Skip to content

Commit 3769e68

Browse files
igor-karpukhinigor-karpukhin
authored
CLOUDP-195050: Atlas Federated Authentication configuration (#1124)
1 parent 5878ddc commit 3769e68

28 files changed

+1258
-80
lines changed

‎.github/workflows/test-e2e.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ jobs:
203203
run: |
204204
kubectl version
205205
- name: Install CRDs if needed
206-
if: ${{ !( matrix.test == 'helm-update' || matrix.test == 'helm-wide' || matrix.test == 'bundle-test' ) }}
206+
if: ${{ !( matrix.test == 'helm-update' || matrix.test == 'helm-wide' || matrix.test == 'helm-ns' || matrix.test == 'bundle-test' ) }}
207207
run: |
208208
kubectl apply -f deploy/crds
209209
- name: Run e2e test

‎.github/workflows/test-int.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
strategy:
1717
fail-fast: false
1818
matrix:
19-
test: ["AtlasProject", "AtlasDeployment", "AtlasDatabaseUser", "AtlasDataFederation"]
19+
test: ["AtlasProject", "AtlasDeployment", "AtlasDatabaseUser", "AtlasDataFederation", "AtlasFederatedAuth"]
2020
path: [ "./test/int" ]
2121
nodes: [12]
2222
include:

‎cmd/manager/main.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ import (
4646
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlasdatabaseuser"
4747
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlasdatafederation"
4848
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlasdeployment"
49+
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlasfederatedauth"
4950
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlasproject"
5051
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/connectionsecret"
5152
"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/watch"
@@ -196,6 +197,22 @@ func main() {
196197
setupLog.Error(err, "unable to create controller", "controller", "AtlasDataFederation")
197198
os.Exit(1)
198199
}
200+
201+
if err = (&atlasfederatedauth.AtlasFederatedAuthReconciler{
202+
Client: mgr.GetClient(),
203+
Log: logger.Named("controllers").Named("AtlasFederatedAuth").Sugar(),
204+
Scheme: mgr.GetScheme(),
205+
AtlasDomain: config.AtlasDomain,
206+
ResourceWatcher: watch.NewResourceWatcher(),
207+
GlobalPredicates: globalPredicates,
208+
EventRecorder: mgr.GetEventRecorderFor("AtlasFederatedAuth"),
209+
ObjectDeletionProtection: config.ObjectDeletionProtection,
210+
SubObjectDeletionProtection: config.SubObjectDeletionProtection,
211+
}).SetupWithManager(mgr); err != nil {
212+
setupLog.Error(err, "unable to create controller", "controller", "AtlasFederatedAuth")
213+
os.Exit(1)
214+
}
215+
199216
// +kubebuilder:scaffold:builder
200217

201218
if err := mgr.AddHealthzCheck("health", healthz.Ping); err != nil {

‎config/crd/bases/atlas.mongodb.com_atlasfederatedauths.yaml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.9.2
7+
creationTimestamp: null
8+
name: atlasfederatedauths.atlas.mongodb.com
9+
spec:
10+
group: atlas.mongodb.com
11+
names:
12+
kind: AtlasFederatedAuth
13+
listKind: AtlasFederatedAuthList
14+
plural: atlasfederatedauths
15+
singular: atlasfederatedauth
16+
scope: Namespaced
17+
versions:
18+
- name: v1
19+
schema:
20+
openAPIV3Schema:
21+
description: AtlasFederatedAuth is the Schema for the Atlasfederatedauth API
22+
properties:
23+
apiVersion:
24+
description: 'APIVersion defines the versioned schema of this representation
25+
of an object. Servers should convert recognized schemas to the latest
26+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
27+
type: string
28+
kind:
29+
description: 'Kind is a string value representing the REST resource this
30+
object represents. Servers may infer this from the endpoint the client
31+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
32+
type: string
33+
metadata:
34+
type: object
35+
spec:
36+
properties:
37+
connectionSecretRef:
38+
description: Connection secret with API credentials for configuring
39+
the federation. These credentials must have OrganizationOwner permissions.
40+
properties:
41+
name:
42+
description: Name is the name of the Kubernetes Resource
43+
type: string
44+
namespace:
45+
description: Namespace is the namespace of the Kubernetes Resource
46+
type: string
47+
required:
48+
- name
49+
type: object
50+
domainAllowList:
51+
description: Approved domains that restrict users who can join the
52+
organization based on their email address.
53+
items:
54+
type: string
55+
type: array
56+
domainRestrictionEnabled:
57+
default: false
58+
description: Prevent users in the federation from accessing organizations
59+
outside of the federation, and creating new organizations. This
60+
option applies to the entire federation. See more information at
61+
https://www.mongodb.com/docs/atlas/security/federation-advanced-options/#restrict-user-membership-to-the-federation
62+
type: boolean
63+
enabled:
64+
default: false
65+
type: boolean
66+
postAuthRoleGrants:
67+
description: Atlas roles that are granted to a user in this organization
68+
after authenticating.
69+
items:
70+
type: string
71+
type: array
72+
roleMappings:
73+
description: Map IDP groups to Atlas roles.
74+
items:
75+
description: RoleMapping maps an external group from an identity
76+
provider to roles within Atlas.
77+
properties:
78+
externalGroupName:
79+
description: ExternalGroupName is the name of the IDP group
80+
to which this mapping applies.
81+
maxLength: 200
82+
minLength: 1
83+
type: string
84+
roleAssignments:
85+
description: RoleAssignments define the roles within projects
86+
that should be given to members of the group.
87+
items:
88+
properties:
89+
projectName:
90+
description: The Atlas project in the same org in which
91+
the role should be given.
92+
type: string
93+
role:
94+
description: The role in Atlas that should be given to
95+
group members.
96+
enum:
97+
- ORG_MEMBER
98+
- ORG_READ_ONLY
99+
- ORG_BILLING_ADMIN
100+
- ORG_GROUP_CREATOR
101+
- ORG_OWNER
102+
- ORG_BILLING_READ_ONLY
103+
- ORG_TEAM_MEMBERS_ADMIN
104+
- GROUP_AUTOMATION_ADMIN
105+
- GROUP_BACKUP_ADMIN
106+
- GROUP_MONITORING_ADMIN
107+
- GROUP_OWNER
108+
- GROUP_READ_ONLY
109+
- GROUP_USER_ADMIN
110+
- GROUP_BILLING_ADMIN
111+
- GROUP_DATA_ACCESS_ADMIN
112+
- GROUP_DATA_ACCESS_READ_ONLY
113+
- GROUP_DATA_ACCESS_READ_WRITE
114+
- GROUP_CHARTS_ADMIN
115+
- GROUP_CLUSTER_MANAGER
116+
- GROUP_SEARCH_INDEX_EDITOR
117+
type: string
118+
type: object
119+
type: array
120+
type: object
121+
type: array
122+
ssoDebugEnabled:
123+
default: false
124+
type: boolean
125+
type: object
126+
status:
127+
properties:
128+
conditions:
129+
description: Conditions is the list of statuses showing the current
130+
state of the Atlas Custom Resource
131+
items:
132+
description: Condition describes the state of an Atlas Custom Resource
133+
at a certain point.
134+
properties:
135+
lastTransitionTime:
136+
description: Last time the condition transitioned from one status
137+
to another.
138+
format: date-time
139+
type: string
140+
message:
141+
description: A human readable message indicating details about
142+
the transition.
143+
type: string
144+
reason:
145+
description: The reason for the condition's last transition.
146+
type: string
147+
status:
148+
description: Status of the condition, one of True, False, Unknown.
149+
type: string
150+
type:
151+
description: Type of Atlas Custom Resource condition.
152+
type: string
153+
required:
154+
- status
155+
- type
156+
type: object
157+
type: array
158+
observedGeneration:
159+
description: ObservedGeneration indicates the generation of the resource
160+
specification that the Atlas Operator is aware of. The Atlas Operator
161+
updates this field to the 'metadata.generation' as soon as it starts
162+
reconciliation of the resource.
163+
format: int64
164+
type: integer
165+
required:
166+
- conditions
167+
type: object
168+
type: object
169+
served: true
170+
storage: true
171+
subresources:
172+
status: {}

‎config/crd/kustomization.yaml‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -9,27 +9,6 @@ resources:
99
- bases/atlas.mongodb.com_atlasbackuppolicies.yaml
1010
- bases/atlas.mongodb.com_atlasbackupschedules.yaml
1111
- bases/atlas.mongodb.com_atlasteams.yaml
12-
# +kubebuilder:scaffold:crdkustomizeresource
13-
14-
patchesStrategicMerge:
15-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
16-
# patches here are for enabling the conversion webhook for each CRD
17-
#- patches/webhook_in_atlasclusters.yaml
18-
#- patches/webhook_in_atlasprojects.yaml
19-
#- patches/webhook_in_atlasbackuppolicies.yaml
20-
#- patches/webhook_in_atlasbackupschedules.yaml
21-
#- patches/webhook_in_atlasteams.yaml
22-
# +kubebuilder:scaffold:crdkustomizewebhookpatch
23-
24-
# [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
25-
# patches here are for enabling the CA injection for each CRD
26-
#- patches/cainjection_in_atlasclusters.yaml
27-
#- patches/cainjection_in_atlasprojects.yaml
28-
#- patches/cainjection_in_atlasbackuppolicies.yaml
29-
#- patches/cainjection_in_atlasbackupschedules.yaml
30-
#- patches/cainjection_in_atlasteams.yaml
31-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
32-
33-
# the following config is for teaching kustomize how to do kustomization for CRDs.
12+
- bases/atlas.mongodb.com_atlasfederatedauths.yaml
3413
configurations:
3514
- kustomizeconfig.yaml

‎config/crd/patches/cainjection_in_atlasfederatedauths.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# The following patch adds a directive for certmanager to inject CA into the CRD
2+
# CRD conversion requires k8s 1.13 or later.
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
annotations:
7+
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
8+
name: atlasfederatedauths.atlas.mongodb.com

‎config/crd/patches/webhook_in_atlasfederatedauths.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# The following patch enables conversion webhook for CRD
2+
# CRD conversion requires k8s 1.13 or later.
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
name: atlasfederatedauths.atlas.mongodb.com
7+
spec:
8+
conversion:
9+
strategy: Webhook
10+
webhookClientConfig:
11+
# this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
12+
# but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
13+
caBundle: Cg==
14+
service:
15+
namespace: system
16+
name: webhook-service
17+
path: /convert

0 commit comments

Comments
 (0)