From 97a64593d7a88cffd8ec4a9364d4be64358afa2f Mon Sep 17 00:00:00 2001 From: Michael Nairn Date: Thu, 28 May 2026 01:22:04 -0700 Subject: [PATCH 01/14] fix: validate bundle after all modifications complete Move bundle validation to run after bundle-custom-modifications so the final bundle (with OpenShift version labels, Quay expiry, and optional digest-specific changes) is validated once, regardless of USE_IMAGE_DIGESTS setting. Signed-off-by: Michael Nairn Signed-off-by: Thomas Maas --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index a3d02fa9..4bef9bc8 100644 --- a/Makefile +++ b/Makefile @@ -347,10 +347,10 @@ bundle: manifests kustomize operator-sdk yq ## Generate bundle manifests and met ($(YQ) e -e '.config.replaces' $(BUILD_CONFIG_FILE) && \ V="$(shell $(YQ) e -e '.config.replaces' $(BUILD_CONFIG_FILE))" $(YQ) eval '.spec.replaces = strenv(V)' -i $(BUNDLE_CSV)) || \ ($(YQ) eval '.' -i $(BUNDLE_CSV) && echo "no replaces added") + $(MAKE) bundle-custom-modifications $(OPERATOR_SDK) bundle validate ./bundle # Roll back edit cd config/manager && $(KUSTOMIZE) edit set image controller=${DEFAULT_OPERATOR_IMAGE} - $(MAKE) bundle-custom-modifications .PHONY: bundle-custom-modifications OPENSHIFT_VERSIONS_ANNOTATION_KEY="com.redhat.openshift.versions" From e94e9efe0269b142f518451021938accc29f5e8e Mon Sep 17 00:00:00 2001 From: Guilherme Cassolato Date: Thu, 11 Jun 2026 16:01:14 +0200 Subject: [PATCH 02/14] Update Authorino manifests Signed-off-by: Guilherme Cassolato Signed-off-by: Thomas Maas --- .../authorino.kuadrant.io_authconfigs.yaml | 69 +++++++++++++++++-- .../templates/manifests.yaml | 69 +++++++++++++++++-- config/deploy/manifests.yaml | 69 +++++++++++++++++-- 3 files changed, 186 insertions(+), 21 deletions(-) diff --git a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml index a340c549..a62fff76 100644 --- a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml +++ b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml @@ -2868,7 +2868,11 @@ spec: type: object x-kubernetes-map-type: atomic endpoint: - description: The full URL of the token introspection endpoint. + description: |- + The full URL of the token introspection endpoint. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string tokenTypeHint: description: |- @@ -3543,8 +3547,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -3579,11 +3586,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4110,8 +4129,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4142,11 +4164,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4458,8 +4492,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4490,11 +4527,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4532,6 +4581,9 @@ spec: description: |- The endpoint of the UMA server. The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint. + + IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - credentialsRef @@ -4551,6 +4603,9 @@ spec: The URL of the UserInfo endpoint. Use it for non-OIDC JWT authentication, where the UserInfo URL is known beforehand. One of: identitySource, userInfoUrl + + IMPORTANT: Ensure this URL points to a trusted endpoint. If constructing this URL dynamically or if it can be + influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string type: object x-kubernetes-validations: diff --git a/charts/authorino-operator/templates/manifests.yaml b/charts/authorino-operator/templates/manifests.yaml index 810763b1..3a2dfb8b 100644 --- a/charts/authorino-operator/templates/manifests.yaml +++ b/charts/authorino-operator/templates/manifests.yaml @@ -2867,7 +2867,11 @@ spec: type: object x-kubernetes-map-type: atomic endpoint: - description: The full URL of the token introspection endpoint. + description: |- + The full URL of the token introspection endpoint. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string tokenTypeHint: description: |- @@ -3542,8 +3546,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -3578,11 +3585,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4109,8 +4128,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4141,11 +4163,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4457,8 +4491,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4489,11 +4526,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4531,6 +4580,9 @@ spec: description: |- The endpoint of the UMA server. The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint. + + IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - credentialsRef @@ -4550,6 +4602,9 @@ spec: The URL of the UserInfo endpoint. Use it for non-OIDC JWT authentication, where the UserInfo URL is known beforehand. One of: identitySource, userInfoUrl + + IMPORTANT: Ensure this URL points to a trusted endpoint. If constructing this URL dynamically or if it can be + influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string type: object x-kubernetes-validations: diff --git a/config/deploy/manifests.yaml b/config/deploy/manifests.yaml index fd69d93f..565edf8d 100644 --- a/config/deploy/manifests.yaml +++ b/config/deploy/manifests.yaml @@ -2874,7 +2874,11 @@ spec: type: object x-kubernetes-map-type: atomic endpoint: - description: The full URL of the token introspection endpoint. + description: |- + The full URL of the token introspection endpoint. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string tokenTypeHint: description: |- @@ -3549,8 +3553,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -3585,11 +3592,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4116,8 +4135,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4148,11 +4170,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4464,8 +4498,11 @@ spec: type: string type: array tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. + description: |- + Token endpoint URL of the OAuth2 resource server. + + IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - clientId @@ -4496,11 +4533,23 @@ spec: The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. E.g. https://ext-auth-server.io/metadata?p={request.path} + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string urlExpression: description: |- A Common Expression Language (CEL) expression that evaluates to a string endpoint URL of the HTTP service to call. String expressions are supported (https://pkg.go.dev/github.com/google/cel-go/ext#Strings). + + IMPORTANT: Avoid using untrusted user input (e.g. request headers, query parameters, or JWT claims) directly in + URL construction, as this may expose your services to Server-Side Request Forgery (SSRF) attacks. An attacker + controlling the URL or parts of it may be able to make Authorino send requests to internal services, cloud + metadata endpoints (e.g. 169.254.169.254), or other unintended destinations. Always validate and sanitize any + dynamic values used in URLs. type: string type: object x-kubernetes-validations: @@ -4538,6 +4587,9 @@ spec: description: |- The endpoint of the UMA server. The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint. + + IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, + you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string required: - credentialsRef @@ -4557,6 +4609,9 @@ spec: The URL of the UserInfo endpoint. Use it for non-OIDC JWT authentication, where the UserInfo URL is known beforehand. One of: identitySource, userInfoUrl + + IMPORTANT: Ensure this URL points to a trusted endpoint. If constructing this URL dynamically or if it can be + influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string type: object x-kubernetes-validations: From 5aeebab146b6a61889b25708ac998da9118af9a7 Mon Sep 17 00:00:00 2001 From: Guilherme Cassolato Date: Fri, 12 Jun 2026 13:55:45 +0200 Subject: [PATCH 03/14] Update Authorino manifests Signed-off-by: Guilherme Cassolato Signed-off-by: Thomas Maas --- .../authorino.kuadrant.io_authconfigs.yaml | 84 +++++++++++++++++++ .../templates/manifests.yaml | 84 +++++++++++++++++++ config/deploy/manifests.yaml | 84 +++++++++++++++++++ 3 files changed, 252 insertions(+) diff --git a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml index a62fff76..11d01a8e 100644 --- a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml +++ b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml @@ -2825,6 +2825,13 @@ spec: The JSON Web Keys (JWK) obtained from this endpoint are automatically cached and the caching updated whenever the kid of a JWT does not match any of the cached JWKs (https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys). One of: jwksUrl, issuerUrl type: string + timeout: + description: |- + Timeout for OIDC discovery and JWK fetching HTTP requests, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: |- Decides how long the OIDC configuration will be cached. @@ -2846,6 +2853,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the Kubernetes TokenReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer type: object metrics: default: false @@ -2874,6 +2888,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for the token introspection HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenTypeHint: description: |- The token type hint for the token introspection. @@ -3319,6 +3340,13 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object type: object + timeout: + description: |- + Timeout for the Kubernetes SubjectAccessReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer user: description: |- User to check for authorization in the Kubernetes RBAC. @@ -3546,6 +3574,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -3576,6 +3611,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: Duration (in seconds) of the external data in the cache before pulled again from the source. @@ -4128,6 +4170,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4158,6 +4207,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4491,6 +4547,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4521,6 +4584,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4585,6 +4655,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for UMA HTTP requests (discovery, PAT, resource queries), in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer required: - credentialsRef - endpoint @@ -4598,6 +4675,13 @@ spec: Name of an OIDC JWT authentication rule whose obtained configuration includes an "userinfo_endpoint" claim. One of: identitySource, userInfoUrl type: string + timeout: + description: |- + Timeout for the UserInfo HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer userInfoUrl: description: |- The URL of the UserInfo endpoint. diff --git a/charts/authorino-operator/templates/manifests.yaml b/charts/authorino-operator/templates/manifests.yaml index 3a2dfb8b..bf385d01 100644 --- a/charts/authorino-operator/templates/manifests.yaml +++ b/charts/authorino-operator/templates/manifests.yaml @@ -2824,6 +2824,13 @@ spec: The JSON Web Keys (JWK) obtained from this endpoint are automatically cached and the caching updated whenever the kid of a JWT does not match any of the cached JWKs (https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys). One of: jwksUrl, issuerUrl type: string + timeout: + description: |- + Timeout for OIDC discovery and JWK fetching HTTP requests, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: |- Decides how long the OIDC configuration will be cached. @@ -2845,6 +2852,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the Kubernetes TokenReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer type: object metrics: default: false @@ -2873,6 +2887,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for the token introspection HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenTypeHint: description: |- The token type hint for the token introspection. @@ -3318,6 +3339,13 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object type: object + timeout: + description: |- + Timeout for the Kubernetes SubjectAccessReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer user: description: |- User to check for authorization in the Kubernetes RBAC. @@ -3545,6 +3573,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -3575,6 +3610,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: Duration (in seconds) of the external data in the cache before pulled again from the source. @@ -4127,6 +4169,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4157,6 +4206,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4490,6 +4546,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4520,6 +4583,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4584,6 +4654,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for UMA HTTP requests (discovery, PAT, resource queries), in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer required: - credentialsRef - endpoint @@ -4597,6 +4674,13 @@ spec: Name of an OIDC JWT authentication rule whose obtained configuration includes an "userinfo_endpoint" claim. One of: identitySource, userInfoUrl type: string + timeout: + description: |- + Timeout for the UserInfo HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer userInfoUrl: description: |- The URL of the UserInfo endpoint. diff --git a/config/deploy/manifests.yaml b/config/deploy/manifests.yaml index 565edf8d..78b60531 100644 --- a/config/deploy/manifests.yaml +++ b/config/deploy/manifests.yaml @@ -2831,6 +2831,13 @@ spec: The JSON Web Keys (JWK) obtained from this endpoint are automatically cached and the caching updated whenever the kid of a JWT does not match any of the cached JWKs (https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys). One of: jwksUrl, issuerUrl type: string + timeout: + description: |- + Timeout for OIDC discovery and JWK fetching HTTP requests, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: |- Decides how long the OIDC configuration will be cached. @@ -2852,6 +2859,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the Kubernetes TokenReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer type: object metrics: default: false @@ -2880,6 +2894,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted OAuth2 server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for the token introspection HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenTypeHint: description: |- The token type hint for the token introspection. @@ -3325,6 +3346,13 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object type: object + timeout: + description: |- + Timeout for the Kubernetes SubjectAccessReview API request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer user: description: |- User to check for authorization in the Kubernetes RBAC. @@ -3552,6 +3580,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -3582,6 +3617,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer ttl: description: Duration (in seconds) of the external data in the cache before pulled again from the source. @@ -4134,6 +4176,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4164,6 +4213,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4497,6 +4553,13 @@ spec: items: type: string type: array + timeout: + description: |- + Timeout for the token endpoint HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer tokenUrl: description: |- Token endpoint URL of the OAuth2 resource server. @@ -4527,6 +4590,13 @@ spec: - key - name type: object + timeout: + description: |- + Timeout for the HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer url: description: |- Endpoint URL of the HTTP service. @@ -4591,6 +4661,13 @@ spec: IMPORTANT: Ensure this URL points to a trusted UMA server. If this value can be influenced by user input, you may be vulnerable to Server-Side Request Forgery (SSRF) attacks. type: string + timeout: + description: |- + Timeout for UMA HTTP requests (discovery, PAT, resource queries), in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer required: - credentialsRef - endpoint @@ -4604,6 +4681,13 @@ spec: Name of an OIDC JWT authentication rule whose obtained configuration includes an "userinfo_endpoint" claim. One of: identitySource, userInfoUrl type: string + timeout: + description: |- + Timeout for the UserInfo HTTP request, in milliseconds. + If not specified, defaults to 5000ms (5 seconds). + Set to 0 to disable timeout. + minimum: 0 + type: integer userInfoUrl: description: |- The URL of the UserInfo endpoint. From 167c85835de99deac54455f23831959a2342ee3a Mon Sep 17 00:00:00 2001 From: Guilherme Cassolato Date: Tue, 16 Jun 2026 10:18:39 +0200 Subject: [PATCH 04/14] Update Authorino manifests Signed-off-by: Guilherme Cassolato Signed-off-by: Thomas Maas --- .../authorino.kuadrant.io_authconfigs.yaml | 88 +++++-------------- .../templates/manifests.yaml | 88 +++++-------------- config/deploy/manifests.yaml | 88 +++++-------------- 3 files changed, 72 insertions(+), 192 deletions(-) diff --git a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml index 11d01a8e..c98d59ee 100644 --- a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml +++ b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml @@ -489,23 +489,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -1120,6 +1103,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -1417,19 +1407,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -1762,6 +1739,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. @@ -2841,8 +2822,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: jwksUrl, issuerUrl' - rule: '!(has(self.jwksUrl) && self.jwksUrl != '''' && has(self.issuerUrl) - && self.issuerUrl != '''')' + rule: has(self.jwksUrl) != has(self.issuerUrl) kubernetesTokenReview: description: Authentication by Kubernetes token review. properties: @@ -3131,23 +3111,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -3954,6 +3917,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -4324,19 +4294,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -4694,8 +4651,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: identitySource, userInfoUrl' - rule: '!(has(self.identitySource) && self.identitySource != - '''' && has(self.userInfoUrl) && self.userInfoUrl != '''')' + rule: has(self.identitySource) != has(self.userInfoUrl) when: description: |- Conditions for Authorino to enforce this config. @@ -4774,6 +4730,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. diff --git a/charts/authorino-operator/templates/manifests.yaml b/charts/authorino-operator/templates/manifests.yaml index bf385d01..da37595f 100644 --- a/charts/authorino-operator/templates/manifests.yaml +++ b/charts/authorino-operator/templates/manifests.yaml @@ -488,23 +488,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -1119,6 +1102,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -1416,19 +1406,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -1761,6 +1738,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. @@ -2840,8 +2821,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: jwksUrl, issuerUrl' - rule: '!(has(self.jwksUrl) && self.jwksUrl != '''' && has(self.issuerUrl) - && self.issuerUrl != '''')' + rule: has(self.jwksUrl) != has(self.issuerUrl) kubernetesTokenReview: description: Authentication by Kubernetes token review. properties: @@ -3130,23 +3110,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -3953,6 +3916,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -4323,19 +4293,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -4693,8 +4650,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: identitySource, userInfoUrl' - rule: '!(has(self.identitySource) && self.identitySource != - '''' && has(self.userInfoUrl) && self.userInfoUrl != '''')' + rule: has(self.identitySource) != has(self.userInfoUrl) when: description: |- Conditions for Authorino to enforce this config. @@ -4773,6 +4729,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. diff --git a/config/deploy/manifests.yaml b/config/deploy/manifests.yaml index 78b60531..f4d0dc9f 100644 --- a/config/deploy/manifests.yaml +++ b/config/deploy/manifests.yaml @@ -495,23 +495,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -1126,6 +1109,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -1423,19 +1413,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -1768,6 +1745,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. @@ -2847,8 +2828,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: jwksUrl, issuerUrl' - rule: '!(has(self.jwksUrl) && self.jwksUrl != '''' && has(self.issuerUrl) - && self.issuerUrl != '''')' + rule: has(self.jwksUrl) != has(self.issuerUrl) kubernetesTokenReview: description: Authentication by Kubernetes token review. properties: @@ -3137,23 +3117,6 @@ spec: type: object authorization: additionalProperties: - oneOf: - - properties: - opa: {} - required: - - opa - - properties: - patternMatching: {} - required: - - patternMatching - - properties: - kubernetesSubjectAccessReview: {} - required: - - kubernetesSubjectAccessReview - - properties: - spicedb: {} - required: - - spicedb properties: cache: description: |- @@ -3960,6 +3923,13 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, + spicedb' + rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) + || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) + != has(self.spicedb)' description: |- Authorization policies. All policies MUST evaluate to "allowed = true" for the auth request be successful. @@ -4330,19 +4300,6 @@ spec: type: array metadata: additionalProperties: - oneOf: - - properties: - userInfo: {} - required: - - userInfo - - properties: - uma: {} - required: - - uma - - properties: - http: {} - required: - - http properties: cache: description: |- @@ -4700,8 +4657,7 @@ spec: type: object x-kubernetes-validations: - message: 'Use one of: identitySource, userInfoUrl' - rule: '!(has(self.identitySource) && self.identitySource != - '''' && has(self.userInfoUrl) && self.userInfoUrl != '''')' + rule: has(self.identitySource) != has(self.userInfoUrl) when: description: |- Conditions for Authorino to enforce this config. @@ -4780,6 +4736,10 @@ spec: type: object type: array type: object + x-kubernetes-validations: + - message: 'Use exactly one of: http, userInfo, uma' + rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) + : has(self.userInfo) != has(self.uma)' description: |- Metadata sources. Authorino fetches auth metadata as JSON from sources specified in this config. From 2a1cf0c6dab58a15ba5f3aae75857b4c738d1c7e Mon Sep 17 00:00:00 2001 From: Thomas Maas Date: Mon, 22 Jun 2026 10:21:40 +0200 Subject: [PATCH 05/14] Upgrade Go to 1.26.3 Signed-off-by: Thomas Maas --- Dockerfile | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index eb970b09..e8e853c0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # Build the authorino binary # https://catalog.redhat.com/software/containers/ubi10/go-toolset -FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi10/go-toolset:1.25 AS builder +FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi10/go-toolset:1.26 AS builder WORKDIR /workspace # Copy the Go Modules manifests diff --git a/go.mod b/go.mod index 71fad992..a597db95 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/kuadrant/authorino-operator -go 1.25.9 +go 1.26.3 require ( github.com/go-logr/logr v1.4.3 From 61545d680c1c6a01d88ffb5474b53358f6d047c2 Mon Sep 17 00:00:00 2001 From: averevki Date: Thu, 25 Jun 2026 18:04:03 +0200 Subject: [PATCH 06/14] Authorino manifests sync automatic worflow Signed-off-by: averevki Signed-off-by: Thomas Maas --- .../workflows/sync-authorino-manifests.yaml | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 .github/workflows/sync-authorino-manifests.yaml diff --git a/.github/workflows/sync-authorino-manifests.yaml b/.github/workflows/sync-authorino-manifests.yaml new file mode 100644 index 00000000..ef47c24e --- /dev/null +++ b/.github/workflows/sync-authorino-manifests.yaml @@ -0,0 +1,64 @@ +name: Sync Authorino manifests + +on: + repository_dispatch: + types: + - authorino-manifests-sync + workflow_dispatch: {} + +concurrency: + group: authorino-manifests-sync + cancel-in-progress: true + +jobs: + sync-manifests: + name: Sync manifests and create PR + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + ref: main + token: ${{ secrets.KUADRANT_DEV_PAT }} + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@v6 + with: + go-version-file: go.mod + + - name: Install gettext-base + run: | + sudo apt-get update + sudo apt-get install -y gettext-base + + - name: Update manifests + run: | + make manifests bundle helm-build + + - name: Check for meaningful changes + id: check + run: | + git diff -I'^ createdAt:' --quiet && echo "skip=true" >> $GITHUB_OUTPUT || echo "skip=false" >> $GITHUB_OUTPUT + + - name: Create Pull Request + if: steps.check.outputs.skip == 'false' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.KUADRANT_DEV_PAT }} + commit-message: Update Authorino manifests + committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> + author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com> + signoff: true + base: main + branch: sync/authorino-manifests + delete-branch: true + title: Update Authorino manifests + body: | + Automated sync of Authorino AuthConfig CRD and related manifests. + + Synced by running `make manifests bundle helm-build`. + + [Recent Authorino manifest changes](https://github.com/Kuadrant/authorino/commits/main/install) + + Auto-generated by [sync-authorino-manifests](https://github.com/Kuadrant/authorino-operator/actions/workflows/sync-authorino-manifests.yaml) From 3ec9d4dcb5efd0c12fbc8cc2233ad436cec87720 Mon Sep 17 00:00:00 2001 From: averevki Date: Tue, 7 Jul 2026 22:17:23 +0200 Subject: [PATCH 07/14] Add gpg commit signature to the sync-manifests workflow Signed-off-by: averevki Signed-off-by: Thomas Maas --- .github/workflows/sync-authorino-manifests.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/sync-authorino-manifests.yaml b/.github/workflows/sync-authorino-manifests.yaml index ef47c24e..4f9309b8 100644 --- a/.github/workflows/sync-authorino-manifests.yaml +++ b/.github/workflows/sync-authorino-manifests.yaml @@ -50,6 +50,7 @@ jobs: committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com> signoff: true + sign-commits: true base: main branch: sync/authorino-manifests delete-branch: true From 0e9de4bd7a5dd51535f8f46738410e47659cc4da Mon Sep 17 00:00:00 2001 From: averevki <71602537+averevki@users.noreply.github.com> Date: Tue, 7 Jul 2026 18:10:09 +0000 Subject: [PATCH 08/14] Update Authorino manifests Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Thomas Maas --- .../authorino.kuadrant.io_authconfigs.yaml | 2523 +---------------- .../templates/manifests.yaml | 2523 +---------------- config/deploy/manifests.yaml | 2523 +---------------- 3 files changed, 30 insertions(+), 7539 deletions(-) diff --git a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml index c98d59ee..7ac659ca 100644 --- a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml +++ b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml @@ -14,2519 +14,6 @@ spec: singular: authconfig scope: Namespaced versions: - - additionalPrinterColumns: - - description: Ready for all hosts - jsonPath: .status.summary.ready - name: Ready - type: string - - description: Number of hosts ready - jsonPath: .status.summary.numHostsReady - name: Hosts - type: string - - description: Number of trusted identity sources - jsonPath: .status.summary.numIdentitySources - name: Authentication - priority: 2 - type: integer - - description: Number of external metadata sources - jsonPath: .status.summary.numMetadataSources - name: Metadata - priority: 2 - type: integer - - description: Number of authorization policies - jsonPath: .status.summary.numAuthorizationPolicies - name: Authorization - priority: 2 - type: integer - - description: Number of items added to the authorization response - jsonPath: .status.summary.numResponseItems - name: Response - priority: 2 - type: integer - - description: Whether issuing Festival Wristbands - jsonPath: .status.summary.festivalWristbandEnabled - name: Wristband - priority: 2 - type: boolean - name: v1beta2 - schema: - openAPIV3Schema: - description: AuthConfig is the schema for Authorino's AuthConfig API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Specifies the desired state of the AuthConfig resource, i.e. - the authentication/authorization scheme to be applied to protect the - matching service hosts. - properties: - authentication: - additionalProperties: - oneOf: - - properties: - credentials: {} - oauth2Introspection: {} - required: - - oauth2Introspection - - properties: - credentials: {} - jwt: {} - required: - - jwt - - properties: - apiKey: {} - credentials: {} - required: - - apiKey - - properties: - credentials: {} - x509: {} - required: - - x509 - - properties: - credentials: {} - kubernetesTokenReview: {} - required: - - kubernetesTokenReview - - properties: - anonymous: {} - credentials: {} - required: - - anonymous - - properties: - credentials: {} - plain: {} - required: - - plain - properties: - anonymous: - description: Anonymous access. - type: object - apiKey: - description: Authentication based on API keys stored in Kubernetes - secrets. - properties: - allNamespaces: - default: false - description: |- - Whether Authorino should look for API key secrets in all namespaces or only in the same namespace as the AuthConfig. - Enabling this option in namespaced Authorino instances has no effect. - type: boolean - selector: - description: Label selector used by Authorino to match secrets - from the cluster storing valid credentials to authenticate - to this service - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - required: - - selector - type: object - cache: - description: |- - Caching options for the resolved object returned when applying this config. - Omit it to avoid caching objects for this config. - properties: - key: - description: |- - Key used to store the entry in the cache. - The resolved key must be unique within the scope of this particular config. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - ttl: - default: 60 - description: Duration (in seconds) of the external data - in the cache before pulled again from the source. - type: integer - required: - - key - type: object - credentials: - description: |- - Defines where credentials are required to be passed in the request for authentication based on this config. - If omitted, it defaults to credentials passed in the HTTP Authorization header and the "Bearer" prefix prepended to the secret credential value. - properties: - authorizationHeader: - properties: - prefix: - type: string - type: object - cookie: - properties: - name: - type: string - required: - - name - type: object - customHeader: - properties: - name: - type: string - required: - - name - type: object - queryString: - properties: - name: - type: string - required: - - name - type: object - type: object - defaults: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: |- - Set default property values (claims) for the resolved identity object, that are set before appending the object to - the authorization JSON. If the property is already present in the resolved identity object, the default value is ignored. - It requires the resolved identity object to always be a JSON object. - Do not use this option with identity objects of other JSON types (array, string, etc). - type: object - jwt: - description: Authentication based on JWT tokens. - properties: - issuerUrl: - description: |- - URL of the issuer of the JWT. - If `jwksUrl` is omitted, Authorino will append the path to the OpenID Connect Well-Known Discovery endpoint - (i.e. "/.well-known/openid-configuration") to this URL, to discover the OIDC configuration where to obtain - the "jkws_uri" claim from. - The value must coincide with the value of the "iss" (issuer) claim of the discovered OpenID Connect configuration. - type: string - ttl: - description: |- - Decides how long to wait before refreshing the JWKS (in seconds). - If omitted, Authorino will never refresh the JWKS. - type: integer - type: object - kubernetesTokenReview: - description: Authentication by Kubernetes token review. - properties: - audiences: - description: |- - The list of audiences (scopes) that must be claimed in a Kubernetes authentication token supplied in the request, and reviewed by Authorino. - If omitted, Authorino will review tokens expecting the host name of the requested protected service amongst the audiences. - items: - type: string - type: array - type: object - metrics: - default: false - description: Whether this config should generate individual - observability metrics - type: boolean - oauth2Introspection: - description: Authentication by OAuth2 token introspection. - properties: - credentialsRef: - description: Reference to a Kubernetes secret in the same - namespace, that stores client credentials to the OAuth2 - server. - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - endpoint: - description: The full URL of the token introspection endpoint. - type: string - tokenTypeHint: - description: |- - The token type hint for the token introspection. - If omitted, it defaults to "access_token". - type: string - required: - - credentialsRef - - endpoint - type: object - overrides: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: |- - Overrides the resolved identity object by setting the additional properties (claims) specified in this config, - before appending the object to the authorization JSON. - It requires the resolved identity object to always be a JSON object. - Do not use this option with identity objects of other JSON types (array, string, etc). - type: object - plain: - description: |- - Identity object extracted from the context. - Use this method when authentication is performed beforehand by a proxy and the resulting object passed to Authorino as JSON in the auth request. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - required: - - selector - type: object - priority: - default: 0 - description: |- - Priority group of the config. - All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. - type: integer - when: - description: |- - Conditions for Authorino to enforce this config. - If omitted, the config will be enforced for all requests. - If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. - items: - oneOf: - - properties: - patternRef: {} - required: - - patternRef - - properties: - operator: {} - selector: {} - value: {} - required: - - operator - - selector - - properties: - all: {} - required: - - all - - properties: - any: {} - required: - - any - properties: - all: - description: A list of pattern expressions to be evaluated - as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to be evaluated - as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - x509: - description: |- - Authentication based on client X.509 certificates. - The certificates presented by the clients must be signed by a trusted CA whose certificates are stored in Kubernetes secrets. - properties: - allNamespaces: - default: false - description: |- - Whether Authorino should look for TLS secrets in all namespaces or only in the same namespace as the AuthConfig. - Enabling this option in namespaced Authorino instances has no effect. - type: boolean - selector: - description: |- - Label selector used by Authorino to match secrets from the cluster storing trusted CA certificates to validate - clients trying to authenticate to this service - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - required: - - selector - type: object - type: object - description: |- - Authentication configs. - At least one config MUST evaluate to a valid identity object for the auth request to be successful. - type: object - authorization: - additionalProperties: - properties: - cache: - description: |- - Caching options for the resolved object returned when applying this config. - Omit it to avoid caching objects for this config. - properties: - key: - description: |- - Key used to store the entry in the cache. - The resolved key must be unique within the scope of this particular config. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - ttl: - default: 60 - description: Duration (in seconds) of the external data - in the cache before pulled again from the source. - type: integer - required: - - key - type: object - kubernetesSubjectAccessReview: - description: Authorization by Kubernetes SubjectAccessReview - properties: - groups: - description: Groups the user must be a member of or, if - `user` is omitted, the groups to check for authorization - in the Kubernetes RBAC. - items: - type: string - type: array - resourceAttributes: - description: |- - Use resourceAttributes to check permissions on Kubernetes resources. - If omitted, it performs a non-resource SubjectAccessReview, with verb and path inferred from the request. - properties: - group: - description: |- - API group of the resource. - Use '*' for all API groups. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - name: - description: |- - Resource name - Omit it to check for authorization on all resources of the specified kind. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - namespace: - description: Namespace where the user must have permissions - on the resource. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - resource: - description: |- - Resource kind - Use '*' for all resource kinds. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - subresource: - description: Subresource kind - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - verb: - description: |- - Verb to check for authorization on the resource. - Use '*' for all verbs. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - user: - description: |- - User to check for authorization in the Kubernetes RBAC. - Omit it to check for group authorization only. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - metrics: - default: false - description: Whether this config should generate individual - observability metrics - type: boolean - opa: - description: Open Policy Agent (OPA) Rego policy. - properties: - allValues: - default: false - description: |- - Returns the value of all Rego rules in the virtual document. Values can be read in subsequent evaluators/phases of the Auth Pipeline. - Otherwise, only the default `allow` rule will be exposed. - Returning all Rego rules can affect performance of OPA policies during reconciliation (policy precompile) and at runtime. - type: boolean - externalPolicy: - description: |- - Settings for fetching the OPA policy from an external registry. - Use it alternatively to 'rego'. - For the configurations of the HTTP request, the following options are not implemented: 'method', 'body', 'bodyParameters', - 'contentType', 'headers', 'oauth2'. Use it only with: 'url', 'sharedSecret', 'credentials'. - properties: - body: - description: |- - Raw body of the HTTP request. - Supersedes 'bodyParameters'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - bodyParameters: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: |- - Custom parameters to encode in the body of the HTTP request. - Superseded by 'body'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - type: object - contentType: - default: application/x-www-form-urlencoded - description: |- - Content-Type of the request body. Shapes how 'bodyParameters' are encoded. - Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. - enum: - - application/x-www-form-urlencoded - - application/json - type: string - credentials: - description: |- - Defines where client credentials will be passed in the request to the service. - If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. - properties: - authorizationHeader: - properties: - prefix: - type: string - type: object - cookie: - properties: - name: - type: string - required: - - name - type: object - customHeader: - properties: - name: - type: string - required: - - name - type: object - queryString: - properties: - name: - type: string - required: - - name - type: object - type: object - headers: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: Custom headers in the HTTP request. - type: object - method: - default: GET - description: |- - HTTP verb used in the request to the service. Accepted values: GET (default), POST. - When the request method is POST, the authorization JSON is passed in the body of the request. - enum: - - GET - - POST - - PUT - - PATCH - - DELETE - - HEAD - - OPTIONS - - CONNECT - - TRACE - type: string - oauth2: - description: Authentication with the HTTP service by - OAuth2 Client Credentials grant. - properties: - cache: - default: true - description: |- - Caches and reuses the token until expired. - Set it to false to force fetch the token at every authorization request regardless of expiration. - type: boolean - clientId: - description: OAuth2 Client ID. - type: string - clientSecretRef: - description: Reference to a Kuberentes Secret key - that stores that OAuth2 Client Secret. - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - extraParams: - additionalProperties: - type: string - description: Optional extra parameters for the requests - to the token URL. - type: object - scopes: - description: Optional scopes for the client credentials - grant, if supported by he OAuth2 server. - items: - type: string - type: array - tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. - type: string - required: - - clientId - - clientSecretRef - - tokenUrl - type: object - sharedSecretRef: - description: |- - Reference to a Secret key whose value will be passed by Authorino in the request. - The HTTP service can use the shared secret to authenticate the origin of the request. - Ignored if used together with oauth2. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - ttl: - description: Duration (in seconds) of the external data - in the cache before pulled again from the source. - type: integer - url: - description: |- - Endpoint URL of the HTTP service. - The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported - by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. - E.g. https://ext-auth-server.io/metadata?p={request.path} - type: string - required: - - url - type: object - rego: - description: |- - Authorization policy as a Rego language document. - The Rego document must include the "allow" condition, set by Authorino to "false" by default (i.e. requests are unauthorized unless changed). - The Rego document must NOT include the "package" declaration in line 1. - type: string - type: object - patternMatching: - description: Pattern-matching authorization rules. - properties: - patterns: - items: - oneOf: - - properties: - patternRef: {} - required: - - patternRef - - properties: - operator: {} - selector: {} - value: {} - required: - - operator - - selector - - properties: - all: {} - required: - - all - - properties: - any: {} - required: - - any - properties: - all: - description: A list of pattern expressions to be evaluated - as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to be evaluated - as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - required: - - patterns - type: object - priority: - default: 0 - description: |- - Priority group of the config. - All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. - type: integer - spicedb: - description: Authorization decision delegated to external Authzed/SpiceDB - server. - properties: - endpoint: - description: Hostname and port number to the GRPC interface - of the SpiceDB server (e.g. spicedb:50051). - type: string - insecure: - description: Insecure HTTP connection (i.e. disables TLS - verification) - type: boolean - permission: - description: The name of the permission (or relation) on - which to execute the check. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - resource: - description: The resource on which to check the permission - or relation. - properties: - kind: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - name: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - sharedSecretRef: - description: Reference to a Secret key whose value will - be used by Authorino to authenticate with the Authzed - service. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - subject: - description: The subject that will be checked for the permission - or relation. - properties: - kind: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - name: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - required: - - endpoint - type: object - when: - description: |- - Conditions for Authorino to enforce this config. - If omitted, the config will be enforced for all requests. - If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. - items: - oneOf: - - properties: - patternRef: {} - required: - - patternRef - - properties: - operator: {} - selector: {} - value: {} - required: - - operator - - selector - - properties: - all: {} - required: - - all - - properties: - any: {} - required: - - any - properties: - all: - description: A list of pattern expressions to be evaluated - as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to be evaluated - as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - type: object - x-kubernetes-validations: - - message: 'Use exactly one of: patternMatching, opa, kubernetesSubjectAccessReview, - spicedb' - rule: 'has(self.patternMatching) ? !(has(self.opa) || has(self.kubernetesSubjectAccessReview) - || has(self.spicedb)) : has(self.opa) ? !(has(self.kubernetesSubjectAccessReview) - || has(self.spicedb)) : has(self.kubernetesSubjectAccessReview) - != has(self.spicedb)' - description: |- - Authorization policies. - All policies MUST evaluate to "allowed = true" for the auth request be successful. - type: object - callbacks: - additionalProperties: - properties: - cache: - description: |- - Caching options for the resolved object returned when applying this config. - Omit it to avoid caching objects for this config. - properties: - key: - description: |- - Key used to store the entry in the cache. - The resolved key must be unique within the scope of this particular config. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - ttl: - default: 60 - description: Duration (in seconds) of the external data - in the cache before pulled again from the source. - type: integer - required: - - key - type: object - http: - description: Settings of the external HTTP request - properties: - body: - description: |- - Raw body of the HTTP request. - Supersedes 'bodyParameters'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - bodyParameters: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: |- - Custom parameters to encode in the body of the HTTP request. - Superseded by 'body'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - type: object - contentType: - default: application/x-www-form-urlencoded - description: |- - Content-Type of the request body. Shapes how 'bodyParameters' are encoded. - Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. - enum: - - application/x-www-form-urlencoded - - application/json - type: string - credentials: - description: |- - Defines where client credentials will be passed in the request to the service. - If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. - properties: - authorizationHeader: - properties: - prefix: - type: string - type: object - cookie: - properties: - name: - type: string - required: - - name - type: object - customHeader: - properties: - name: - type: string - required: - - name - type: object - queryString: - properties: - name: - type: string - required: - - name - type: object - type: object - headers: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: Custom headers in the HTTP request. - type: object - method: - default: GET - description: |- - HTTP verb used in the request to the service. Accepted values: GET (default), POST. - When the request method is POST, the authorization JSON is passed in the body of the request. - enum: - - GET - - POST - - PUT - - PATCH - - DELETE - - HEAD - - OPTIONS - - CONNECT - - TRACE - type: string - oauth2: - description: Authentication with the HTTP service by OAuth2 - Client Credentials grant. - properties: - cache: - default: true - description: |- - Caches and reuses the token until expired. - Set it to false to force fetch the token at every authorization request regardless of expiration. - type: boolean - clientId: - description: OAuth2 Client ID. - type: string - clientSecretRef: - description: Reference to a Kuberentes Secret key that - stores that OAuth2 Client Secret. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - extraParams: - additionalProperties: - type: string - description: Optional extra parameters for the requests - to the token URL. - type: object - scopes: - description: Optional scopes for the client credentials - grant, if supported by he OAuth2 server. - items: - type: string - type: array - tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. - type: string - required: - - clientId - - clientSecretRef - - tokenUrl - type: object - sharedSecretRef: - description: |- - Reference to a Secret key whose value will be passed by Authorino in the request. - The HTTP service can use the shared secret to authenticate the origin of the request. - Ignored if used together with oauth2. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - url: - description: |- - Endpoint URL of the HTTP service. - The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported - by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. - E.g. https://ext-auth-server.io/metadata?p={request.path} - type: string - required: - - url - type: object - metrics: - default: false - description: Whether this config should generate individual - observability metrics - type: boolean - priority: - default: 0 - description: |- - Priority group of the config. - All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. - type: integer - when: - description: |- - Conditions for Authorino to enforce this config. - If omitted, the config will be enforced for all requests. - If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. - items: - properties: - all: - description: A list of pattern expressions to be evaluated - as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to be evaluated - as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - required: - - http - type: object - description: |- - Callback functions. - Authorino sends callbacks at the end of the auth pipeline to the endpoints specified in this config. - type: object - hosts: - description: |- - The list of public host names of the services protected by this authentication/authorization scheme. - Authorino uses the requested host to lookup for the corresponding authentication/authorization configs to enforce. - items: - type: string - type: array - metadata: - additionalProperties: - properties: - cache: - description: |- - Caching options for the resolved object returned when applying this config. - Omit it to avoid caching objects for this config. - properties: - key: - description: |- - Key used to store the entry in the cache. - The resolved key must be unique within the scope of this particular config. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - ttl: - default: 60 - description: Duration (in seconds) of the external data - in the cache before pulled again from the source. - type: integer - required: - - key - type: object - http: - description: External source of auth metadata via HTTP request - properties: - body: - description: |- - Raw body of the HTTP request. - Supersedes 'bodyParameters'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - bodyParameters: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: |- - Custom parameters to encode in the body of the HTTP request. - Superseded by 'body'; use either one or the other. - Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). - type: object - contentType: - default: application/x-www-form-urlencoded - description: |- - Content-Type of the request body. Shapes how 'bodyParameters' are encoded. - Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. - enum: - - application/x-www-form-urlencoded - - application/json - type: string - credentials: - description: |- - Defines where client credentials will be passed in the request to the service. - If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. - properties: - authorizationHeader: - properties: - prefix: - type: string - type: object - cookie: - properties: - name: - type: string - required: - - name - type: object - customHeader: - properties: - name: - type: string - required: - - name - type: object - queryString: - properties: - name: - type: string - required: - - name - type: object - type: object - headers: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: Custom headers in the HTTP request. - type: object - method: - default: GET - description: |- - HTTP verb used in the request to the service. Accepted values: GET (default), POST. - When the request method is POST, the authorization JSON is passed in the body of the request. - enum: - - GET - - POST - - PUT - - PATCH - - DELETE - - HEAD - - OPTIONS - - CONNECT - - TRACE - type: string - oauth2: - description: Authentication with the HTTP service by OAuth2 - Client Credentials grant. - properties: - cache: - default: true - description: |- - Caches and reuses the token until expired. - Set it to false to force fetch the token at every authorization request regardless of expiration. - type: boolean - clientId: - description: OAuth2 Client ID. - type: string - clientSecretRef: - description: Reference to a Kuberentes Secret key that - stores that OAuth2 Client Secret. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - extraParams: - additionalProperties: - type: string - description: Optional extra parameters for the requests - to the token URL. - type: object - scopes: - description: Optional scopes for the client credentials - grant, if supported by he OAuth2 server. - items: - type: string - type: array - tokenUrl: - description: Token endpoint URL of the OAuth2 resource - server. - type: string - required: - - clientId - - clientSecretRef - - tokenUrl - type: object - sharedSecretRef: - description: |- - Reference to a Secret key whose value will be passed by Authorino in the request. - The HTTP service can use the shared secret to authenticate the origin of the request. - Ignored if used together with oauth2. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: The name of the secret in the Authorino's - namespace to select from. - type: string - required: - - key - - name - type: object - url: - description: |- - Endpoint URL of the HTTP service. - The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported - by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. - E.g. https://ext-auth-server.io/metadata?p={request.path} - type: string - required: - - url - type: object - metrics: - default: false - description: Whether this config should generate individual - observability metrics - type: boolean - priority: - default: 0 - description: |- - Priority group of the config. - All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. - type: integer - uma: - description: User-Managed Access (UMA) source of resource data. - properties: - credentialsRef: - description: Reference to a Kubernetes secret in the same - namespace, that stores client credentials to the resource - registration API of the UMA server. - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - endpoint: - description: |- - The endpoint of the UMA server. - The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint. - type: string - required: - - credentialsRef - - endpoint - type: object - userInfo: - description: OpendID Connect UserInfo linked to an OIDC authentication - config specified in this same AuthConfig. - properties: - identitySource: - description: The name of an OIDC-enabled JWT authentication - config whose OpenID Connect configuration discovered includes - the OIDC "userinfo_endpoint" claim. - type: string - required: - - identitySource - type: object - when: - description: |- - Conditions for Authorino to enforce this config. - If omitted, the config will be enforced for all requests. - If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. - items: - oneOf: - - properties: - patternRef: {} - required: - - patternRef - - properties: - operator: {} - selector: {} - value: {} - required: - - operator - - selector - - properties: - all: {} - required: - - all - - properties: - any: {} - required: - - any - properties: - all: - description: A list of pattern expressions to be evaluated - as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to be evaluated - as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - type: object - x-kubernetes-validations: - - message: 'Use exactly one of: http, userInfo, uma' - rule: 'has(self.http) ? !(has(self.userInfo) || has(self.uma)) - : has(self.userInfo) != has(self.uma)' - description: |- - Metadata sources. - Authorino fetches auth metadata as JSON from sources specified in this config. - type: object - patterns: - additionalProperties: - items: - properties: - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - description: Named sets of patterns that can be referred in `when` - conditions and in pattern-matching authorization policy rules. - type: object - response: - description: |- - Response items. - Authorino builds custom responses to the client of the auth request. - properties: - success: - description: |- - Response items to be included in the auth response when the request is authenticated and authorized. - For integration of Authorino via proxy, the proxy must use these settings to propagate dynamic metadata and/or inject data in the request. - properties: - dynamicMetadata: - additionalProperties: - description: Settings of the success custom response item. - oneOf: - - properties: - wristband: {} - required: - - wristband - - properties: - json: {} - required: - - json - - properties: - plain: {} - required: - - plain - properties: - cache: - description: |- - Caching options for the resolved object returned when applying this config. - Omit it to avoid caching objects for this config. - properties: - key: - description: |- - Key used to store the entry in the cache. - The resolved key must be unique within the scope of this particular config. - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - ttl: - default: 60 - description: Duration (in seconds) of the external - data in the cache before pulled again from the - source. - type: integer - required: - - key - type: object - json: - description: |- - JSON object - Specify it as the list of properties of the object, whose values can combine static values and values selected from the authorization JSON. - properties: - properties: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - required: - - properties - type: object - key: - description: |- - The key used to add the custom response item (name of the HTTP header or root property of the Dynamic Metadata object). - If omitted, it will be set to the name of the response config. - type: string - metrics: - default: false - description: Whether this config should generate individual - observability metrics - type: boolean - plain: - description: Plain text content - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - priority: - default: 0 - description: |- - Priority group of the config. - All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. - type: integer - when: - description: |- - Conditions for Authorino to enforce this config. - If omitted, the config will be enforced for all requests. - If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. - items: - oneOf: - - properties: - patternRef: {} - required: - - patternRef - - properties: - operator: {} - selector: {} - value: {} - required: - - operator - - selector - - properties: - all: {} - required: - - all - - properties: - any: {} - required: - - any - properties: - all: - description: A list of pattern expressions to - be evaluated as a logical AND. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - any: - description: A list of pattern expressions to - be evaluated as a logical OR. - items: - type: object - x-kubernetes-preserve-unknown-fields: true - type: array - operator: - description: |- - The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". - Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) - enum: - - eq - - neq - - incl - - excl - - matches - type: string - patternRef: - description: Reference to a named set of pattern - expressions - type: string - selector: - description: |- - Path selector to fetch content from the authorization JSON (e.g. 'request.method'). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - Authorino custom JSON path modifiers are also supported. - type: string - value: - description: |- - The value of reference for the comparison with the content fetched from the authorization JSON. - If used with the "matches" operator, the value must compile to a valid Golang regex. - type: string - type: object - type: array - wristband: - description: Authorino Festival Wristband token - properties: - customClaims: - additionalProperties: - properties: - selector: - description: |- - Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). - Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. - The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. - type: string - value: - description: Static value - x-kubernetes-preserve-unknown-fields: true - type: object - description: Any claims to be added to the wristband - token apart from the standard JWT claims (iss, - iat, exp) added by default. - type: object - issuer: - description: 'The endpoint to the Authorino service - that issues the wristband (format: ://:/, - where = /://:/, - where = /://:/, - where = /://:/, - where = /://:/, - where = /://:/, - where = / Date: Mon, 6 Jul 2026 18:04:18 +0200 Subject: [PATCH 09/14] Upgrade Go to 1.26.4 Signed-off-by: Thomas Maas --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index a597db95..26bb44b2 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/kuadrant/authorino-operator -go 1.26.3 +go 1.26.4 require ( github.com/go-logr/logr v1.4.3 From a418ca02997fd9e6dbbbadf24cdb89f15a611233 Mon Sep 17 00:00:00 2001 From: Thomas Maas Date: Thu, 28 May 2026 16:39:31 +0200 Subject: [PATCH 10/14] fix: fall back to tag_name when release name is empty in set-replaces-directive The set-replaces-directive target fetches the latest release name to build the OLM replaces directive. When a release has an empty name field (e.g. created without --title), jq returns an empty string, producing an invalid replaces value "authorino-operator." that fails bundle validation. Use jq's alternative operator (//) to fall back to tag_name when name is empty or null. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Thomas Maas --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 4bef9bc8..d2e9ab15 100644 --- a/Makefile +++ b/Makefile @@ -391,7 +391,7 @@ set-authorino-default-image: yq ## Sets the default Authorino image in the build set-replaces-directive: yq ## Sets the value for the OLM replaces directive in the build file. $(eval REPLACES_VERSION=$(shell curl -sSL -H "Accept: application/vnd.github+json" \ https://api.github.com/repos/Kuadrant/authorino-operator/releases/latest | \ - jq -r '.name')) + jq -r '.name // .tag_name')) V="authorino-operator.$(REPLACES_VERSION)" $(YQ) e -i '.config.replaces = strenv(V)' $(BUILD_CONFIG_FILE) .PHONY: prepare-release From 92f86677da322fd7bff6a35502b131bdb4d3bda1 Mon Sep 17 00:00:00 2001 From: Thomas Maas Date: Thu, 28 May 2026 18:18:54 +0200 Subject: [PATCH 11/14] fix: handle empty string name, not just null jq's // operator only catches null/false, not empty string "". The original bug was an empty name (""), so the previous fix didn't actually cover the failing case. Use an explicit length check instead. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Thomas Maas --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index d2e9ab15..b3f4663e 100644 --- a/Makefile +++ b/Makefile @@ -391,7 +391,7 @@ set-authorino-default-image: yq ## Sets the default Authorino image in the build set-replaces-directive: yq ## Sets the value for the OLM replaces directive in the build file. $(eval REPLACES_VERSION=$(shell curl -sSL -H "Accept: application/vnd.github+json" \ https://api.github.com/repos/Kuadrant/authorino-operator/releases/latest | \ - jq -r '.name // .tag_name')) + jq -r 'if (.name // "" | length) > 0 then .name else .tag_name end')) V="authorino-operator.$(REPLACES_VERSION)" $(YQ) e -i '.config.replaces = strenv(V)' $(BUILD_CONFIG_FILE) .PHONY: prepare-release From e0ddc7ad4d0e46ac8acee9b68ca7c078ef9abd93 Mon Sep 17 00:00:00 2001 From: Phil Brookes Date: Mon, 13 Jul 2026 10:22:20 +0200 Subject: [PATCH 12/14] fix: checkout existing release branch instead of creating new one The release workflow always created a new local branch, which failed when the release branch already existed on origin (e.g. patch releases). Check for the remote branch first and fetch/checkout it if present. Signed-off-by: Phil Brookes rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED Signed-off-by: Thomas Maas --- .github/workflows/release.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 564b5c14..a0e32f14 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -54,10 +54,16 @@ jobs: # Removes: pre-release suffix ([+-].*) and patch version (\.[0-9]*$) release_branch=release-$(echo "${{ github.event.inputs.operatorVersion }}" | sed 's/[+-].*//; s/\.[0-9]*$//') echo "name=$release_branch" >> $GITHUB_OUTPUT - - name: Create release branch + - name: Create or checkout release branch if: ${{ !startsWith(github.event.inputs.gitRef, 'release-') }} run: | - git checkout -b ${{ steps.release-branch.outputs.name }} + branch=${{ steps.release-branch.outputs.name }} + if git ls-remote --exit-code --heads origin "$branch" > /dev/null 2>&1; then + git fetch origin "$branch" + git checkout "$branch" + else + git checkout -b "$branch" + fi - name: Prepare release run: | VERSION=${{ github.event.inputs.operatorVersion }} \ From 2a6ce433dce62c3ccd071d38977c296ece70345c Mon Sep 17 00:00:00 2001 From: Thomas Maas Date: Wed, 15 Jul 2026 09:04:34 +0200 Subject: [PATCH 13/14] Bump authorino operand to v0.26.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update RELATED_IMAGE_AUTHORINO from v0.26.1 to v0.26.2 across build config, manager, deploy manifests, Helm chart, and OLM bundle. Authorino v0.26.2 includes: - Fix OAuth2 introspection panic on non-200 responses - Fix authorization failing open on context timeout - Fix pprof port clash on status update manager - Fix UMA PAT response body resource leak - Go 1.26.3 → 1.26.4 - CI hardening (StepSecurity, CodeQL, cosigning) Signed-off-by: Thomas Maas --- build.yaml | 4 ++-- .../manifests/authorino-operator.clusterserviceversion.yaml | 4 ++-- charts/authorino-operator/templates/manifests.yaml | 2 +- config/deploy/manifests.yaml | 2 +- config/manager/manager.yaml | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/build.yaml b/build.yaml index 860ec252..e30f7e8f 100644 --- a/build.yaml +++ b/build.yaml @@ -1,5 +1,5 @@ config: version: 0.25.1 replaces: authorino-operator.v0.25.0 - authorinoVersion: 0.26.1 - authorinoImage: quay.io/kuadrant/authorino:v0.26.1 + authorinoVersion: 0.26.2 + authorinoImage: quay.io/kuadrant/authorino:v0.26.2 diff --git a/bundle/manifests/authorino-operator.clusterserviceversion.yaml b/bundle/manifests/authorino-operator.clusterserviceversion.yaml index 1da58c7c..2aaf2089 100644 --- a/bundle/manifests/authorino-operator.clusterserviceversion.yaml +++ b/bundle/manifests/authorino-operator.clusterserviceversion.yaml @@ -255,7 +255,7 @@ spec: - /manager env: - name: RELATED_IMAGE_AUTHORINO - value: quay.io/kuadrant/authorino:v0.26.1 + value: quay.io/kuadrant/authorino:v0.26.2 image: quay.io/kuadrant/authorino-operator:v0.25.1 livenessProbe: httpGet: @@ -359,7 +359,7 @@ spec: provider: name: Red Hat relatedImages: - - image: quay.io/kuadrant/authorino:v0.26.1 + - image: quay.io/kuadrant/authorino:v0.26.2 name: authorino version: 0.25.1 replaces: authorino-operator.v0.25.0 diff --git a/charts/authorino-operator/templates/manifests.yaml b/charts/authorino-operator/templates/manifests.yaml index 469a68de..7fcc9f22 100644 --- a/charts/authorino-operator/templates/manifests.yaml +++ b/charts/authorino-operator/templates/manifests.yaml @@ -3775,7 +3775,7 @@ spec: - /manager env: - name: RELATED_IMAGE_AUTHORINO - value: quay.io/kuadrant/authorino:v0.26.1 + value: quay.io/kuadrant/authorino:v0.26.2 image: quay.io/kuadrant/authorino-operator:v0.25.1 livenessProbe: httpGet: diff --git a/config/deploy/manifests.yaml b/config/deploy/manifests.yaml index 2921cd66..e763bc26 100644 --- a/config/deploy/manifests.yaml +++ b/config/deploy/manifests.yaml @@ -3782,7 +3782,7 @@ spec: - /manager env: - name: RELATED_IMAGE_AUTHORINO - value: quay.io/kuadrant/authorino:v0.26.1 + value: quay.io/kuadrant/authorino:v0.26.2 image: quay.io/kuadrant/authorino-operator:v0.25.1 livenessProbe: httpGet: diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 68c17522..e236c89f 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -22,7 +22,7 @@ spec: - /manager env: - name: RELATED_IMAGE_AUTHORINO - value: quay.io/kuadrant/authorino:v0.26.1 + value: quay.io/kuadrant/authorino:v0.26.2 args: - --leader-elect image: controller:latest From 821fcff7999873ede6e18bfd851514f2be515c45 Mon Sep 17 00:00:00 2001 From: Thomas Maas Date: Wed, 15 Jul 2026 09:14:29 +0200 Subject: [PATCH 14/14] Regenerate manifests, bundle, and helm charts for v0.26.2 Run make manifests, make bundle, and make helm-build to regenerate all derived files with the correct authorino v0.26.2 image reference and updated AuthConfig CRD from synced authorino manifests. Signed-off-by: Thomas Maas --- ...horino-operator.clusterserviceversion.yaml | 2 +- .../authorino.kuadrant.io_authconfigs.yaml | 2742 ++++++++++++++++- .../templates/manifests.yaml | 2742 ++++++++++++++++- config/authorino/kustomization.yaml | 4 +- config/deploy/manifests.yaml | 2742 ++++++++++++++++- 5 files changed, 7722 insertions(+), 510 deletions(-) diff --git a/bundle/manifests/authorino-operator.clusterserviceversion.yaml b/bundle/manifests/authorino-operator.clusterserviceversion.yaml index 2aaf2089..fe68d505 100644 --- a/bundle/manifests/authorino-operator.clusterserviceversion.yaml +++ b/bundle/manifests/authorino-operator.clusterserviceversion.yaml @@ -55,7 +55,7 @@ metadata: capabilities: Basic Install categories: Integration & Delivery containerImage: quay.io/kuadrant/authorino-operator:v0.25.1 - createdAt: "2026-06-19T14:15:09Z" + createdAt: "2026-07-15T07:14:06Z" operators.operatorframework.io/builder: operator-sdk-v1.32.0 operators.operatorframework.io/project_layout: go.kubebuilder.io/v3 repository: https://github.com/Kuadrant/authorino-operator diff --git a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml index 7ac659ca..a340c549 100644 --- a/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml +++ b/bundle/manifests/authorino.kuadrant.io_authconfigs.yaml @@ -14,6 +14,2538 @@ spec: singular: authconfig scope: Namespaced versions: + - additionalPrinterColumns: + - description: Ready for all hosts + jsonPath: .status.summary.ready + name: Ready + type: string + - description: Number of hosts ready + jsonPath: .status.summary.numHostsReady + name: Hosts + type: string + - description: Number of trusted identity sources + jsonPath: .status.summary.numIdentitySources + name: Authentication + priority: 2 + type: integer + - description: Number of external metadata sources + jsonPath: .status.summary.numMetadataSources + name: Metadata + priority: 2 + type: integer + - description: Number of authorization policies + jsonPath: .status.summary.numAuthorizationPolicies + name: Authorization + priority: 2 + type: integer + - description: Number of items added to the authorization response + jsonPath: .status.summary.numResponseItems + name: Response + priority: 2 + type: integer + - description: Whether issuing Festival Wristbands + jsonPath: .status.summary.festivalWristbandEnabled + name: Wristband + priority: 2 + type: boolean + name: v1beta2 + schema: + openAPIV3Schema: + description: AuthConfig is the schema for Authorino's AuthConfig API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Specifies the desired state of the AuthConfig resource, i.e. + the authentication/authorization scheme to be applied to protect the + matching service hosts. + properties: + authentication: + additionalProperties: + oneOf: + - properties: + credentials: {} + oauth2Introspection: {} + required: + - oauth2Introspection + - properties: + credentials: {} + jwt: {} + required: + - jwt + - properties: + apiKey: {} + credentials: {} + required: + - apiKey + - properties: + credentials: {} + x509: {} + required: + - x509 + - properties: + credentials: {} + kubernetesTokenReview: {} + required: + - kubernetesTokenReview + - properties: + anonymous: {} + credentials: {} + required: + - anonymous + - properties: + credentials: {} + plain: {} + required: + - plain + properties: + anonymous: + description: Anonymous access. + type: object + apiKey: + description: Authentication based on API keys stored in Kubernetes + secrets. + properties: + allNamespaces: + default: false + description: |- + Whether Authorino should look for API key secrets in all namespaces or only in the same namespace as the AuthConfig. + Enabling this option in namespaced Authorino instances has no effect. + type: boolean + selector: + description: Label selector used by Authorino to match secrets + from the cluster storing valid credentials to authenticate + to this service + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + required: + - selector + type: object + cache: + description: |- + Caching options for the resolved object returned when applying this config. + Omit it to avoid caching objects for this config. + properties: + key: + description: |- + Key used to store the entry in the cache. + The resolved key must be unique within the scope of this particular config. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + ttl: + default: 60 + description: Duration (in seconds) of the external data + in the cache before pulled again from the source. + type: integer + required: + - key + type: object + credentials: + description: |- + Defines where credentials are required to be passed in the request for authentication based on this config. + If omitted, it defaults to credentials passed in the HTTP Authorization header and the "Bearer" prefix prepended to the secret credential value. + properties: + authorizationHeader: + properties: + prefix: + type: string + type: object + cookie: + properties: + name: + type: string + required: + - name + type: object + customHeader: + properties: + name: + type: string + required: + - name + type: object + queryString: + properties: + name: + type: string + required: + - name + type: object + type: object + defaults: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: |- + Set default property values (claims) for the resolved identity object, that are set before appending the object to + the authorization JSON. If the property is already present in the resolved identity object, the default value is ignored. + It requires the resolved identity object to always be a JSON object. + Do not use this option with identity objects of other JSON types (array, string, etc). + type: object + jwt: + description: Authentication based on JWT tokens. + properties: + issuerUrl: + description: |- + URL of the issuer of the JWT. + If `jwksUrl` is omitted, Authorino will append the path to the OpenID Connect Well-Known Discovery endpoint + (i.e. "/.well-known/openid-configuration") to this URL, to discover the OIDC configuration where to obtain + the "jkws_uri" claim from. + The value must coincide with the value of the "iss" (issuer) claim of the discovered OpenID Connect configuration. + type: string + ttl: + description: |- + Decides how long to wait before refreshing the JWKS (in seconds). + If omitted, Authorino will never refresh the JWKS. + type: integer + type: object + kubernetesTokenReview: + description: Authentication by Kubernetes token review. + properties: + audiences: + description: |- + The list of audiences (scopes) that must be claimed in a Kubernetes authentication token supplied in the request, and reviewed by Authorino. + If omitted, Authorino will review tokens expecting the host name of the requested protected service amongst the audiences. + items: + type: string + type: array + type: object + metrics: + default: false + description: Whether this config should generate individual + observability metrics + type: boolean + oauth2Introspection: + description: Authentication by OAuth2 token introspection. + properties: + credentialsRef: + description: Reference to a Kubernetes secret in the same + namespace, that stores client credentials to the OAuth2 + server. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + endpoint: + description: The full URL of the token introspection endpoint. + type: string + tokenTypeHint: + description: |- + The token type hint for the token introspection. + If omitted, it defaults to "access_token". + type: string + required: + - credentialsRef + - endpoint + type: object + overrides: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: |- + Overrides the resolved identity object by setting the additional properties (claims) specified in this config, + before appending the object to the authorization JSON. + It requires the resolved identity object to always be a JSON object. + Do not use this option with identity objects of other JSON types (array, string, etc). + type: object + plain: + description: |- + Identity object extracted from the context. + Use this method when authentication is performed beforehand by a proxy and the resulting object passed to Authorino as JSON in the auth request. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + required: + - selector + type: object + priority: + default: 0 + description: |- + Priority group of the config. + All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. + type: integer + when: + description: |- + Conditions for Authorino to enforce this config. + If omitted, the config will be enforced for all requests. + If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. + items: + oneOf: + - properties: + patternRef: {} + required: + - patternRef + - properties: + operator: {} + selector: {} + value: {} + required: + - operator + - selector + - properties: + all: {} + required: + - all + - properties: + any: {} + required: + - any + properties: + all: + description: A list of pattern expressions to be evaluated + as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to be evaluated + as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + x509: + description: |- + Authentication based on client X.509 certificates. + The certificates presented by the clients must be signed by a trusted CA whose certificates are stored in Kubernetes secrets. + properties: + allNamespaces: + default: false + description: |- + Whether Authorino should look for TLS secrets in all namespaces or only in the same namespace as the AuthConfig. + Enabling this option in namespaced Authorino instances has no effect. + type: boolean + selector: + description: |- + Label selector used by Authorino to match secrets from the cluster storing trusted CA certificates to validate + clients trying to authenticate to this service + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + required: + - selector + type: object + type: object + description: |- + Authentication configs. + At least one config MUST evaluate to a valid identity object for the auth request to be successful. + type: object + authorization: + additionalProperties: + oneOf: + - properties: + opa: {} + required: + - opa + - properties: + patternMatching: {} + required: + - patternMatching + - properties: + kubernetesSubjectAccessReview: {} + required: + - kubernetesSubjectAccessReview + - properties: + spicedb: {} + required: + - spicedb + properties: + cache: + description: |- + Caching options for the resolved object returned when applying this config. + Omit it to avoid caching objects for this config. + properties: + key: + description: |- + Key used to store the entry in the cache. + The resolved key must be unique within the scope of this particular config. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + ttl: + default: 60 + description: Duration (in seconds) of the external data + in the cache before pulled again from the source. + type: integer + required: + - key + type: object + kubernetesSubjectAccessReview: + description: Authorization by Kubernetes SubjectAccessReview + properties: + groups: + description: Groups the user must be a member of or, if + `user` is omitted, the groups to check for authorization + in the Kubernetes RBAC. + items: + type: string + type: array + resourceAttributes: + description: |- + Use resourceAttributes to check permissions on Kubernetes resources. + If omitted, it performs a non-resource SubjectAccessReview, with verb and path inferred from the request. + properties: + group: + description: |- + API group of the resource. + Use '*' for all API groups. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + name: + description: |- + Resource name + Omit it to check for authorization on all resources of the specified kind. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + namespace: + description: Namespace where the user must have permissions + on the resource. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + resource: + description: |- + Resource kind + Use '*' for all resource kinds. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + subresource: + description: Subresource kind + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + verb: + description: |- + Verb to check for authorization on the resource. + Use '*' for all verbs. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + user: + description: |- + User to check for authorization in the Kubernetes RBAC. + Omit it to check for group authorization only. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + metrics: + default: false + description: Whether this config should generate individual + observability metrics + type: boolean + opa: + description: Open Policy Agent (OPA) Rego policy. + properties: + allValues: + default: false + description: |- + Returns the value of all Rego rules in the virtual document. Values can be read in subsequent evaluators/phases of the Auth Pipeline. + Otherwise, only the default `allow` rule will be exposed. + Returning all Rego rules can affect performance of OPA policies during reconciliation (policy precompile) and at runtime. + type: boolean + externalPolicy: + description: |- + Settings for fetching the OPA policy from an external registry. + Use it alternatively to 'rego'. + For the configurations of the HTTP request, the following options are not implemented: 'method', 'body', 'bodyParameters', + 'contentType', 'headers', 'oauth2'. Use it only with: 'url', 'sharedSecret', 'credentials'. + properties: + body: + description: |- + Raw body of the HTTP request. + Supersedes 'bodyParameters'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + bodyParameters: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: |- + Custom parameters to encode in the body of the HTTP request. + Superseded by 'body'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + type: object + contentType: + default: application/x-www-form-urlencoded + description: |- + Content-Type of the request body. Shapes how 'bodyParameters' are encoded. + Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. + enum: + - application/x-www-form-urlencoded + - application/json + type: string + credentials: + description: |- + Defines where client credentials will be passed in the request to the service. + If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. + properties: + authorizationHeader: + properties: + prefix: + type: string + type: object + cookie: + properties: + name: + type: string + required: + - name + type: object + customHeader: + properties: + name: + type: string + required: + - name + type: object + queryString: + properties: + name: + type: string + required: + - name + type: object + type: object + headers: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: Custom headers in the HTTP request. + type: object + method: + default: GET + description: |- + HTTP verb used in the request to the service. Accepted values: GET (default), POST. + When the request method is POST, the authorization JSON is passed in the body of the request. + enum: + - GET + - POST + - PUT + - PATCH + - DELETE + - HEAD + - OPTIONS + - CONNECT + - TRACE + type: string + oauth2: + description: Authentication with the HTTP service by + OAuth2 Client Credentials grant. + properties: + cache: + default: true + description: |- + Caches and reuses the token until expired. + Set it to false to force fetch the token at every authorization request regardless of expiration. + type: boolean + clientId: + description: OAuth2 Client ID. + type: string + clientSecretRef: + description: Reference to a Kuberentes Secret key + that stores that OAuth2 Client Secret. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + extraParams: + additionalProperties: + type: string + description: Optional extra parameters for the requests + to the token URL. + type: object + scopes: + description: Optional scopes for the client credentials + grant, if supported by he OAuth2 server. + items: + type: string + type: array + tokenUrl: + description: Token endpoint URL of the OAuth2 resource + server. + type: string + required: + - clientId + - clientSecretRef + - tokenUrl + type: object + sharedSecretRef: + description: |- + Reference to a Secret key whose value will be passed by Authorino in the request. + The HTTP service can use the shared secret to authenticate the origin of the request. + Ignored if used together with oauth2. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + ttl: + description: Duration (in seconds) of the external data + in the cache before pulled again from the source. + type: integer + url: + description: |- + Endpoint URL of the HTTP service. + The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported + by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. + E.g. https://ext-auth-server.io/metadata?p={request.path} + type: string + required: + - url + type: object + rego: + description: |- + Authorization policy as a Rego language document. + The Rego document must include the "allow" condition, set by Authorino to "false" by default (i.e. requests are unauthorized unless changed). + The Rego document must NOT include the "package" declaration in line 1. + type: string + type: object + patternMatching: + description: Pattern-matching authorization rules. + properties: + patterns: + items: + oneOf: + - properties: + patternRef: {} + required: + - patternRef + - properties: + operator: {} + selector: {} + value: {} + required: + - operator + - selector + - properties: + all: {} + required: + - all + - properties: + any: {} + required: + - any + properties: + all: + description: A list of pattern expressions to be evaluated + as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to be evaluated + as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + required: + - patterns + type: object + priority: + default: 0 + description: |- + Priority group of the config. + All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. + type: integer + spicedb: + description: Authorization decision delegated to external Authzed/SpiceDB + server. + properties: + endpoint: + description: Hostname and port number to the GRPC interface + of the SpiceDB server (e.g. spicedb:50051). + type: string + insecure: + description: Insecure HTTP connection (i.e. disables TLS + verification) + type: boolean + permission: + description: The name of the permission (or relation) on + which to execute the check. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + resource: + description: The resource on which to check the permission + or relation. + properties: + kind: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + name: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + sharedSecretRef: + description: Reference to a Secret key whose value will + be used by Authorino to authenticate with the Authzed + service. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + subject: + description: The subject that will be checked for the permission + or relation. + properties: + kind: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + name: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + required: + - endpoint + type: object + when: + description: |- + Conditions for Authorino to enforce this config. + If omitted, the config will be enforced for all requests. + If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. + items: + oneOf: + - properties: + patternRef: {} + required: + - patternRef + - properties: + operator: {} + selector: {} + value: {} + required: + - operator + - selector + - properties: + all: {} + required: + - all + - properties: + any: {} + required: + - any + properties: + all: + description: A list of pattern expressions to be evaluated + as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to be evaluated + as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + type: object + description: |- + Authorization policies. + All policies MUST evaluate to "allowed = true" for the auth request be successful. + type: object + callbacks: + additionalProperties: + properties: + cache: + description: |- + Caching options for the resolved object returned when applying this config. + Omit it to avoid caching objects for this config. + properties: + key: + description: |- + Key used to store the entry in the cache. + The resolved key must be unique within the scope of this particular config. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + ttl: + default: 60 + description: Duration (in seconds) of the external data + in the cache before pulled again from the source. + type: integer + required: + - key + type: object + http: + description: Settings of the external HTTP request + properties: + body: + description: |- + Raw body of the HTTP request. + Supersedes 'bodyParameters'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + bodyParameters: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: |- + Custom parameters to encode in the body of the HTTP request. + Superseded by 'body'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + type: object + contentType: + default: application/x-www-form-urlencoded + description: |- + Content-Type of the request body. Shapes how 'bodyParameters' are encoded. + Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. + enum: + - application/x-www-form-urlencoded + - application/json + type: string + credentials: + description: |- + Defines where client credentials will be passed in the request to the service. + If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. + properties: + authorizationHeader: + properties: + prefix: + type: string + type: object + cookie: + properties: + name: + type: string + required: + - name + type: object + customHeader: + properties: + name: + type: string + required: + - name + type: object + queryString: + properties: + name: + type: string + required: + - name + type: object + type: object + headers: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: Custom headers in the HTTP request. + type: object + method: + default: GET + description: |- + HTTP verb used in the request to the service. Accepted values: GET (default), POST. + When the request method is POST, the authorization JSON is passed in the body of the request. + enum: + - GET + - POST + - PUT + - PATCH + - DELETE + - HEAD + - OPTIONS + - CONNECT + - TRACE + type: string + oauth2: + description: Authentication with the HTTP service by OAuth2 + Client Credentials grant. + properties: + cache: + default: true + description: |- + Caches and reuses the token until expired. + Set it to false to force fetch the token at every authorization request regardless of expiration. + type: boolean + clientId: + description: OAuth2 Client ID. + type: string + clientSecretRef: + description: Reference to a Kuberentes Secret key that + stores that OAuth2 Client Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + extraParams: + additionalProperties: + type: string + description: Optional extra parameters for the requests + to the token URL. + type: object + scopes: + description: Optional scopes for the client credentials + grant, if supported by he OAuth2 server. + items: + type: string + type: array + tokenUrl: + description: Token endpoint URL of the OAuth2 resource + server. + type: string + required: + - clientId + - clientSecretRef + - tokenUrl + type: object + sharedSecretRef: + description: |- + Reference to a Secret key whose value will be passed by Authorino in the request. + The HTTP service can use the shared secret to authenticate the origin of the request. + Ignored if used together with oauth2. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + url: + description: |- + Endpoint URL of the HTTP service. + The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported + by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. + E.g. https://ext-auth-server.io/metadata?p={request.path} + type: string + required: + - url + type: object + metrics: + default: false + description: Whether this config should generate individual + observability metrics + type: boolean + priority: + default: 0 + description: |- + Priority group of the config. + All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. + type: integer + when: + description: |- + Conditions for Authorino to enforce this config. + If omitted, the config will be enforced for all requests. + If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. + items: + properties: + all: + description: A list of pattern expressions to be evaluated + as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to be evaluated + as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + required: + - http + type: object + description: |- + Callback functions. + Authorino sends callbacks at the end of the auth pipeline to the endpoints specified in this config. + type: object + hosts: + description: |- + The list of public host names of the services protected by this authentication/authorization scheme. + Authorino uses the requested host to lookup for the corresponding authentication/authorization configs to enforce. + items: + type: string + type: array + metadata: + additionalProperties: + oneOf: + - properties: + userInfo: {} + required: + - userInfo + - properties: + uma: {} + required: + - uma + - properties: + http: {} + required: + - http + properties: + cache: + description: |- + Caching options for the resolved object returned when applying this config. + Omit it to avoid caching objects for this config. + properties: + key: + description: |- + Key used to store the entry in the cache. + The resolved key must be unique within the scope of this particular config. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + ttl: + default: 60 + description: Duration (in seconds) of the external data + in the cache before pulled again from the source. + type: integer + required: + - key + type: object + http: + description: External source of auth metadata via HTTP request + properties: + body: + description: |- + Raw body of the HTTP request. + Supersedes 'bodyParameters'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + bodyParameters: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: |- + Custom parameters to encode in the body of the HTTP request. + Superseded by 'body'; use either one or the other. + Use it with method=POST; for GET requests, set parameters as query string in the 'endpoint' (placeholders can be used). + type: object + contentType: + default: application/x-www-form-urlencoded + description: |- + Content-Type of the request body. Shapes how 'bodyParameters' are encoded. + Use it with method=POST; for GET requests, Content-Type is automatically set to 'text/plain'. + enum: + - application/x-www-form-urlencoded + - application/json + type: string + credentials: + description: |- + Defines where client credentials will be passed in the request to the service. + If omitted, it defaults to client credentials passed in the HTTP Authorization header and the "Bearer" prefix expected prepended to the secret value. + properties: + authorizationHeader: + properties: + prefix: + type: string + type: object + cookie: + properties: + name: + type: string + required: + - name + type: object + customHeader: + properties: + name: + type: string + required: + - name + type: object + queryString: + properties: + name: + type: string + required: + - name + type: object + type: object + headers: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: Custom headers in the HTTP request. + type: object + method: + default: GET + description: |- + HTTP verb used in the request to the service. Accepted values: GET (default), POST. + When the request method is POST, the authorization JSON is passed in the body of the request. + enum: + - GET + - POST + - PUT + - PATCH + - DELETE + - HEAD + - OPTIONS + - CONNECT + - TRACE + type: string + oauth2: + description: Authentication with the HTTP service by OAuth2 + Client Credentials grant. + properties: + cache: + default: true + description: |- + Caches and reuses the token until expired. + Set it to false to force fetch the token at every authorization request regardless of expiration. + type: boolean + clientId: + description: OAuth2 Client ID. + type: string + clientSecretRef: + description: Reference to a Kuberentes Secret key that + stores that OAuth2 Client Secret. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + extraParams: + additionalProperties: + type: string + description: Optional extra parameters for the requests + to the token URL. + type: object + scopes: + description: Optional scopes for the client credentials + grant, if supported by he OAuth2 server. + items: + type: string + type: array + tokenUrl: + description: Token endpoint URL of the OAuth2 resource + server. + type: string + required: + - clientId + - clientSecretRef + - tokenUrl + type: object + sharedSecretRef: + description: |- + Reference to a Secret key whose value will be passed by Authorino in the request. + The HTTP service can use the shared secret to authenticate the origin of the request. + Ignored if used together with oauth2. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: The name of the secret in the Authorino's + namespace to select from. + type: string + required: + - key + - name + type: object + url: + description: |- + Endpoint URL of the HTTP service. + The value can include variable placeholders in the format "{selector}", where "selector" is any pattern supported + by https://pkg.go.dev/github.com/tidwall/gjson and selects value from the authorization JSON. + E.g. https://ext-auth-server.io/metadata?p={request.path} + type: string + required: + - url + type: object + metrics: + default: false + description: Whether this config should generate individual + observability metrics + type: boolean + priority: + default: 0 + description: |- + Priority group of the config. + All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. + type: integer + uma: + description: User-Managed Access (UMA) source of resource data. + properties: + credentialsRef: + description: Reference to a Kubernetes secret in the same + namespace, that stores client credentials to the resource + registration API of the UMA server. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + endpoint: + description: |- + The endpoint of the UMA server. + The value must coincide with the "issuer" claim of the UMA config discovered from the well-known uma configuration endpoint. + type: string + required: + - credentialsRef + - endpoint + type: object + userInfo: + description: OpendID Connect UserInfo linked to an OIDC authentication + config specified in this same AuthConfig. + properties: + identitySource: + description: The name of an OIDC-enabled JWT authentication + config whose OpenID Connect configuration discovered includes + the OIDC "userinfo_endpoint" claim. + type: string + required: + - identitySource + type: object + when: + description: |- + Conditions for Authorino to enforce this config. + If omitted, the config will be enforced for all requests. + If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. + items: + oneOf: + - properties: + patternRef: {} + required: + - patternRef + - properties: + operator: {} + selector: {} + value: {} + required: + - operator + - selector + - properties: + all: {} + required: + - all + - properties: + any: {} + required: + - any + properties: + all: + description: A list of pattern expressions to be evaluated + as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to be evaluated + as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + type: object + description: |- + Metadata sources. + Authorino fetches auth metadata as JSON from sources specified in this config. + type: object + patterns: + additionalProperties: + items: + properties: + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + description: Named sets of patterns that can be referred in `when` + conditions and in pattern-matching authorization policy rules. + type: object + response: + description: |- + Response items. + Authorino builds custom responses to the client of the auth request. + properties: + success: + description: |- + Response items to be included in the auth response when the request is authenticated and authorized. + For integration of Authorino via proxy, the proxy must use these settings to propagate dynamic metadata and/or inject data in the request. + properties: + dynamicMetadata: + additionalProperties: + description: Settings of the success custom response item. + oneOf: + - properties: + wristband: {} + required: + - wristband + - properties: + json: {} + required: + - json + - properties: + plain: {} + required: + - plain + properties: + cache: + description: |- + Caching options for the resolved object returned when applying this config. + Omit it to avoid caching objects for this config. + properties: + key: + description: |- + Key used to store the entry in the cache. + The resolved key must be unique within the scope of this particular config. + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + ttl: + default: 60 + description: Duration (in seconds) of the external + data in the cache before pulled again from the + source. + type: integer + required: + - key + type: object + json: + description: |- + JSON object + Specify it as the list of properties of the object, whose values can combine static values and values selected from the authorization JSON. + properties: + properties: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + required: + - properties + type: object + key: + description: |- + The key used to add the custom response item (name of the HTTP header or root property of the Dynamic Metadata object). + If omitted, it will be set to the name of the response config. + type: string + metrics: + default: false + description: Whether this config should generate individual + observability metrics + type: boolean + plain: + description: Plain text content + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + priority: + default: 0 + description: |- + Priority group of the config. + All configs in the same priority group are evaluated concurrently; consecutive priority groups are evaluated sequentially. + type: integer + when: + description: |- + Conditions for Authorino to enforce this config. + If omitted, the config will be enforced for all requests. + If present, all conditions must match for the config to be enforced; otherwise, the config will be skipped. + items: + oneOf: + - properties: + patternRef: {} + required: + - patternRef + - properties: + operator: {} + selector: {} + value: {} + required: + - operator + - selector + - properties: + all: {} + required: + - all + - properties: + any: {} + required: + - any + properties: + all: + description: A list of pattern expressions to + be evaluated as a logical AND. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + any: + description: A list of pattern expressions to + be evaluated as a logical OR. + items: + type: object + x-kubernetes-preserve-unknown-fields: true + type: array + operator: + description: |- + The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value". + Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex) + enum: + - eq + - neq + - incl + - excl + - matches + type: string + patternRef: + description: Reference to a named set of pattern + expressions + type: string + selector: + description: |- + Path selector to fetch content from the authorization JSON (e.g. 'request.method'). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + Authorino custom JSON path modifiers are also supported. + type: string + value: + description: |- + The value of reference for the comparison with the content fetched from the authorization JSON. + If used with the "matches" operator, the value must compile to a valid Golang regex. + type: string + type: object + type: array + wristband: + description: Authorino Festival Wristband token + properties: + customClaims: + additionalProperties: + properties: + selector: + description: |- + Simple path selector to fetch content from the authorization JSON (e.g. 'request.method') or a string template with variables that resolve to patterns (e.g. "Hello, {auth.identity.name}!"). + Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used. + The following Authorino custom modifiers are supported: @extract:{sep:" ",pos:0}, @replace{old:"",new:""}, @case:upper|lower, @base64:encode|decode and @strip. + type: string + value: + description: Static value + x-kubernetes-preserve-unknown-fields: true + type: object + description: Any claims to be added to the wristband + token apart from the standard JWT claims (iss, + iat, exp) added by default. + type: object + issuer: + description: 'The endpoint to the Authorino service + that issues the wristband (format: ://:/, + where = /://:/, + where = /://:/, + where = /://:/, + where = /://:/, + where = /://:/, + where = /