Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added oidc Configuration section and operator management #464

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Added oidc Configuration section and operator management #464

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9ac5662
Added oidc Configuration section and operator management
Sep 17, 2024
266cc6c
Fixed client secret replacement
Sep 17, 2024
861ab81
fixed tab typo
Sep 17, 2024
82588f2
Fixed quota issue
Sep 17, 2024
36d95aa
fixed wrong comment
Sep 17, 2024
af8c0f5
replaced spaces with tabs
Sep 17, 2024
7028437
Merge branch 'master' into feat/oidcConfiguration
juldrixx Sep 25, 2024
b0444d9
Merge branch 'master' into feat/oidcConfiguration
juldrixx Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions api/v1/nificluster_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,8 @@ type NifiClusterSpec struct {
ControllerUserIdentity *string `json:"controllerUserIdentity,omitempty"`
// SingleUserConfiguration if enabled handles the information related to this authentication method
SingleUserConfiguration SingleUserConfiguration `json:"singleUserConfiguration,omitempty"`
// OidcConfiguration if enabled handles the information related to this authentication method
OidcConfiguration OidcConfiguration `json:"oidcConfiguration,omitempty"`

// @TODO: Block Controller change
}
Expand All @@ -128,6 +130,37 @@ type SingleUserConfiguration struct {
SecretKeys UserSecretKeys `json:"secretKeys,omitempty"`
}

// You can look into single-user access here: https://exceptionfactory.com/posts/2021/07/21/single-user-access-and-https-in-apache-nifi/
type OidcConfiguration struct {
// enabled specifies whether or not the cluster should use single user authentication for Nifi
// +kubebuilder:default:=false
// +optional
Enabled bool `json:"enabled"`
// authorizerEnabled specifies if the cluster should use use the single-user-authorizer instead of the managed-authorizer
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please update these comments to correctly describe the variables?

// +kubebuilder:default:=
// +optional
DiscoveryUrl string `json:"discoveryUrl,omitempty"`
// authorizerEnabled specifies if the cluster should use use the single-user-authorizer instead of the managed-authorizer
// +kubebuilder:default:=
// +optional
ClientId string `json:"clientId,omitempty"`
// secretRef references the secret containing the informations required to authentiticate to the cluster
// +optional
ClientSecretRef *SecretReference `json:"clientSecretRef,omitempty"`
// authorizerEnabled specifies if the cluster should use use the single-user-authorizer instead of the managed-authorizer
// +kubebuilder:default:=CN=([^,])(?:, (?:O|OU)=.)?
// +optional
PatternDn string `json:"patternDn,omitempty"`
// authorizerEnabled specifies if the cluster should use use the single-user-authorizer instead of the managed-authorizer
// +kubebuilder:default:=$1
// +optional
ValueDn string `json:"valueDn,omitempty"`
// authorizerEnabled specifies if the cluster should use use the single-user-authorizer instead of the managed-authorizer
// +kubebuilder:default:=None
// +optional
TransformDn string `json:"transformDn,omitempty"`
}

type UserSecretKeys struct {
// username specifies he name of the secret key to retrieve the user name
// +kubebuilder:default:=username
Expand Down
11 changes: 11 additions & 0 deletions api/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions helm/nifi-cluster/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,17 @@ cluster:
secretKeys:
username: "username"
password: "password"

oidcConfiguration:
enabled: false
discoveryUrl: ""
clientId: ""
clientSecretRef:
name: "oidcClientSecret"
namespace: "nifi"
patternDn: "CN=([^,])(?:, (?:O|OU)=.)?"
valueDn: "$1"
transformDn: "NONE"

pod:
# -- Annotations to apply to every pod
Expand Down
17 changes: 17 additions & 0 deletions pkg/resources/nifi/secretconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,20 @@ func (r *Reconciler) getNifiPropertiesConfigString(nConfig *v1.NodeConfig, id in
webProxyHosts = strings.Join(append(dnsNames, base.WebProxyHosts...), ",")
}

if strings.Contains(config.NifiPropertiesTemplate, "user.oidc.client.secret") {
// read secret value
clientSecret := &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: OidcConfiguration.SecretRef.Name,
NameSpace: OidcConfiguration.SecretRef.NameSpace,
},
Key: clientSecret,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please document (ad nauseum) what the key in the secret should be for the referenced secret? This should be documented on the website documentation, in nificluster_types.go, and in any comment where is makes sense. This way, it's very clear what the secret should contain.

},
}

strings.Replace(config.NifiPropertiesTemplate, "nifi.security.user.oidc.client.secret=clientSecret", "nifi.security.user.oidc.client.secret=" + clientSecret, 1)
}
useSSL := configcommon.UseSSL(r.NifiCluster)
var out bytes.Buffer
t := template.Must(template.New("nConfig-config").Parse(config.NifiPropertiesTemplate))
Expand Down Expand Up @@ -162,6 +176,7 @@ func (r *Reconciler) getNifiPropertiesConfigString(nConfig *v1.NodeConfig, id in
//
"LdapConfiguration": r.NifiCluster.Spec.LdapConfiguration,
"SingleUserConfiguration": r.NifiCluster.Spec.SingleUserConfiguration,
"OidcConfiguration": r.NifiCluster.Spec.OidcConfiguration,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please correct the tab spacing for all of these?

"IsNode": nConfig.GetIsNode(),
"ZookeeperConnectString": r.NifiCluster.Spec.ZKAddress,
"ZookeeperPath": r.NifiCluster.Spec.GetZkPath(),
Expand Down Expand Up @@ -297,6 +312,7 @@ func (r *Reconciler) getLoginIdentityProvidersConfigString(nConfig *v1.NodeConfi
"Id": id,
"LdapConfiguration": r.NifiCluster.Spec.LdapConfiguration,
"SingleUserConfiguration": r.NifiCluster.Spec.SingleUserConfiguration,
"OidcConfiguration": r.NifiCluster.Spec.OidcConfiguration,
}); err != nil {
log.Error("error occurred during parsing the config template",
zap.String("clusterName", r.NifiCluster.Name),
Expand Down Expand Up @@ -514,6 +530,7 @@ func (r *Reconciler) getAuthorizersConfigString(nConfig *v1.NodeConfig, id int32
"NodeList": nodeList,
"ControllerUser": r.NifiCluster.GetNifiControllerUserIdentity(),
"SingleUserConfiguration": r.NifiCluster.Spec.SingleUserConfiguration,
"OidcConfiguration": r.NifiCluster.Spec.OidcConfiguration,
}); err != nil {
log.Error("error occurred during parsing the config template",
zap.String("clusterName", r.NifiCluster.Name),
Expand Down
9 changes: 8 additions & 1 deletion pkg/resources/templates/config/nifi_properties.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,14 @@ nifi.security.user.authorizer=single-user-authorizer
{{else}}
nifi.security.user.authorizer={{ .Authorizer }}
{{end}}
{{if .LdapConfiguration.Enabled}}
{{ if .OidcConfiguration.Enabled}}
nifi.security.user.oidc.discovery.url={{ .OidcConfiguration.discoveryUrl }}
nifi.security.user.oidc.client.id={{ .OidcConfiguration.clientId }}
nifi.security.user.oidc.client.secret=clientSecret
nifi.security.identity.mapping.pattern.dn={{ .OidcConfiguration.patternDn }}
nifi.security.identity.mapping.value.dn={{ .OidcConfiguration.valueDn }}
nifi.security.identity.mapping.transform.dn={{ .OidcConfiguration.transformDn }}
{{else if .LdapConfiguration.Enabled}}
nifi.security.user.login.identity.provider=ldap-provider
{{else if .SingleUserConfiguration.Enabled}}
nifi.security.user.login.identity.provider=single-user-provider
Expand Down