressStatus.enableLeaderElection must be set to true. | Autogenerated
222223
`controller.reportIngressStatus.annotations` | The annotations of the leader election configmap. | {}
@@ -230,7 +231,7 @@ Parameter | Description | Default
230231
`controller.appprotectdos.memory` | RAM memory size to consume in MB. | 50% of free RAM in the container or 80MB, the smaller
231232
`controller.readyStatus.enable` | Enables the readiness endpoint `"/nginx-ready"`. The endpoint returns a success code when NGINX has loaded all the config after the startup. This also configures a readiness probe for the Ingress Controller pods that uses the readiness endpoint. | true
232233
`controller.readyStatus.port` | The HTTP port for the readiness endpoint. | 8081
233-
`controller.enableLatencyMetrics` | Enable collection of latency metrics for upstreams. Requires `prometheus.create`. | false
234+
`controller.enableLatencyMetrics` | Enable collection of latency metrics for upstreams. Requires `prometheus.create`. | false
234235
`rbac.create` | Configures RBAC. | true
235236
`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | false
236237
`prometheus.port` | Configures the port to scrape the metrics. | 9113

‎deployments/helm-chart/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ spec:
9999
token:
100100
type: string
101101
oidc:
102-
description: 'OIDC defines an Open ID Connect policy. policy status: preview'
102+
description: OIDC defines an Open ID Connect policy.
103103
type: object
104104
properties:
105105
authEndpoint:

‎deployments/helm-chart/templates/controller-daemonset.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ spec:
182182
- -enable-tls-passthrough={{ .Values.controller.enableTLSPassthrough }}
183183
- -enable-preview-policies={{ .Values.controller.enablePreviewPolicies }}
184184
- -enable-cert-manager={{ .Values.controller.enableCertManager }}
185+
- -enable-oidc={{ .Values.controller.enableOIDC }}
185186
{{- if .Values.controller.globalConfiguration.create }}
186187
- -global-configuration=$(POD_NAMESPACE)/{{ include "nginx-ingress.name" . }}
187188
{{- end }}

‎deployments/helm-chart/templates/controller-deployment.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ spec:
180180
- -enable-tls-passthrough={{ .Values.controller.enableTLSPassthrough }}
181181
- -enable-preview-policies={{ .Values.controller.enablePreviewPolicies }}
182182
- -enable-cert-manager={{ .Values.controller.enableCertManager }}
183+
- -enable-oidc={{ .Values.controller.enableOIDC }}
183184
{{- if .Values.controller.globalConfiguration.create }}
184185
- -global-configuration=$(POD_NAMESPACE)/{{ include "nginx-ingress.name" . }}
185186
{{- end }}

‎deployments/helm-chart/values.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,9 +162,12 @@ controller:
162162
## Enable the custom resources.
163163
enableCustomResources: true
164164

165-
## Enable preview policies.
165+
## Enable preview policies. This parameter is deprecated. To enable OIDC Policies please use controller.enableOIDC instead.
166166
enablePreviewPolicies: false
167167

168+
## Enable OIDC policies.
169+
enableOIDC: false
170+
168171
## Enable TLS Passthrough on port 443. Requires controller.enableCustomResources.
169172
enableTLSPassthrough: false
170173

‎docs/content/configuration/global-configuration/command-line-arguments.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,15 @@ Default `true`.
5959

6060
### -enable-preview-policies
6161

62-
Enables preview policies.
62+
Enables preview policies. This flag is deprecated. To enable OIDC Policies please[-enable-oidc](#cmdoption-enable-oidc) instead.
63+
64+
Default `false`.
65+
&nbsp;
66+
<a name="cmdoption-enable-oidc"></a>
67+
68+
### -enable-oidc
69+
70+
Enables OIDC policies.
6371

6472
Default `false`.
6573
&nbsp;

‎docs/content/configuration/policy-resource.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ In this example the Ingress Controller will use the configuration from the first
276276

277277
### OIDC
278278

279-
> **Feature Status**: OIDC is available as a preview feature[^1]: We might introduce some backward-incompatible changes to the resource definition. The feature is disabled by default. To enable it, set the [enable-preview-policies](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-preview-policies) command-line argument of the Ingress Controller.
279+
> **Feature Status**: This feature is disabled by default. To enable it, set the [enable-oidc](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-enable-oidc) command-line argument of the Ingress Controller.
280280

281281
The OIDC policy configures NGINX Plus as a relying party for OpenID Connect authentication.
282282

@@ -532,7 +532,3 @@ Status:
532532
```
533533
534534
**Note**: If you make an existing resource invalid, the Ingress Controller will reject it.
535-
536-
## Footnotes
537-
538-
[^1]: Capabilities labeled in preview status are fully supported.

‎docs/content/installation/installation-with-helm.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,8 @@ The following tables lists the configurable parameters of the NGINX Ingress cont
185185
|``controller.setAsDefaultIngress`` | New Ingresses without an ingressClassName field specified will be assigned the class specified in `controller.ingressClass`. | false |
186186
|``controller.watchNamespace`` | Namespace to watch for Ingress resources. By default the Ingress controller watches all namespaces. | "" |
187187
|``controller.enableCustomResources`` | Enable the custom resources. | true |
188-
|``controller.enablePreviewPolicies`` | Enable preview policies. | false |
188+
|``controller.enablePreviewPolicies`` | Enable preview policies. This parameter is deprecated. To enable OIDC Policies please use ``controller.enableOIDC`` instead. | false |
189+
|``controller.enableOIDC`` | Enable OIDC policies. | false |
189190
|``controller.enableTLSPassthrough`` | Enable TLS Passthrough on port 443. Requires ``controller.enableCustomResources``. | false |
190191
|``controller.globalConfiguration.create`` | Creates the GlobalConfiguration custom resource. Requires ``controller.enableCustomResources``. | false |
191192
|``controller.globalConfiguration.spec`` | The spec of the GlobalConfiguration for defining the global configuration parameters of the Ingress Controller. | {} |

0 commit comments

Comments
 (0)
0