Add machine user
[ZITADOPER-1]
This commit is contained in:
Haim Kortovich
198
src/internal/controller/machineuser_controller.go
Normal file
198
src/internal/controller/machineuser_controller.go
Normal file
@@ -0,0 +1,198 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
zitadelv1alpha1 "bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1"
|
||||
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/builder"
|
||||
condition "bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/condition"
|
||||
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/controller/zitadel"
|
||||
"github.com/zitadel/zitadel-go/v2/pkg/client/management"
|
||||
"github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/authn"
|
||||
pb "github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/management"
|
||||
user "github.com/zitadel/zitadel-go/v2/pkg/client/zitadel/user"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/client-go/util/workqueue"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
ctrlClient "sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/controller"
|
||||
)
|
||||
|
||||
// MachineUserReconciler reconciles a MachineUser object
|
||||
type MachineUserReconciler struct {
|
||||
client.Client
|
||||
RefResolver *zitadelv1alpha1.RefResolver
|
||||
ConditionReady *condition.Ready
|
||||
RequeueInterval time.Duration
|
||||
Builder *builder.Builder
|
||||
}
|
||||
|
||||
func NewMachineUserReconciler(client client.Client, refResolver *zitadelv1alpha1.RefResolver, builder *builder.Builder, conditionReady *condition.Ready,
|
||||
requeueInterval time.Duration) *MachineUserReconciler {
|
||||
return &MachineUserReconciler{
|
||||
Client: client,
|
||||
RefResolver: refResolver,
|
||||
ConditionReady: conditionReady,
|
||||
RequeueInterval: requeueInterval,
|
||||
Builder: builder,
|
||||
}
|
||||
}
|
||||
|
||||
//+kubebuilder:rbac:groups=zitadel.topmanage.com,resources=oidcapps,verbs=get;list;watch;create;update;patch;delete
|
||||
//+kubebuilder:rbac:groups=zitadel.topmanage.com,resources=oidcapps/status,verbs=get;update;patch
|
||||
//+kubebuilder:rbac:groups=zitadel.topmanage.com,resources=oidcapps/finalizers,verbs=update
|
||||
|
||||
// Reconcile is part of the main kubernetes reconciliation loop which aims to
|
||||
// move the current state of the cluster closer to the desired state.
|
||||
func (r *MachineUserReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
||||
var MachineUser zitadelv1alpha1.MachineUser
|
||||
if err := r.Get(ctx, req.NamespacedName, &MachineUser); err != nil {
|
||||
return ctrl.Result{}, client.IgnoreNotFound(err)
|
||||
}
|
||||
wr := newWrappedMachineUserReconciler(r.Client, r.RefResolver, r.Builder, &MachineUser)
|
||||
wf := newWrappedMachineUserFinalizer(r.Client, &MachineUser)
|
||||
tf := zitadel.NewZitadelFinalizer(r.Client, wf)
|
||||
tr := zitadel.NewZitadelReconciler(r.Client, r.ConditionReady, wr, tf, r.RequeueInterval)
|
||||
|
||||
result, err := tr.Reconcile(ctx, &MachineUser)
|
||||
if err != nil {
|
||||
return result, fmt.Errorf("error reconciling in MachineUserReconciler: %v", err)
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
type wrappedMachineUserReconciler struct {
|
||||
client.Client
|
||||
refResolver *zitadelv1alpha1.RefResolver
|
||||
MachineUser *zitadelv1alpha1.MachineUser
|
||||
Builder *builder.Builder
|
||||
}
|
||||
|
||||
func newWrappedMachineUserReconciler(client client.Client, refResolver *zitadelv1alpha1.RefResolver, builder *builder.Builder,
|
||||
MachineUser *zitadelv1alpha1.MachineUser) zitadel.WrappedReconciler {
|
||||
return &wrappedMachineUserReconciler{
|
||||
Client: client,
|
||||
refResolver: refResolver,
|
||||
MachineUser: MachineUser,
|
||||
Builder: builder,
|
||||
}
|
||||
}
|
||||
|
||||
func (wr *wrappedMachineUserReconciler) Reconcile(ctx context.Context, ztdClient *management.Client) error {
|
||||
// if wr.MachineUser.Status.AppId != "" {
|
||||
// appResp, err := ztdClient.GetAppByID(middleware.SetOrgID(ctx, org.Status.OrgId), &pb.GetAppByIDRequest{
|
||||
// ProjectId: project.Status.ProjectId,
|
||||
// AppId: string(wr.MachineUser.Status.AppId),
|
||||
// })
|
||||
// if err != nil {
|
||||
// return fmt.Errorf("Error getting MachineUser: %v", err)
|
||||
// }
|
||||
// if appResp.App != nil {
|
||||
// _, err := ztdClient.UpdateMachineUserConfig(middleware.SetOrgID(ctx, org.Status.OrgId), &pb.UpdateMachineUserConfigRequest{ProjectId: project.Status.ProjectId, AppId: wr.MachineUser.Status.AppId,
|
||||
// RedirectUris: wr.MachineUser.Spec.RedirectUris,
|
||||
// ResponseTypes: responseTypes,
|
||||
// GrantTypes: grantTypes,
|
||||
// AppType: app.MachineUserType(app.MachineUserType_value[wr.MachineUser.Spec.AppType]),
|
||||
// AuthMethodType: app.OIDCAuthMethodType(app.OIDCAuthMethodType_value[wr.MachineUser.Spec.AuthMethodType]),
|
||||
// PostLogoutRedirectUris: wr.MachineUser.Spec.PostLogoutRedirectUris,
|
||||
// DevMode: wr.MachineUser.Spec.DevMode,
|
||||
// AccessTokenType: app.OIDCTokenType(app.OIDCTokenType_value[wr.MachineUser.Spec.AccessTokenType]),
|
||||
// AccessTokenRoleAssertion: wr.MachineUser.Spec.AccessTokenRoleAssertion,
|
||||
// IdTokenRoleAssertion: wr.MachineUser.Spec.IdTokenRoleAssertion,
|
||||
// IdTokenUserinfoAssertion: wr.MachineUser.Spec.IdTokenUserinfoAssertion,
|
||||
// ClockSkew: durationpb.New(wr.MachineUser.Spec.ClockSkew.Duration),
|
||||
// AdditionalOrigins: wr.MachineUser.Spec.AdditionalOrigins,
|
||||
// SkipNativeAppSuccessPage: wr.MachineUser.Spec.SkipNativeAppSuccessPage,
|
||||
// })
|
||||
// if err != nil {
|
||||
// if !strings.Contains(err.Error(), "No changes") {
|
||||
// return fmt.Errorf("Error updating MachineUser: %v", err)
|
||||
// }
|
||||
// }
|
||||
// return nil
|
||||
// }
|
||||
// }
|
||||
zitadel, err := wr.refResolver.ZitadelCluster(ctx, &wr.MachineUser.Spec.ZitadelClusterRef, wr.MachineUser.Namespace)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
resp, err := ztdClient.AddMachineUser(ctx,
|
||||
&pb.AddMachineUserRequest{
|
||||
Name: wr.MachineUser.Name,
|
||||
UserName: wr.MachineUser.Name,
|
||||
Description: wr.MachineUser.Name,
|
||||
AccessTokenType: user.AccessTokenType(user.AccessTokenType_value[wr.MachineUser.Spec.AccessTokenType]),
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
if strings.Contains(err.Error(), "AlreadyExists") {
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("error creating MachineUser in Zitadel: %v", err)
|
||||
}
|
||||
|
||||
patch := ctrlClient.MergeFrom(wr.MachineUser.DeepCopy())
|
||||
wr.MachineUser.Status.UserId = resp.UserId
|
||||
if err := wr.Client.Status().Patch(ctx, wr.MachineUser, patch); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if wr.MachineUser.Status.KeyId != "" {
|
||||
respKey, err := ztdClient.AddMachineKey(ctx, &pb.AddMachineKeyRequest{
|
||||
UserId: resp.UserId,
|
||||
Type: authn.KeyType_KEY_TYPE_JSON,
|
||||
ExpirationDate: nil,
|
||||
})
|
||||
if err != nil {
|
||||
return fmt.Errorf("Error Adding MachineKey: %v", err)
|
||||
}
|
||||
key := types.NamespacedName{
|
||||
Name: wr.MachineUser.Name + "-key-secret",
|
||||
Namespace: wr.MachineUser.Namespace,
|
||||
}
|
||||
secret, err := wr.Builder.BuildSecret(builder.SecretOpts{
|
||||
Zitadel: zitadel,
|
||||
Key: key,
|
||||
Immutable: true,
|
||||
Data: map[string][]byte{
|
||||
"key": respKey.KeyDetails,
|
||||
},
|
||||
}, wr.MachineUser)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error building Secret: %v", err)
|
||||
}
|
||||
if err := wr.Create(ctx, secret); err != nil {
|
||||
return fmt.Errorf("error creating machine key Secret: %v", err)
|
||||
}
|
||||
patch = ctrlClient.MergeFrom(wr.MachineUser.DeepCopy())
|
||||
wr.MachineUser.Status.KeyId = respKey.KeyId
|
||||
return wr.Client.Status().Patch(ctx, wr.MachineUser, patch)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (wr *wrappedMachineUserReconciler) PatchStatus(ctx context.Context, patcher condition.Patcher) error {
|
||||
patch := client.MergeFrom(wr.MachineUser.DeepCopy())
|
||||
patcher(&wr.MachineUser.Status)
|
||||
|
||||
if err := wr.Client.Status().Patch(ctx, wr.MachineUser, patch); err != nil {
|
||||
return fmt.Errorf("error patching MachineUser status: %v", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// SetupWithManager sets up the controller with the Manager.
|
||||
func (r *MachineUserReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&zitadelv1alpha1.MachineUser{}).
|
||||
Owns(&corev1.Secret{}).
|
||||
WithOptions(controller.Options{RateLimiter: workqueue.NewItemExponentialFailureRateLimiter(time.Millisecond*500, time.Minute*3)}).
|
||||
Complete(r)
|
||||
}
|
||||
Reference in New Issue
Block a user