Skip to content

Commit 627296e

Browse files
ajanikowajanikow
authored
[Feature] [Platform] OpenID Refresh (#1908)
1 parent 6b07589 commit 627296e

File tree

30 files changed

+804
-300
lines changed

30 files changed

+804
-300
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
- (Maintenance) Grade Doc Field
2424
- (Feature) (Platform) Improve Platform Components names
2525
- (Feature) Extend Shared Types
26+
- (Feature) (Platform) OpenID Refresh Feature
2627

2728
## [1.2.48](https://github.com/arangodb/kube-arangodb/tree/1.2.48) (2025-05-08)
2829
- (Maintenance) Extend Documentation

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,9 @@ covers individual newer features separately.
8888

8989
| Feature | Operator Version | Introduced | ArangoDB Version | ArangoDB Edition | State | Enabled | Flag | Remarks |
9090
|:--- |:--- |:--- |:--- |:--- |:--- |:--- |:--- |:--- |
91-
| Gateway | 1.2.43 | 1.2.43 | >= 3.8.0 | Community, Enterprise | Alpha | True | N/A | Support for ArangoDeployment Gateway Group |
91+
| ArangoPlatform OpenID SSO | 1.2.49 | 1.2.49 | >= 3.8.0 | Community, Enterprise | Beta | True | N/A | Support for ArangoPlatform SSO with OpenID |
92+
| ArangoPlatform OpenID SSO Refresh | 1.2.49 | 1.2.49 | >= 3.8.0 | Community, Enterprise | Alpha | True | N/A | Support for ArangoPlatform SSO with OpenID Refresh |
93+
| ArangoPlatform | 1.2.49 | 1.2.43 | >= 3.8.0 | Community, Enterprise | Beta | True | N/A | ArangoPlatform Solution with support for ArangoDeployment Gateway Group |
9294
| Cleanup Imported Backups | 1.2.41 | 1.2.41 | >= 3.8.0 | Community, Enterprise | Production | False | --deployment.feature.backup-cleanup | Cleanup backups created outside of the Operator and imported into Kubernetes ArangoBackup |
9395
| Upscale resources spec in init containers | 1.2.36 | 1.2.36 | >= 3.8.0 | Community, Enterprise | Production | True | --deployment.feature.init-containers-upscale-resources | Upscale resources spec to built-in init containers if they are not specified or lower |
9496
| Create backups asynchronously | 1.2.35 | 1.2.41 | >= 3.8.0 | Community, Enterprise | Production | True | --deployment.feature.async-backup-creation | Create backups asynchronously to avoid blocking the operator and reaching the timeout |

‎docs/api/ArangoPlatform.V1Alpha1.Authentication.OpenID.md

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,27 @@ title: ArangoPlatform V1Alpha1 Authentication OpenID
88

99
##
1010

11+
### .claims.username
12+
13+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L254)</sup>
14+
15+
Username defines the claim key to extract username
16+
17+
Default Value: `username`
18+
19+
***
20+
1121
### .client.id
1222

13-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L223)</sup>
23+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L229)</sup>
1424

1525
ID defines OpenID Client ID
1626

1727
***
1828

1929
### .client.secret
2030

21-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L226)</sup>
31+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L232)</sup>
2232

2333
Secret defines OpenID Client Secret
2434

@@ -40,9 +50,24 @@ Endpoint defines the OpenID callback Endpoint
4050

4151
***
4252

53+
### .features.refreshEnabled
54+
55+
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L240)</sup>
56+
57+
> [!WARNING]
58+
> ***ALPHA***
59+
>
60+
> **Experimental Feature, in development**
61+
62+
RefreshEnabled defines if the Refresh OpenID Functionality is enabled
63+
64+
Default Value: `false`
65+
66+
***
67+
4368
### .http.insecure
4469

45-
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L179)</sup>
70+
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L185)</sup>
4671

4772
Insecure defines if insecure HTTP Client is used
4873

@@ -52,7 +77,7 @@ Default Value: `false`
5277

5378
### .provider..authorizationEndpoint
5479

55-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L210)</sup>
80+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L216)</sup>
5681

5782
AuthorizationEndpoint defines OpenID Authorization Endpoint
5883

@@ -63,7 +88,7 @@ Links:
6388

6489
### .provider..tokenEndpoint
6590

66-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L214)</sup>
91+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L220)</sup>
6792

6893
TokenEndpoint defines OpenID Token Endpoint
6994

@@ -74,7 +99,7 @@ Links:
7499

75100
### .provider..userInfoEndpoint
76101

77-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L218)</sup>
102+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L224)</sup>
78103

79104
UserInfoEndpoint defines OpenID UserInfo Endpoint
80105

@@ -85,7 +110,7 @@ Links:
85110

86111
### .provider.issuer
87112

88-
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L204)</sup>
113+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.48/pkg/apis/platform/v1alpha1/authentication/openid.go#L210)</sup>
89114

90115
Issuer defines OpenID Issuer
91116

‎docs/features/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@ title: List of all features
88

99
| Feature | Operator Version | Introduced | ArangoDB Version | ArangoDB Edition | State | Enabled | Flag | Remarks |
1010
|:--- |:--- |:--- |:--- |:--- |:--- |:--- |:--- |:--- |
11-
| Gateway | 1.2.43 | 1.2.43 | >= 3.8.0 | Community, Enterprise | Alpha | True | N/A | Support for ArangoDeployment Gateway Group |
11+
| ArangoPlatform OpenID SSO | 1.2.49 | 1.2.49 | >= 3.8.0 | Community, Enterprise | Beta | True | N/A | Support for ArangoPlatform SSO with OpenID |
12+
| ArangoPlatform OpenID SSO Refresh | 1.2.49 | 1.2.49 | >= 3.8.0 | Community, Enterprise | Alpha | True | N/A | Support for ArangoPlatform SSO with OpenID Refresh |
13+
| ArangoPlatform | 1.2.49 | 1.2.43 | >= 3.8.0 | Community, Enterprise | Beta | True | N/A | ArangoPlatform Solution with support for ArangoDeployment Gateway Group |
1214
| Cleanup Imported Backups | 1.2.41 | 1.2.41 | >= 3.8.0 | Community, Enterprise | Production | False | --deployment.feature.backup-cleanup | Cleanup backups created outside of the Operator and imported into Kubernetes ArangoBackup |
1315
| Upscale resources spec in init containers | 1.2.36 | 1.2.36 | >= 3.8.0 | Community, Enterprise | Production | True | --deployment.feature.init-containers-upscale-resources | Upscale resources spec to built-in init containers if they are not specified or lower |
1416
| Create backups asynchronously | 1.2.35 | 1.2.41 | >= 3.8.0 | Community, Enterprise | Production | True | --deployment.feature.async-backup-creation | Create backups asynchronously to avoid blocking the operator and reaching the timeout |

‎integrations/envoy/auth/v3/impl.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ import (
3636
"github.com/arangodb/kube-arangodb/pkg/util/svc"
3737
)
3838

39-
func New(config pbImplEnvoyAuthV3Shared.Configuration) svc.Handler {
39+
func New(ctx context.Context, config pbImplEnvoyAuthV3Shared.Configuration) svc.Handler {
4040
return &impl{
4141
config: config,
42-
handler: impl2.Factory().Render(config),
42+
handler: impl2.Factory().Render(ctx, config),
4343
}
4444
}
4545

‎integrations/envoy/auth/v3/impl/auth_bearer/impl.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ package auth_bearer
2222

2323
import (
2424
"context"
25+
"time"
2526

2627
pbEnvoyAuthV3 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
2728

@@ -33,7 +34,7 @@ import (
3334
"github.com/arangodb/kube-arangodb/pkg/util/strings"
3435
)
3536

36-
func New(configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
37+
func New(ctx context.Context, configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
3738
if !configuration.Extensions.JWT {
3839
return nil, false
3940
}
@@ -43,32 +44,32 @@ func New(configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3
4344
z.configuration = configuration
4445
z.authClient = cache.NewObject[pbAuthenticationV1.AuthenticationV1Client](configuration.GetAuthClientFetcher)
4546

46-
z.cache = cache.NewCache[pbImplEnvoyAuthV3Shared.Token, pbImplEnvoyAuthV3Shared.ResponseAuth](func(ctx context.Context, in pbImplEnvoyAuthV3Shared.Token) (pbImplEnvoyAuthV3Shared.ResponseAuth, error) {
47+
z.cache = cache.NewCache[pbImplEnvoyAuthV3Shared.Token, pbImplEnvoyAuthV3Shared.ResponseAuth](func(ctx context.Context, in pbImplEnvoyAuthV3Shared.Token) (pbImplEnvoyAuthV3Shared.ResponseAuth, time.Time, error) {
4748
client, err := z.authClient.Get(ctx)
4849
if err != nil {
49-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, err
50+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), err
5051
}
5152

5253
resp, err := client.Validate(ctx, &pbAuthenticationV1.ValidateRequest{
5354
Token: string(in),
5455
})
5556
if err != nil {
56-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, err
57+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), err
5758
}
5859

5960
if !resp.GetIsValid() {
60-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, errors.Errorf("Invalid Token: %s", resp.GetMessage())
61+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), errors.Errorf("Invalid Token: %s", resp.GetMessage())
6162
}
6263

6364
if resp.Details == nil {
64-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, errors.Errorf("Missing Details: %s", resp.GetMessage())
65+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), errors.Errorf("Missing Details: %s", resp.GetMessage())
6566
}
6667

6768
return pbImplEnvoyAuthV3Shared.ResponseAuth{
6869
User: resp.GetDetails().GetUser(),
6970
Roles: resp.GetDetails().GetRoles(),
70-
}, nil
71-
}, pbImplEnvoyAuthV3Shared.DefaultTTL)
71+
}, time.Now().Add(pbImplEnvoyAuthV3Shared.DefaultTTL), nil
72+
})
7273

7374
return z, true
7475
}

‎integrations/envoy/auth/v3/impl/auth_cookie/impl.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"context"
2525
goHttp "net/http"
2626
goStrings "strings"
27+
"time"
2728

2829
pbEnvoyCoreV3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
2930
pbEnvoyAuthV3 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
@@ -38,7 +39,7 @@ import (
3839

3940
const JWTAuthorizationCookieName = "X-ArangoDB-Token-JWT"
4041

41-
func New(configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
42+
func New(ctx context.Context, configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
4243
if !configuration.Extensions.CookieJWT {
4344
logger.Info("Gateway CookieAuth Disabled")
4445
return nil, false
@@ -48,32 +49,32 @@ func New(configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3
4849

4950
z.configuration = configuration
5051
z.authClient = cache.NewObject[pbAuthenticationV1.AuthenticationV1Client](configuration.GetAuthClientFetcher)
51-
z.cache = cache.NewCache[pbImplEnvoyAuthV3Shared.Token, pbImplEnvoyAuthV3Shared.ResponseAuth](func(ctx context.Context, in pbImplEnvoyAuthV3Shared.Token) (pbImplEnvoyAuthV3Shared.ResponseAuth, error) {
52+
z.cache = cache.NewCache[pbImplEnvoyAuthV3Shared.Token, pbImplEnvoyAuthV3Shared.ResponseAuth](func(ctx context.Context, in pbImplEnvoyAuthV3Shared.Token) (pbImplEnvoyAuthV3Shared.ResponseAuth, time.Time, error) {
5253
client, err := z.authClient.Get(ctx)
5354
if err != nil {
54-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, err
55+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), err
5556
}
5657

5758
resp, err := client.Validate(ctx, &pbAuthenticationV1.ValidateRequest{
5859
Token: string(in),
5960
})
6061
if err != nil {
61-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, err
62+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), err
6263
}
6364

6465
if !resp.GetIsValid() {
65-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, errors.Errorf("Invalid Token: %s", resp.GetMessage())
66+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), errors.Errorf("Invalid Token: %s", resp.GetMessage())
6667
}
6768

6869
if resp.Details == nil {
69-
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, errors.Errorf("Missing Details: %s", resp.GetMessage())
70+
return pbImplEnvoyAuthV3Shared.ResponseAuth{}, util.Default[time.Time](), errors.Errorf("Missing Details: %s", resp.GetMessage())
7071
}
7172

7273
return pbImplEnvoyAuthV3Shared.ResponseAuth{
7374
User: resp.GetDetails().GetUser(),
7475
Roles: resp.GetDetails().GetRoles(),
75-
}, nil
76-
}, pbImplEnvoyAuthV3Shared.DefaultTTL)
76+
}, time.Now().Add(pbImplEnvoyAuthV3Shared.DefaultTTL), nil
77+
})
7778

7879
logger.Info("Gateway CookieAuth Enabled")
7980
return z, true

‎integrations/envoy/auth/v3/impl/auth_custom/impl.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,20 @@
2121
package auth_custom
2222

2323
import (
24+
"context"
25+
2426
"github.com/arangodb/kube-arangodb/integrations/envoy/auth/v3/impl/auth_custom/openid"
2527
pbImplEnvoyAuthV3Shared "github.com/arangodb/kube-arangodb/integrations/envoy/auth/v3/shared"
2628
)
2729

28-
func New(configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
30+
func New(ctx context.Context, configuration pbImplEnvoyAuthV3Shared.Configuration) (pbImplEnvoyAuthV3Shared.AuthHandler, bool) {
2931
if !configuration.Auth.Enabled {
3032
return nil, false
3133
}
3234

3335
switch configuration.Auth.Type {
3436
case "OpenID":
35-
return openid.New(configuration)
37+
return openid.New(ctx, configuration)
3638
}
3739

3840
return nil, false

0 commit comments

Comments
 (0)