diff --git a/pkg/apis/tinyauth/v1alpha1/application.go b/pkg/apis/tinyauth/v1alpha1/application.go new file mode 100644 index 00000000..c534f4a0 --- /dev/null +++ b/pkg/apis/tinyauth/v1alpha1/application.go @@ -0,0 +1,109 @@ +package v1alpha1 + +import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + +//go:generate controller-gen object paths=$GOFILE + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// ApplicationSet is a list of Application resources +type ApplicationSet struct { + metav1.TypeMeta `json:",inline"` + // +optional + metav1.ListMeta `json:"metadata,omitempty"` + + Items []Application `json:"items"` +} + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// Application is a set of access control rules that can be applied to a +// specific domain. It is an alternative to environment variable or config-based +// access controls. +type Application struct { + metav1.TypeMeta `json:",inline"` + // +optional + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec ApplicationSpec `json:"spec,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// ApplicationSpec describes the application to which this rule applies to +type ApplicationSpec struct { + Config AppConfig `json:"config,omitempty"` + Users AppUsers `json:"users,omitempty"` + OAuth AppOAuth `json:"oauth,omitempty"` + IP AppIP `json:"ip,omitempty"` + Response AppResponse `json:"response,omitempty"` + Path AppPath `json:"path,omitempty"` + LDAP AppLDAP `json:"ldap,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppConfig specifies configuration for the application +type AppConfig struct { + // +required + Name string `json:"name,omitempty"` + // +required + Domain string `json:"domain,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppUsers specifies user access control rules +type AppUsers struct { + Allow string `json:"allow,omitempty"` + Block string `json:"block,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppOAuth specifies OAuth access control rules +type AppOAuth struct { + Whitelist string `json:"whitelist,omitempty"` + Groups string `json:"groups,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppLDAP specifies LDAP access control rules +type AppLDAP struct { + Groups string `json:"groups,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppIP specifies IP access control rules +type AppIP struct { + Allow []string `json:"allow,omitempty"` + Block []string `json:"block,omitempty"` + Bypass []string `json:"bypass,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppResponse specifies response headers and basic auth credentials +type AppResponse struct { + Headers []string `json:"headers,omitempty"` + BasicAuth AppBasicAuth `json:"basicAuth,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppBasicAuth specifies basic auth credentials +type AppBasicAuth struct { + Username string `json:"username,omitempty"` + Password string `json:"password,omitempty"` + PasswordFile string `json:"passwordFile,omitempty"` +} + +// +k8s:deepcopy-gen=true + +// AppPath specifies path-based access control rules +type AppPath struct { + Allow string `json:"allow,omitempty"` + Block string `json:"block,omitempty"` +} diff --git a/pkg/apis/tinyauth/v1alpha1/crds/tinyauth.app_applications.yaml b/pkg/apis/tinyauth/v1alpha1/crds/tinyauth.app_applications.yaml new file mode 100644 index 00000000..a3657463 --- /dev/null +++ b/pkg/apis/tinyauth/v1alpha1/crds/tinyauth.app_applications.yaml @@ -0,0 +1,125 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.22.0 + name: applications.tinyauth.app +spec: + group: tinyauth.app + names: + kind: Application + listKind: ApplicationList + plural: applications + singular: application + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + Application is a set of access control rules that can be applied to a + specific domain. It is an alternative to environment variable or config-based + access controls. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ApplicationSpec describes the application to which this rule + applies to + properties: + config: + description: AppConfig specifies configuration for the application + properties: + domain: + type: string + name: + type: string + required: + - domain + - name + type: object + ip: + description: AppIP specifies IP access control rules + properties: + allow: + items: + type: string + type: array + block: + items: + type: string + type: array + bypass: + items: + type: string + type: array + type: object + ldap: + description: AppLDAP specifies LDAP access control rules + properties: + groups: + type: string + type: object + oauth: + description: AppOAuth specifies OAuth access control rules + properties: + groups: + type: string + whitelist: + type: string + type: object + path: + description: AppPath specifies path-based access control rules + properties: + allow: + type: string + block: + type: string + type: object + response: + description: AppResponse specifies response headers and basic auth + credentials + properties: + basicAuth: + description: AppBasicAuth specifies basic auth credentials + properties: + password: + type: string + passwordFile: + type: string + username: + type: string + type: object + headers: + items: + type: string + type: array + type: object + users: + description: AppUsers specifies user access control rules + properties: + allow: + type: string + block: + type: string + type: object + type: object + type: object + served: true + storage: true diff --git a/pkg/apis/tinyauth/v1alpha1/doc.go b/pkg/apis/tinyauth/v1alpha1/doc.go new file mode 100644 index 00000000..4d9977c0 --- /dev/null +++ b/pkg/apis/tinyauth/v1alpha1/doc.go @@ -0,0 +1,3 @@ +package v1alpha1 + +//+groupName=tinyauth.app diff --git a/pkg/apis/tinyauth/v1alpha1/register.go b/pkg/apis/tinyauth/v1alpha1/register.go new file mode 100644 index 00000000..f5ae87cb --- /dev/null +++ b/pkg/apis/tinyauth/v1alpha1/register.go @@ -0,0 +1,27 @@ +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "tinyauth.app" +const GroupVersion = "v1alpha1" + +var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: GroupVersion} + +var ( + SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) + AddToScheme = SchemeBuilder.AddToScheme +) + +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &Application{}, + &ApplicationSet{}, + ) + + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} diff --git a/pkg/apis/tinyauth/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/tinyauth/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 00000000..c0a511e2 --- /dev/null +++ b/pkg/apis/tinyauth/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,230 @@ +//go:build !ignore_autogenerated + +// Code generated by controller-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppBasicAuth) DeepCopyInto(out *AppBasicAuth) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppBasicAuth. +func (in *AppBasicAuth) DeepCopy() *AppBasicAuth { + if in == nil { + return nil + } + out := new(AppBasicAuth) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppConfig) DeepCopyInto(out *AppConfig) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppConfig. +func (in *AppConfig) DeepCopy() *AppConfig { + if in == nil { + return nil + } + out := new(AppConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppIP) DeepCopyInto(out *AppIP) { + *out = *in + if in.Allow != nil { + in, out := &in.Allow, &out.Allow + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.Block != nil { + in, out := &in.Block, &out.Block + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.Bypass != nil { + in, out := &in.Bypass, &out.Bypass + *out = make([]string, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppIP. +func (in *AppIP) DeepCopy() *AppIP { + if in == nil { + return nil + } + out := new(AppIP) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppLDAP) DeepCopyInto(out *AppLDAP) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppLDAP. +func (in *AppLDAP) DeepCopy() *AppLDAP { + if in == nil { + return nil + } + out := new(AppLDAP) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppOAuth) DeepCopyInto(out *AppOAuth) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppOAuth. +func (in *AppOAuth) DeepCopy() *AppOAuth { + if in == nil { + return nil + } + out := new(AppOAuth) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppPath) DeepCopyInto(out *AppPath) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppPath. +func (in *AppPath) DeepCopy() *AppPath { + if in == nil { + return nil + } + out := new(AppPath) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppResponse) DeepCopyInto(out *AppResponse) { + *out = *in + if in.Headers != nil { + in, out := &in.Headers, &out.Headers + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.BasicAuth = in.BasicAuth +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppResponse. +func (in *AppResponse) DeepCopy() *AppResponse { + if in == nil { + return nil + } + out := new(AppResponse) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppUsers) DeepCopyInto(out *AppUsers) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppUsers. +func (in *AppUsers) DeepCopy() *AppUsers { + if in == nil { + return nil + } + out := new(AppUsers) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Application) DeepCopyInto(out *Application) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Application. +func (in *Application) DeepCopy() *Application { + if in == nil { + return nil + } + out := new(Application) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *Application) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ApplicationSet) DeepCopyInto(out *ApplicationSet) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]Application, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationSet. +func (in *ApplicationSet) DeepCopy() *ApplicationSet { + if in == nil { + return nil + } + out := new(ApplicationSet) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *ApplicationSet) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ApplicationSpec) DeepCopyInto(out *ApplicationSpec) { + *out = *in + out.Config = in.Config + out.Users = in.Users + out.OAuth = in.OAuth + in.IP.DeepCopyInto(&out.IP) + in.Response.DeepCopyInto(&out.Response) + out.Path = in.Path + out.LDAP = in.LDAP +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationSpec. +func (in *ApplicationSpec) DeepCopy() *ApplicationSpec { + if in == nil { + return nil + } + out := new(ApplicationSpec) + in.DeepCopyInto(out) + return out +}