Skip to content

Commit 74e82d2

Browse files
matheuscscpmatheuscscp
authored
Merge pull request #1585 from fluxcd/bucket-sts-endpoint-ldap
Add LDAP provider for Bucket STS API
2 parents 7c4fdd5 + 10ac113 commit 74e82d2

File tree

10 files changed

+811
-94
lines changed

10 files changed

+811
-94
lines changed

Diff for: ‎api/v1beta2/bucket_types.go

+29-3
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,11 @@ const (
4949

5050
// BucketSpec specifies the required configuration to produce an Artifact for
5151
// an object storage bucket.
52-
// +kubebuilder:validation:XValidation:rule="self.provider == 'aws' || !has(self.sts)", message="STS configuration is only supported for the 'aws' Bucket provider"
52+
// +kubebuilder:validation:XValidation:rule="self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)", message="STS configuration is only supported for the 'aws' and 'generic' Bucket providers"
5353
// +kubebuilder:validation:XValidation:rule="self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'", message="'aws' is the only supported STS provider for the 'aws' Bucket provider"
54+
// +kubebuilder:validation:XValidation:rule="self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'", message="'ldap' is the only supported STS provider for the 'generic' Bucket provider"
55+
// +kubebuilder:validation:XValidation:rule="!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)", message="spec.sts.secretRef is not required for the 'aws' STS provider"
56+
// +kubebuilder:validation:XValidation:rule="!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)", message="spec.sts.certSecretRef is not required for the 'aws' STS provider"
5457
type BucketSpec struct {
5558
// Provider of the object storage bucket.
5659
// Defaults to 'generic', which expects an S3 (API) compatible object
@@ -72,7 +75,7 @@ type BucketSpec struct {
7275
// Service for fetching temporary credentials to authenticate in a
7376
// Bucket provider.
7477
//
75-
// This field is only supported for the `aws` provider.
78+
// This field is only supported for the `aws` and `generic` providers.
7679
// +optional
7780
STS *BucketSTSSpec `json:"sts,omitempty"`
7881

@@ -153,7 +156,7 @@ type BucketSpec struct {
153156
// provider.
154157
type BucketSTSSpec struct {
155158
// Provider of the Security Token Service.
156-
// +kubebuilder:validation:Enum=aws
159+
// +kubebuilder:validation:Enum=aws;ldap
157160
// +required
158161
Provider string `json:"provider"`
159162

@@ -162,6 +165,29 @@ type BucketSTSSpec struct {
162165
// +required
163166
// +kubebuilder:validation:Pattern="^(http|https)://.*$"
164167
Endpoint string `json:"endpoint"`
168+
169+
// SecretRef specifies the Secret containing authentication credentials
170+
// for the STS endpoint. This Secret must contain the fields `username`
171+
// and `password` and is supported only for the `ldap` provider.
172+
// +optional
173+
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
174+
175+
// CertSecretRef can be given the name of a Secret containing
176+
// either or both of
177+
//
178+
// - a PEM-encoded client certificate (`tls.crt`) and private
179+
// key (`tls.key`);
180+
// - a PEM-encoded CA certificate (`ca.crt`)
181+
//
182+
// and whichever are supplied, will be used for connecting to the
183+
// STS endpoint. The client cert and key are useful if you are
184+
// authenticating with a certificate; the CA cert is useful if
185+
// you are using a self-signed server certificate. The Secret must
186+
// be of type `Opaque` or `kubernetes.io/tls`.
187+
//
188+
// This field is only supported for the `ldap` provider.
189+
// +optional
190+
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
165191
}
166192

167193
// BucketStatus records the observed state of a Bucket.

Diff for: ‎api/v1beta2/sts_types.go

+3
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,7 @@ const (
2020
// STSProviderAmazon represents the AWS provider for Security Token Service.
2121
// Provides support for fetching temporary credentials from an AWS STS endpoint.
2222
STSProviderAmazon string = "aws"
23+
// STSProviderLDAP represents the LDAP provider for Security Token Service.
24+
// Provides support for fetching temporary credentials from an LDAP endpoint.
25+
STSProviderLDAP string = "ldap"
2326
)

Diff for: ‎api/v1beta2/zz_generated.deepcopy.go

+11-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎config/crd/bases/source.toolkit.fluxcd.io_buckets.yaml

+51-3
Original file line numberDiff line numberDiff line change
@@ -424,8 +424,34 @@ spec:
424424
Bucket provider.
425425
426426
427-
This field is only supported for the `aws` provider.
427+
This field is only supported for the `aws` and `generic` providers.
428428
properties:
429+
certSecretRef:
430+
description: |-
431+
CertSecretRef can be given the name of a Secret containing
432+
either or both of
433+
434+
435+
- a PEM-encoded client certificate (`tls.crt`) and private
436+
key (`tls.key`);
437+
- a PEM-encoded CA certificate (`ca.crt`)
438+
439+
440+
and whichever are supplied, will be used for connecting to the
441+
STS endpoint. The client cert and key are useful if you are
442+
authenticating with a certificate; the CA cert is useful if
443+
you are using a self-signed server certificate. The Secret must
444+
be of type `Opaque` or `kubernetes.io/tls`.
445+
446+
447+
This field is only supported for the `ldap` provider.
448+
properties:
449+
name:
450+
description: Name of the referent.
451+
type: string
452+
required:
453+
- name
454+
type: object
429455
endpoint:
430456
description: |-
431457
Endpoint is the HTTP/S endpoint of the Security Token Service from
@@ -436,7 +462,20 @@ spec:
436462
description: Provider of the Security Token Service.
437463
enum:
438464
- aws
465+
- ldap
439466
type: string
467+
secretRef:
468+
description: |-
469+
SecretRef specifies the Secret containing authentication credentials
470+
for the STS endpoint. This Secret must contain the fields `username`
471+
and `password` and is supported only for the `ldap` provider.
472+
properties:
473+
name:
474+
description: Name of the referent.
475+
type: string
476+
required:
477+
- name
478+
type: object
440479
required:
441480
- endpoint
442481
- provider
@@ -457,12 +496,21 @@ spec:
457496
- interval
458497
type: object
459498
x-kubernetes-validations:
460-
- message: STS configuration is only supported for the 'aws' Bucket provider
461-
rule: self.provider == 'aws' || !has(self.sts)
499+
- message: STS configuration is only supported for the 'aws' and 'generic'
500+
Bucket providers
501+
rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)
462502
- message: '''aws'' is the only supported STS provider for the ''aws''
463503
Bucket provider'
464504
rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider
465505
== 'aws'
506+
- message: '''ldap'' is the only supported STS provider for the ''generic''
507+
Bucket provider'
508+
rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider
509+
== 'ldap'
510+
- message: spec.sts.secretRef is not required for the 'aws' STS provider
511+
rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)'
512+
- message: spec.sts.certSecretRef is not required for the 'aws' STS provider
513+
rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)'
466514
status:
467515
default:
468516
observedGeneration: -1

Diff for: ‎docs/api/v1beta2/source.md

+44-2
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ BucketSTSSpec
126126
<p>STS specifies the required configuration to use a Security Token
127127
Service for fetching temporary credentials to authenticate in a
128128
Bucket provider.</p>
129-
<p>This field is only supported for the <code>aws</code> provider.</p>
129+
<p>This field is only supported for the <code>aws</code> and <code>generic</code> providers.</p>
130130
</td>
131131
</tr>
132132
<tr>
@@ -1497,6 +1497,48 @@ string
14971497
where temporary credentials will be fetched.</p>
14981498
</td>
14991499
</tr>
1500+
<tr>
1501+
<td>
1502+
<code>secretRef</code><br>
1503+
<em>
1504+
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
1505+
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
1506+
</a>
1507+
</em>
1508+
</td>
1509+
<td>
1510+
<em>(Optional)</em>
1511+
<p>SecretRef specifies the Secret containing authentication credentials
1512+
for the STS endpoint. This Secret must contain the fields <code>username</code>
1513+
and <code>password</code> and is supported only for the <code>ldap</code> provider.</p>
1514+
</td>
1515+
</tr>
1516+
<tr>
1517+
<td>
1518+
<code>certSecretRef</code><br>
1519+
<em>
1520+
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
1521+
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
1522+
</a>
1523+
</em>
1524+
</td>
1525+
<td>
1526+
<em>(Optional)</em>
1527+
<p>CertSecretRef can be given the name of a Secret containing
1528+
either or both of</p>
1529+
<ul>
1530+
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
1531+
key (<code>tls.key</code>);</li>
1532+
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
1533+
</ul>
1534+
<p>and whichever are supplied, will be used for connecting to the
1535+
STS endpoint. The client cert and key are useful if you are
1536+
authenticating with a certificate; the CA cert is useful if
1537+
you are using a self-signed server certificate. The Secret must
1538+
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
1539+
<p>This field is only supported for the <code>ldap</code> provider.</p>
1540+
</td>
1541+
</tr>
15001542
</tbody>
15011543
</table>
15021544
</div>
@@ -1569,7 +1611,7 @@ BucketSTSSpec
15691611
<p>STS specifies the required configuration to use a Security Token
15701612
Service for fetching temporary credentials to authenticate in a
15711613
Bucket provider.</p>
1572-
<p>This field is only supported for the <code>aws</code> provider.</p>
1614+
<p>This field is only supported for the <code>aws</code> and <code>generic</code> providers.</p>
15731615
</td>
15741616
</tr>
15751617
<tr>

Diff for: ‎docs/spec/v1beta2/buckets.md

+64-4
Original file line numberDiff line numberDiff line change
@@ -756,15 +756,75 @@ configuration. A Security Token Service (STS) is a web service that issues
756756
temporary security credentials. By adding this field, one may specify the
757757
STS endpoint from where temporary credentials will be fetched.
758758

759+
This field is only supported for the `aws` and `generic` bucket [providers](#provider).
760+
759761
If using `.spec.sts`, the following fields are required:
760762

761763
- `.spec.sts.provider`, the Security Token Service provider. The only supported
762-
option is `aws`.
764+
option for the `generic` bucket provider is `ldap`. The only supported option
765+
for the `aws` bucket provider is `aws`.
763766
- `.spec.sts.endpoint`, the HTTP/S endpoint of the Security Token Service. In
764-
the case of AWS, this can be `https://sts.amazonaws.com`, or a Regional STS
765-
Endpoint, or an Interface Endpoint created inside a VPC.
767+
the case of `aws` this can be `https://sts.amazonaws.com`, or a Regional STS
768+
Endpoint, or an Interface Endpoint created inside a VPC. In the case of
769+
`ldap` this must be the LDAP server endpoint.
770+
771+
When using the `ldap` provider, the following fields may also be specified:
772+
773+
- `.spec.sts.secretRef.name`, the name of the Secret containing the LDAP
774+
credentials. The Secret must contain the following keys:
775+
- `username`, the username to authenticate with.
776+
- `password`, the password to authenticate with.
777+
- `.spec.sts.certSecretRef.name`, the name of the Secret containing the
778+
TLS configuration for communicating with the STS endpoint. The contents
779+
of this Secret must follow the same structure of
780+
[`.spec.certSecretRef.name`](#cert-secret-reference).
781+
782+
If [`.spec.proxySecretRef.name`](#proxy-secret-reference) is specified,
783+
the proxy configuration will be used for commucating with the STS endpoint.
784+
785+
Example for the `ldap` provider:
766786

767-
This field is only supported for the `aws` bucket provider.
787+
```yaml
788+
---
789+
apiVersion: source.toolkit.fluxcd.io/v1beta2
790+
kind: Bucket
791+
metadata:
792+
name: example
793+
namespace: example
794+
spec:
795+
interval: 5m
796+
bucketName: example
797+
provider: generic
798+
endpoint: minio.example.com
799+
sts:
800+
provider: ldap
801+
endpoint: https://ldap.example.com
802+
secretRef:
803+
name: ldap-credentials
804+
certSecretRef:
805+
name: ldap-tls
806+
---
807+
apiVersion: v1
808+
kind: Secret
809+
metadata:
810+
name: ldap-credentials
811+
namespace: example
812+
type: Opaque
813+
stringData:
814+
username: <username>
815+
password: <password>
816+
---
817+
apiVersion: v1
818+
kind: Secret
819+
metadata:
820+
name: ldap-tls
821+
namespace: example
822+
type: kubernetes.io/tls # or Opaque
823+
stringData:
824+
tls.crt: <PEM-encoded cert>
825+
tls.key: <PEM-encoded key>
826+
ca.crt: <PEM-encoded cert>
827+
```
768828

769829
### Bucket name
770830

0 commit comments

Comments
 (0)