Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: auth policy enforced condition #411

Merged
merged 4 commits into from
Feb 20, 2024
Merged

feat: auth policy enforced condition #411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7315084
feat: auth policy enforced condition
KevFan Jan 31, 2024
7cd6f4d
feat: enforced condition overridden reason
KevFan Feb 12, 2024
522306e
refactor: detection overridden AuthPolicy logic
KevFan Feb 14, 2024
3b71908
refactor: OverriddenPolicyMap
KevFan Feb 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion api/v1beta2/authpolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,8 @@ var _ common.KuadrantPolicy = &AuthPolicy{}
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=direct"
// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`,description="AuthPolicy Status",priority=2
// +kubebuilder:printcolumn:name="Accepted",type=string,JSONPath=`.status.conditions[?(@.type=="Accepted")].status`,description="AuthPolicy Accepted",priority=2
// +kubebuilder:printcolumn:name="Enforced",type=string,JSONPath=`.status.conditions[?(@.type=="Enforced")].status`,description="AuthPolicy Enforced",priority=2
// +kubebuilder:printcolumn:name="TargetRefKind",type="string",JSONPath=".spec.targetRef.kind",description="Type of the referenced Gateway API resource",priority=2
// +kubebuilder:printcolumn:name="TargetRefName",type="string",JSONPath=".spec.targetRef.name",description="Name of the referenced Gateway API resource",priority=2
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
Expand Down
3 changes: 2 additions & 1 deletion api/v1beta2/ratelimitpolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,8 @@ var _ common.KuadrantPolicy = &RateLimitPolicy{}
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=direct"
// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`,description="RateLimitPolicy Status",priority=2
// +kubebuilder:printcolumn:name="Accepted",type=string,JSONPath=`.status.conditions[?(@.type=="Accepted")].status`,description="RateLimitPolicy Accepted",priority=2
// +kubebuilder:printcolumn:name="Enforced",type=string,JSONPath=`.status.conditions[?(@.type=="Enforced")].status`,description="RateLimitPolicy Enforced",priority=2
Comment on lines +171 to +172
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though the title says "auth policy", it's good to have this here as well, for completeness 👍

// +kubebuilder:printcolumn:name="TargetRefKind",type="string",JSONPath=".spec.targetRef.kind",description="Type of the referenced Gateway API resource",priority=2
// +kubebuilder:printcolumn:name="TargetRefName",type="string",JSONPath=".spec.targetRef.name",description="Name of the referenced Gateway API resource",priority=2
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/kuadrant-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ metadata:
capabilities: Basic Install
categories: Integration & Delivery
containerImage: quay.io/kuadrant/kuadrant-operator:latest
createdAt: "2024-01-23T14:59:43Z"
createdAt: "2024-02-06T11:59:47Z"
operators.operatorframework.io/builder: operator-sdk-v1.32.0
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
repository: https://github.com/Kuadrant/kuadrant-operator
Expand Down
11 changes: 8 additions & 3 deletions bundle/manifests/kuadrant.io_authpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,14 @@ spec:
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: AuthPolicy Status
jsonPath: .status.conditions[0].reason
name: Status
- description: AuthPolicy Accepted
jsonPath: .status.conditions[?(@.type=="Accepted")].status
name: Accepted
priority: 2
type: string
- description: AuthPolicy Enforced
jsonPath: .status.conditions[?(@.type=="Enforced")].status
name: Enforced
priority: 2
type: string
- description: Type of the referenced Gateway API resource
Expand Down
11 changes: 8 additions & 3 deletions bundle/manifests/kuadrant.io_ratelimitpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,14 @@ spec:
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: RateLimitPolicy Status
jsonPath: .status.conditions[0].reason
name: Status
- description: RateLimitPolicy Accepted
jsonPath: .status.conditions[?(@.type=="Accepted")].status
name: Accepted
priority: 2
type: string
- description: RateLimitPolicy Enforced
jsonPath: .status.conditions[?(@.type=="Enforced")].status
name: Enforced
priority: 2
type: string
- description: Type of the referenced Gateway API resource
Expand Down
11 changes: 8 additions & 3 deletions config/crd/bases/kuadrant.io_authpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,14 @@ spec:
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: AuthPolicy Status
jsonPath: .status.conditions[0].reason
name: Status
- description: AuthPolicy Accepted
jsonPath: .status.conditions[?(@.type=="Accepted")].status
name: Accepted
priority: 2
type: string
- description: AuthPolicy Enforced
jsonPath: .status.conditions[?(@.type=="Enforced")].status
name: Enforced
priority: 2
type: string
- description: Type of the referenced Gateway API resource
Expand Down
11 changes: 8 additions & 3 deletions config/crd/bases/kuadrant.io_ratelimitpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,14 @@ spec:
scope: Namespaced
versions:
- additionalPrinterColumns:
- description: RateLimitPolicy Status
jsonPath: .status.conditions[0].reason
name: Status
- description: RateLimitPolicy Accepted
jsonPath: .status.conditions[?(@.type=="Accepted")].status
name: Accepted
priority: 2
type: string
- description: RateLimitPolicy Enforced
jsonPath: .status.conditions[?(@.type=="Enforced")].status
name: Enforced
priority: 2
type: string
- description: Type of the referenced Gateway API resource
Expand Down
4 changes: 4 additions & 0 deletions controllers/authpolicy_authconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ func (r *AuthPolicyReconciler) desiredAuthConfig(ctx context.Context, ap *api.Au
if len(rules) == 0 {
logger.V(1).Info("no httproutes attached to the targeted gateway, skipping authorino authconfig for the gateway authpolicy")
common.TagObjectToDelete(authConfig)
r.OverriddenPolicyMap.SetOverriddenPolicy(ap)
return authConfig, nil
}
route = &gatewayapiv1.HTTPRoute{
Expand All @@ -102,6 +103,9 @@ func (r *AuthPolicyReconciler) desiredAuthConfig(ctx context.Context, ap *api.Au
}
}

// AuthPolicy is not overridden if we still need to create an AuthConfig for it
r.OverriddenPolicyMap.RemoveOverriddenPolicy(ap)

// hosts
authConfig.Spec.Hosts = hosts

Expand Down
6 changes: 4 additions & 2 deletions controllers/authpolicy_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ const authPolicyFinalizer = "authpolicy.kuadrant.io/finalizer"
// AuthPolicyReconciler reconciles a AuthPolicy object
type AuthPolicyReconciler struct {
reconcilers.TargetRefReconciler
// OverriddenPolicyMap tracks the overridden policies to report their status.
OverriddenPolicyMap *common.OverriddenPolicyMap
}

//+kubebuilder:rbac:groups=kuadrant.io,resources=authpolicies,verbs=get;list;watch;create;update;patch;delete
Expand Down Expand Up @@ -67,7 +69,7 @@ func (r *AuthPolicyReconciler) Reconcile(eventCtx context.Context, req ctrl.Requ
if delResErr == nil {
delResErr = err
}
return r.reconcileStatus(ctx, ap, common.NewErrTargetNotFound(ap.Kind(), ap.GetTargetRef(), delResErr))
return r.reconcileStatus(ctx, ap, targetNetworkObject, common.NewErrTargetNotFound(ap.Kind(), ap.GetTargetRef(), delResErr))
}
return ctrl.Result{}, err
}
Expand Down Expand Up @@ -103,7 +105,7 @@ func (r *AuthPolicyReconciler) Reconcile(eventCtx context.Context, req ctrl.Requ
specErr := r.reconcileResources(ctx, ap, targetNetworkObject)

// reconcile authpolicy status
statusResult, statusErr := r.reconcileStatus(ctx, ap, specErr)
statusResult, statusErr := r.reconcileStatus(ctx, ap, targetNetworkObject, specErr)

if specErr != nil {
return ctrl.Result{}, specErr
Expand Down
Loading
Loading