Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

operator: support storing SSO connector client secret in a Kubernetes Secret #46699

Merged
merged 9 commits into from
Sep 20, 2024
Merged

operator: support storing SSO connector client secret in a Kubernetes Secret #46699

merged 9 commits into from
Sep 20, 2024

Conversation

hugoShaka
Copy link
Contributor

Fixes: #6815

Changelog: The Teleport Kubernetes Operator is now able to lookup the GitHub and OIDC connector client_secret value from a Kubernetes Secret.

@hugoShaka hugoShaka changed the title Hugo/operator sso secrets lookup operator: support storing SSO connector client secret in a Kubernetes Secret Sep 17, 2024
@github-actions GitHub Actions
Copy link

🤖 Vercel preview here: https://docs-gy730te5k-goteleport.vercel.app/docs/ver/preview

@github-actions GitHub Actions
Copy link

🤖 Vercel preview here: https://docs-nfzay6sn4-goteleport.vercel.app/docs/ver/preview

r0mant
r0mant approved these changes Sep 18, 2024
View reviewed changes
docs/pages/admin-guides/infrastructure-as-code/teleport-operator.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/reference/operator-resources/resources.teleport.dev_githubconnectors.mdx
@@ -29,7 +29,7 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|api_endpoint_url|string|APIEndpointURL is the URL of the API endpoint of the Github instance this connector is for.|
|client_id|string|ClientID is the Github OAuth app client ID.|
|client_redirect_settings|[object](#specclient_redirect_settings)|ClientRedirectSettings defines which client redirect URLs are allowed for non-browser SSO logins other than the standard localhost ones.|
|client_secret|string|ClientSecret is the Github OAuth app client secret.|
|client_secret|string|ClientSecret is the Github OAuth app client secret. This field supports secret lookup. See the operator documentation for more details.|
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I'd add a link to "operator documentation" to user can easily navigate.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will be an absolute link because it will be displayed in kubectl explain teleportgithubconnector.spec

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc linter blocks me from puttin an absolute link,it wants a relative one. Relative links make no sense in the CRD so I will revert this change and remove the link.

docs/pages/reference/operator-resources/resources.teleport.dev_oidcconnectors.mdx Show resolved Hide resolved
integrations/operator/controllers/resources/secretlookup/secretlookup.go Show resolved Hide resolved
ptgott
ptgott approved these changes Sep 18, 2024
View reviewed changes
Copy link
Contributor

@ptgott ptgott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved with grammar and style feedback

docs/pages/admin-guides/infrastructure-as-code/teleport-operator.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
docs/pages/admin-guides/infrastructure-as-code/teleport-operator/secret-lookup.mdx Outdated Show resolved Hide resolved
@zmb3
Copy link
Collaborator

zmb3 commented Sep 18, 2024

How does this play with #46041?

@hugoShaka
Copy link
Contributor Author

How does this play with #46041?

Teleport is not aware of the secret:// scheme, the operator replaces the secret:// uri by the secret value. Any other scheme is passed as-is.

If you were to set file://foobar in the CR, the operator would send this as-is to Teleport. Teleport validation would fail because of #46041, and the operator would put the error in the CR status field and mark the reconciliation as failed.

@zmb3
Copy link
Collaborator

zmb3 commented Sep 18, 2024

Great, sounds like we can merge both PRs without any issues then.

@hugoShaka @ptgott @r0mant
Apply suggestions from code review
fa69c85 
Co-authored-by: Paul Gottschling <[email protected]>
Co-authored-by: Roman Tkachenko <[email protected]>
@github-actions GitHub Actions
Copy link

🤖 Vercel preview here: https://docs-8l9cfisam-goteleport.vercel.app/docs/ver/preview

@github-actions GitHub Actions
Copy link

🤖 Vercel preview here: https://docs-4oym9b189-goteleport.vercel.app/docs/ver/preview

@github-actions GitHub Actions
Copy link

🤖 Vercel preview here: https://docs-q947jrwr2-goteleport.vercel.app/docs/ver/preview

@hugoShaka hugoShaka added this pull request to the merge queue Sep 20, 2024
github-merge-queue bot pushed a commit that referenced this pull request Sep 20, 2024
@hugoShaka @ptgott @r0mant
operator: support storing SSO connector client secret in a Kubernetes…
8f7a404 
… Secret (#46699)

* Allow operator secret lookup

* Document which fields can lookup secrets

* operator: support secret lookup

* fixup! operator: support secret lookup

* Apply suggestions from code review

Co-authored-by: Paul Gottschling <[email protected]>
Co-authored-by: Roman Tkachenko <[email protected]>

* lint

* add link to operator docs

* address feedback

* Revert "add link to operator docs"

This reverts commit cd812eb.

---------

Co-authored-by: Paul Gottschling <[email protected]>
Co-authored-by: Roman Tkachenko <[email protected]>
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 20, 2024
@hugoShaka hugoShaka added this pull request to the merge queue Sep 20, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 20, 2024
@hugoShaka hugoShaka added this pull request to the merge queue Sep 20, 2024
Merged via the queue into master with commit 2ba79b2 Sep 20, 2024
42 checks passed
@hugoShaka hugoShaka deleted the hugo/operator-sso-secrets-lookup branch September 20, 2024 22:01
@public-teleport-github-review-bot
Copy link

@hugoShaka See the table below for backport results.

Branch Result
branch/v16 Create PR

@camscale camscale mentioned this pull request Sep 25, 2024
Merged
@zmb3 zmb3 mentioned this pull request Oct 16, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@r0mant r0mant r0mant approved these changes

@tigrato tigrato tigrato approved these changes

@ptgott ptgott ptgott approved these changes

Assignees
No one assigned
Labels
backport/branch/v16 documentation helm size/md
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

add support for loading connector secrets from a file (k8s secret)
5 participants
@hugoShaka @zmb3 @r0mant @tigrato @ptgott