You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC,rule="!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients) || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace == specC.componentNamespace && statusC.componentName == specC.componentName) || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP, oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC, oldC.componentNamespace == specC.componentNamespace && oldC.componentName == specC.componentName)))))",message="all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
8
+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC;ExternalOIDCWithUIDAndExtraClaimMappings,rule="!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients) || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace == specC.componentNamespace && statusC.componentName == specC.componentName) || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP, oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC, oldC.componentNamespace == specC.componentNamespace && oldC.componentName == specC.componentName)))))",message="all oidcClients in the oidcProviders must match their componentName and componentNamespace to either a previously configured oidcClient or they must exist in the status.oidcClients"
9
9
10
10
// Authentication specifies cluster-wide settings for authentication (like OAuth and
11
11
// webhook token authenticators). The canonical name of an instance is `cluster`.
@@ -91,6 +91,7 @@ type AuthenticationSpec struct {
@@ -278,6 +307,110 @@ type TokenClaimMapping struct {
278
307
Claimstring`json:"claim"`
279
308
}
280
309
310
+
// TokenClaimOrExpressionMapping allows specifying either a JWT
311
+
// token claim or CEL expression to be used when mapping claims
312
+
// from an authentication token to cluster identities.
313
+
// +kubebuilder:validation:XValidation:rule="has(self.claim) ? !has(self.expression) : has(self.expression)",message="precisely one of claim or expression must be set"
314
+
typeTokenClaimOrExpressionMappingstruct {
315
+
// claim is an optional field for specifying the
316
+
// JWT token claim that is used in the mapping.
317
+
// The value of this claim will be assigned to
318
+
// the field in which this mapping is associated.
319
+
//
320
+
// Precisely one of claim or expression must be set.
321
+
// claim must not be specified when expression is set.
322
+
// When specified, claim must be at least 1 character in length
323
+
// and must not exceed 256 characters in length.
324
+
//
325
+
// +optional
326
+
// +kubebuilder:validation:MaxLength=256
327
+
// +kubebuilder:validation:MinLength=1
328
+
Claimstring`json:"claim,omitempty"`
329
+
330
+
// expression is an optional field for specifying a
331
+
// CEL expression that produces a string value from
332
+
// JWT token claims.
333
+
//
334
+
// CEL expressions have access to the token claims
335
+
// through a CEL variable, 'claims'.
336
+
// 'claims' is a map of claim names to claim values.
337
+
// For example, the 'sub' claim value can be accessed as 'claims.sub'.
338
+
// Nested claims can be accessed using dot notation ('claims.foo.bar').
339
+
//
340
+
// Precisely one of claim or expression must be set.
341
+
// expression must not be specified when claim is set.
342
+
// When specified, expression must be at least 1 character in length
343
+
// and must not exceed 4096 characters in length.
344
+
//
345
+
// +optional
346
+
// +kubebuilder:validation:MaxLength=4096
347
+
// +kubebuilder:validation:MinLength=1
348
+
Expressionstring`json:"expression,omitempty"`
349
+
}
350
+
351
+
// ExtraMapping allows specifying a key and CEL expression
352
+
// to evaluate the keys' value. It is used to create additional
353
+
// mappings and attributes added to a cluster identity from
354
+
// a provided authentication token.
355
+
typeExtraMappingstruct {
356
+
// key is a required field that specifies the string
357
+
// to use as the extra attribute key.
358
+
//
359
+
// key must be a domain-prefix path (e.g 'example.org/foo').
360
+
// key must not exceed 510 characters in length.
361
+
// key must contain the '/' character, separating the domain and path characters.
362
+
// key must not be empty.
363
+
//
364
+
// The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
365
+
// It must not exceed 253 characters in length.
366
+
// It must start and end with an alphanumeric character.
367
+
// It must only contain lower case alphanumeric characters and '-' or '.'.
368
+
// It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
369
+
//
370
+
// The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
// +kubebuilder:validation:XValidation:rule="self.contains('/')",message="key must contain the '/' character"
378
+
//
379
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[0].matches(\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\")",message="the domain of the key must consist of only lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
380
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[0].size() <= 253",message="the domain of the key must not exceed 253 characters in length"
381
+
//
382
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[0] != 'kubernetes.io'",message="the domain 'kubernetes.io' is reserved for Kubernetes use"
383
+
// +kubebuilder:validation:XValidation:rule="!self.split('/', 2)[0].endsWith('.kubernetes.io')",message="the subdomains '*.kubernetes.io' are reserved for Kubernetes use"
384
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[0] != 'k8s.io'",message="the domain 'k8s.io' is reserved for Kubernetes use"
385
+
// +kubebuilder:validation:XValidation:rule="!self.split('/', 2)[0].endsWith('.k8s.io')",message="the subdomains '*.k8s.io' are reserved for Kubernetes use"
386
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[0] != 'openshift.io'",message="the domain 'openshift.io' is reserved for OpenShift use"
387
+
// +kubebuilder:validation:XValidation:rule="!self.split('/', 2)[0].endsWith('.openshift.io')",message="the subdomains '*.openshift.io' are reserved for OpenShift use"
388
+
//
389
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[1].matches('[A-Za-z0-9/\\\\-._~%!$&\\'()*+;=:]+')",message="the path of the key must not be empty and must consist of at least one alphanumeric character, percent-encoded octets, apostrophe, '-', '.', '_', '~', '!', '$', '&', '(', ')', '*', '+', ',', ';', '=', and ':'"
390
+
// +kubebuilder:validation:XValidation:rule="self.split('/', 2)[1].size() <= 256",message="the path of the key must not exceed 256 characters in length"
391
+
Keystring`json:"key"`
392
+
393
+
// valueExpression is a required field to specify the CEL expression to extract
394
+
// the extra attribute value from a JWT token's claims.
395
+
// valueExpression must produce a string or string array value.
396
+
// "", [], and null are treated as the extra mapping not being present.
397
+
// Empty string values within an array are filtered out.
398
+
//
399
+
// CEL expressions have access to the token claims
400
+
// through a CEL variable, 'claims'.
401
+
// 'claims' is a map of claim names to claim values.
402
+
// For example, the 'sub' claim value can be accessed as 'claims.sub'.
403
+
// Nested claims can be accessed using dot notation ('claims.foo.bar').
404
+
//
405
+
// valueExpression must not exceed 4096 characters in length.
406
+
// valueExpression must not be empty.
407
+
//
408
+
// +required
409
+
// +kubebuilder:validation:MinLength=1
410
+
// +kubebuilder:validation:MaxLength=4096
411
+
ValueExpressionstring`json:"valueExpression"`
412
+
}
413
+
281
414
typeOIDCClientConfigstruct {
282
415
// ComponentName is the name of the component that is supposed to consume this
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments