8000 add policy · nginx/kubernetes-ingress@e4d4519 · GitHub
[go: up one dir, main page]
Skip to content

Commit e4d4519

Browse files
lucacomelucacome
committed
add policy
1 parent 700836c commit e4d4519

File tree

10 files changed

+108
-57
lines changed

10 files changed

+108
-57
lines changed

‎deployments/common/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,8 @@ spec:
116116
type: string
117117
tokenEndpoint:
118118
type: string
119+
zoneSyncLeeway:
120+
type: integer
119121
rateLimit:
120122
description: RateLimit defines a rate limit policy.
121123
type: object

‎deployments/helm-chart/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,8 @@ spec:
116116
type: string
117117
tokenEndpoint:
118118
type: string
119+
zoneSyncLeeway:
120+
type: integer
119121
rateLimit:
120122
description: RateLimit defines a rate limit policy.
121123
type: object

‎internal/configs/version2/http.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,14 @@ type EgressMTLS struct {
109109

110110
// OIDC holds OIDC configuration data.
111111
type OIDC struct {
112-
AuthEndpoint string
113-
ClientID string
114-
ClientSecret string
115-
JwksURI string
116-
Scope string
117-
TokenEndpoint string
118-
RedirectURI string
112+
AuthEndpoint string
113+
ClientID string
114+
ClientSecret string
115+
JwksURI string
116+
Scope string
117+
TokenEndpoint string
118+
RedirectURI string
119+
ZoneSyncLeeway int
119120
}
120121

121122
// WAF defines WAF configuration.

‎internal/configs/version2/nginx-plus.virtualserver.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ server {
7171
include oidc/oidc.conf;
7272

7373
set $oidc_pkce_enable 0;
74-
set $zone_sync_leeway 0;
7574
set $oidc_logout_redirect "/_logout";
7675
set $oidc_hmac_key "{{ $s.VSName }}";
76+
set $zone_sync_leeway {{ $oidc.ZoneSyncLeeway }};
7777

7878
set $oidc_authz_endpoint "{{ $oidc.AuthEndpoint }}";
7979
set $oidc_token_endpoint "{{ $oidc.TokenEndpoint }}";

‎internal/configs/virtualserver.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -991,13 +991,14 @@ func (p *policiesCfg) addOIDCConfig(
991991
}
992992

993993
oidcPolCfg.oidc = &version2.OIDC{
994-
AuthEndpoint: oidc.AuthEndpoint,
995-
TokenEndpoint: oidc.TokenEndpoint,
996-
JwksURI: oidc.JWKSURI,
997-
ClientID: oidc.ClientID,
998-
ClientSecret: string(clientSecret),
999-
Scope: scope,
1000-
RedirectURI: redirectURI,
994+
AuthEndpoint: oidc.AuthEndpoint,
995+
TokenEndpoint: oidc.TokenEndpoint,
996+
JwksURI: oidc.JWKSURI,
997+
ClientID: oidc.ClientID,
998+
ClientSecret: string(clientSecret),
999+
Scope: scope,
1000+
RedirectURI: redirectURI,
1001+
ZoneSyncLeeway: generateIntFromPointer(oidc.ZoneSyncLeeway, 0),
10011002
}
10021003
oidcPolCfg.key = polKey
10031004
}

‎internal/configs/virtualserver_test.go‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2894,13 +2894,14 @@ func TestGeneratePolicies(t *testing.T) {
28942894
},
28952895
Spec: conf_v1.PolicySpec{
28962896
OIDC: &conf_v1.OIDC{
2897-
AuthEndpoint: "http://example.com/auth",
2898-
TokenEndpoint: "http://example.com/token",
2899-
JWKSURI: "http://example.com/jwks",
2900-
ClientID: "client-id",
2901-
ClientSecret: "oidc-secret",
2902-
Scope: "scope",
2903-
RedirectURI: "/redirect",
2897+
AuthEndpoint: "http://example.com/auth",
2898+
TokenEndpoint: "http://example.com/token",
2899+
JWKSURI: "http://example.com/jwks",
2900+
ClientID: "client-id",
2901+
ClientSecret: "oidc-secret",
2902+
Scope: "scope",
2903+
RedirectURI: "/redirect",
2904+
ZoneSyncLeeway: createPointerFromInt(20),
29042905
},
29052906
},
29062907
},
@@ -3891,13 +3892,14 @@ func TestGeneratePoliciesFails(t *testing.T) {
38913892
context: "route",
38923893
oidcPolCfg: &oidcPolicyCfg{
38933894
oidc: &version2.OIDC{
3894-
AuthEndpoint: "https://foo.com/auth",
3895-
TokenEndpoint: "https://foo.com/token",
3896-
JwksURI: "https://foo.com/certs",
3897-
ClientID: "foo",
3898-
ClientSecret: "super_secret_123",
3899-
RedirectURI: "/_codexch",
3900-
Scope: "openid",
3895+
AuthEndpoint: "https://foo.com/auth",
3896+
TokenEndpoint: "https://foo.com/token",
3897+
JwksURI: "https://foo.com/certs",
3898+
ClientID: "foo",
3899+
ClientSecret: "super_secret_123",
3900+
RedirectURI: "/_codexch",
3901+
Scope: "openid",
3902+
ZoneSyncLeeway: 0,
39013903
},
39023904
key: "default/oidc-policy-1",
39033905
},
@@ -3991,13 +3993,14 @@ func TestGeneratePoliciesFails(t *testing.T) {
39913993
},
39923994
expectedOidc: &oidcPolicyCfg{
39933995
&version2.OIDC{
3994-
AuthEndpoint: "https://foo.com/auth",
3995-
TokenEndpoint: "https://foo.com/token",
3996-
JwksURI: "https://foo.com/certs",
3997-
ClientID: "foo",
3998-
ClientSecret: "super_secret_123",
3999-
RedirectURI: "/_codexch",
4000-
Scope: "openid",
3996+
AuthEndpoint: "https://foo.com/auth",
3997+
TokenEndpoint: "https://foo.com/token",
3998+
JwksURI: "https://foo.com/certs",
3999+
ClientID: "foo",
4000+
ClientSecret: "super_secret_123",
4001+
RedirectURI: "/_codexch",
4002+
Scope: "openid",
4003+
ZoneSyncLeeway: 0,
40014004
},
40024005
"default/oidc-policy",
40034006
},

‎pkg/apis/configuration/v1/types.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -434,13 +434,14 @@ type EgressMTLS struct {
434434

435435
// OIDC defines an Open ID Connect policy.
436436
type OIDC struct {
437-
AuthEndpoint string `json:"authEndpoint"`
438-
TokenEndpoint string `json:"tokenEndpoint"`
439-
JWKSURI string `json:"jwksURI"`
440-
ClientID string `json:"clientID"`
441-
ClientSecret string `json:"clientSecret"`
442-
Scope string `json:"scope"`
443-
RedirectURI string `json:"redirectURI"`
437+
AuthEndpoint string `json:"authEndpoint"`
438+
TokenEndpoint string `json:"tokenEndpoint"`
439+
JWKSURI string `json:"jwksURI"`
440+
ClientID string `json:"clientID"`
441+
ClientSecret string `json:"clientSecret"`
442+
Scope string `json:"scope"`
443+
RedirectURI string `json:"redirectURI"`
444+
ZoneSyncLeeway *int `json:"zoneSyncLeeway"`
444445
}
445446

446447
// WAF defines an WAF policy.

‎pkg/apis/configuration/v1/zz_generated.deepcopy.go‎

Lines changed: 6 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/configuration/validation/policy.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,10 @@ func validateOIDC(oidc *v1.OIDC, fieldPath *field.Path) field.ErrorList {
222222
allErrs = append(allErrs, validatePath(oidc.RedirectURI, fieldPath.Child("redirectURI"))...)
223223
}
224224

225+
if oidc.ZoneSyncLeeway != nil {
226+
allErrs = append(allErrs, validatePositiveIntOrZero(*oidc.ZoneSyncLeeway, fieldPath.Child("zoneSyncLeeway"))...)
227+
}
228+
225229
allErrs = append(allErrs, validateURL(oidc.AuthEndpoint, fieldPath.Child("authEndpoint"))...)
226230
allErrs = append(allErrs, validateURL(oidc.TokenEndpoint, fieldPath.Child("tokenEndpoint"))...)
227231
allErrs = append(allErrs, validateURL(oidc.JWKSURI, fieldPath.Child("jwksURI"))...)

‎pkg/apis/configuration/validation/policy_test.go‎

Lines changed: 45 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,13 @@ func TestValidatePolicy(t *testing.T) {
4646
policy: &v1.Policy{
4747
Spec: v1.PolicySpec{
4848
OIDC: &v1.OIDC{
49-
AuthEndpoint: "https://foo.bar/auth",
50-
TokenEndpoint: "https://foo.bar/token",
51-
JWKSURI: "https://foo.bar/certs",
52-
ClientID: "random-string",
53-
ClientSecret: "random-secret",
54-
Scope: "openid",
49+
AuthEndpoint: "https://foo.bar/auth",
50+
TokenEndpoint: "https://foo.bar/token",
51+
JWKSURI: "https://foo.bar/certs",
52+
ClientID: "random-string",
53+
ClientSecret: "random-secret",
54+
Scope: "openid",
55+
ZoneSyncLeeway: createPointerFromInt(10),
5556
},
5657
},
5758
},
@@ -191,6 +192,24 @@ func TestValidatePolicyFails(t *testing.T) {
191192
enableAppProtect: false,
192193
msg: "WAF policy with AP disabled",
193194
},
195+
{
196+
policy: &v1.Policy{
197+
Spec: v1.PolicySpec{
198+
OIDC: &v1.OIDC{
199+
AuthEndpoint: "https://foo.bar/auth",
200+
TokenEndpoint: "https://foo.bar/token",
201+
JWKSURI: "https://foo.bar/certs",
202+
ClientID: "random-string",
203+
ClientSecret: "random-secret",
204+
Scope: "openid",
205+
ZoneSyncLeeway: createPointerFromInt(-1),
206+
},
207+
},
208+
},
209+
isPlus: true,
210+
enableOIDC: true,
211+
msg: "OIDC policy with invalid ZoneSyncLeeway",
212+
},
194213
}
195214
for _, test := range tests {
196215
err := ValidatePolicy(test.policy, test.isPlus, test.enableOIDC, test.enableAppProtect)
@@ -852,13 +871,14 @@ func TestValidateOIDCValid(t *testing.T) {
852871
}{
853872
{
854873
oidc: &v1.OIDC{
855-
AuthEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
856-
TokenEndpoint: "https://oauth2. B72 googleapis.com/token",
857-
JWKSURI: "https://www.googleapis.com/oauth2/v3/certs",
858- ClientID: "random-string",
859-
ClientSecret: "random-secret",
860-
Scope: "openid",
861-
RedirectURI: "/foo",
874+
AuthEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
875+
TokenEndpoint: "https://oauth2.googleapis.com/token",
876+
JWKSURI: "https://www.googleapis.com/oauth2/v3/certs",
877+
ClientID: "random-string",
878+
ClientSecret: "random-secret",
879+
Scope: "openid",
880+
RedirectURI: "/foo",
881+
ZoneSyncLeeway: createPointerFromInt(20),
862882
},
863883
msg: "verify full oidc",
864884
},
@@ -992,6 +1012,18 @@ func TestValidateOIDCInvalid(t *testing.T) {
9921012
},
9931013
msg: "invalid chars in clientID",
9941014
},
1015+
{
1016+
oidc: &v1.OIDC{
1017+
AuthEndpoint: "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/auth",
1018+
TokenEndpoint: "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/token",
1019+
JWKSURI: "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/certs",
1020+
ClientID: "foobar",
1021+
ClientSecret: "secret",
1022+
Scope: "openid",
1023+
ZoneSyncLeeway: createPointerFromInt(-1),
1024+
},
1025+
msg: "invalid zoneSyncLeeway value",
1026+
},
9951027
}
9961028

9971029
for _, test := range tests {

0 commit comments

Comments
 (0)
0