Skip to content

Commit 5ec3c44

Browse files
shraddhabangshraddhabang
committed
[feat gw api] Add auth cognito action for secure listeners on ALBs
1 parent f6aa7ef commit 5ec3c44

25 files changed

+1228
-191
lines changed

‎apis/gateway/v1beta1/listenerruleconfig_types.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ type AuthenticateCognitoActionConfig struct {
166166
// +kubebuilder:default=604800
167167
// +kubebuilder:validation:Minimum=1
168168
// +kubebuilder:validation:Maximum=604800
169-
SessionTimeout *int32 `json:"sessionTimeout,omitempty"`
169+
SessionTimeout *int64 `json:"sessionTimeout,omitempty"`
170170
}
171171

172172
// Information about an authenticate-oidc action
@@ -259,12 +259,12 @@ type Action struct {
259259
AuthenticateOIDCConfig *AuthenticateOidcActionConfig `json:"authenticateOIDCConfig,omitempty"`
260260
}
261261

262-
// ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
262+
// ListenerRuleConfigurationSpec defines the desired state of ListenerRuleConfiguration
263263
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions) > 0",message="At least one action must be specified if actions field is present"
264264
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || self.actions.all(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito' || a.type == 'fixed-response' || a.type == 'forward' || a.type == 'redirect')",message="Only forward, redirect, authenticate-oidc, authenticate-cognito, and fixed-response action types are supported"
265265
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions.filter(a, a.type == 'authenticate-oidc' || a.type == 'authenticate-cognito')) <= 1",message="At most one authentication action (either authenticate-oidc or authenticate-cognito) can be specified"
266266
// +kubebuilder:validation:XValidation:rule="!has(self.actions) || size(self.actions.filter(a, a.type == 'fixed-response' || a.type == 'forward' || a.type == 'redirect')) <= 1",message="At most one routing action (fixed-response or forward or redirect) can be specified"
267-
type ListenerRuleSpec struct {
267+
type ListenerRuleConfigurationSpec struct {
268268
// Actions defines the set of actions to be performed when conditions match.
269269
// This CRD implementation currently supports only authenticate-oidc, authenticate-cognito, and fixed-response action types fully and forward and redirect actions partially
270270
//
@@ -292,8 +292,8 @@ type ListenerRuleSpec struct {
292292
Tags *map[string]string `json:"tags,omitempty"`
293293
}
294294

295-
// ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
296-
type ListenerRuleStatus struct {
295+
// ListenerRuleConfigurationStatus defines the observed state of ListenerRuleConfiguration
296+
type ListenerRuleConfigurationStatus struct {
297297

298298
// The observed generation of the rule configuration
299299
// +optional
@@ -309,8 +309,8 @@ type ListenerRuleConfiguration struct {
309309
metav1.TypeMeta `json:",inline"`
310310
metav1.ObjectMeta `json:"metadata,omitempty"`
311311

312-
Spec ListenerRuleSpec `json:"spec,omitempty"`
313-
Status ListenerRuleStatus `json:"status,omitempty"`
312+
Spec ListenerRuleConfigurationSpec `json:"spec,omitempty"`
313+
Status ListenerRuleConfigurationStatus `json:"status,omitempty"`
314314
}
315315

316316
// +kubebuilder:object:root=true

‎apis/gateway/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 9 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/gateway/gateway-crds.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ spec:
4141
metadata:
4242
type: object
4343
spec:
44-
description: ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
44+
description: ListenerRuleConfigurationSpec defines the desired state of
45+
ListenerRuleConfiguration
4546
properties:
4647
actions:
4748
description: |-
@@ -97,7 +98,7 @@ spec:
9798
description: |-
9899
The maximum duration of the authentication session, in seconds. The default is
99100
604800 seconds (7 days).
100-
format: int32
101+
format: int64
101102
maximum: 604800
102103
minimum: 1
103104
type: integer
@@ -373,7 +374,8 @@ spec:
373374
rule: '!has(self.actions) || size(self.actions.filter(a, a.type == ''fixed-response''
374375
|| a.type == ''forward'' || a.type == ''redirect'')) <= 1'
375376
status:
376-
description: ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
377+
description: ListenerRuleConfigurationStatus defines the observed state
378+
of ListenerRuleConfiguration
377379
properties:
378380
observedGeneration:
379381
description: The observed generation of the rule configuration

‎config/crd/gateway/gateway.k8s.aws_listenerruleconfigurations.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ spec:
4242
metadata:
4343
type: object
4444
spec:
45-
description: ListenerRuleSpec defines the desired state of ListenerRuleConfiguration
45+
description: ListenerRuleConfigurationSpec defines the desired state of
46+
ListenerRuleConfiguration
4647
properties:
4748
actions:
4849
description: |-
@@ -98,7 +99,7 @@ spec:
9899
description: |-
99100
The maximum duration of the authentication session, in seconds. The default is
100101
604800 seconds (7 days).
101-
format: int32
102+
format: int64
102103
maximum: 604800
103104
minimum: 1
104105
type: integer
@@ -374,7 +375,8 @@ spec:
374375
rule: '!has(self.actions) || size(self.actions.filter(a, a.type == ''fixed-response''
375376
|| a.type == ''forward'' || a.type == ''redirect'')) <= 1'
376377
status:
377-
description: ListenerRuleStatus defines the observed state of ListenerRuleConfiguration
378+
description: ListenerRuleConfigurationStatus defines the observed state
379+
of ListenerRuleConfiguration
378380
properties:
379381
observedGeneration:
380382
description: The observed generation of the rule configuration

‎docs/guide/gateway/spec.md‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ _Appears in:_
219219

220220
| Field | Description | Default | Validation |
221221
| --- | --- | --- | --- |
222-
| `targetGroupStickinessConfig` _[TargetGroupStickinessConfig](#targetgroupstickinessconfig)_ | The target group stickiness for the rule.<br />Note: ForwardActionConfig only supports target group stickiness configuration through CRD.<br />All other forward action fields must be set through the Gateway API native way. | | |
222+
| `targetGroupStickinessConfig` _[TargetGroupStickinessConfig](#targetgroupstickinessconfig)_ | The target group stickiness for the rule.<br />Note: ForwardActionConfig only supports target group stickiness configuration through CRD.<br />All other forward action fields must be set through the Gateway API native way. | \{ \} | |
223223

224224

225225
#### HealthCheckConfiguration
@@ -476,6 +476,8 @@ _Appears in:_
476476
| `enableICMP` _boolean_ | EnableICMP [Network LoadBalancer]<br />enables the creation of security group rules to the managed security group<br />to allow explicit ICMP traffic for Path MTU discovery for IPv4 and dual-stack VPCs | | |
477477
| `manageBackendSecurityGroupRules` _boolean_ | ManageBackendSecurityGroupRules [Application / Network LoadBalancer]<br />specifies whether you want the controller to configure security group rules on Node/Pod for traffic access<br />when you specify securityGroups | | |
478478
| `minimumLoadBalancerCapacity` _[MinimumLoadBalancerCapacity](#minimumloadbalancercapacity)_ | MinimumLoadBalancerCapacity define the capacity reservation for LoadBalancers | | |
479+
| `wafV2` _[WAFv2Configuration](#wafv2configuration)_ | WAFv2 define the AWS WAFv2 settings for a Gateway [Application Load Balancer] | | |
480+
| `shieldConfiguration` _[ShieldConfiguration](#shieldconfiguration)_ | ShieldAdvanced define the AWS Shield settings for a Gateway [Application Load Balancer] | | |
479481

480482

481483
#### LoadBalancerConfigurationStatus
@@ -731,6 +733,22 @@ _Appears in:_
731733
| `namespace` _string_ | Namespace is namespace of secret. If empty it will be considered to be in same namespace as of the resource referring it | | |
732734

733735

736+
#### ShieldConfiguration
737+
738+
739+
740+
ShieldConfiguration configuration parameters used to configure Shield
741+
742+
743+
744+
_Appears in:_
745+
- [LoadBalancerConfigurationSpec](#loadbalancerconfigurationspec)
746+
747+
| Field | Description | Default | Validation |
748+
| --- | --- | --- | --- |
749+
| `enabled` _boolean_ | Enabled whether Shield Advanced should be configured with the Gateway | | |
750+
751+
734752
#### SourceIPConditionConfig
735753

736754

@@ -942,3 +960,19 @@ _Appears in:_
942960
| `ip` | |
943961

944962

963+
#### WAFv2Configuration
964+
965+
966+
967+
WAFv2Configuration configuration parameters used to configure WAFv2
968+
969+
970+
971+
_Appears in:_
972+
- [LoadBalancerConfigurationSpec](#loadbalancerconfigurationspec)
973+
974+
| Field | Description | Default | Validation |
975+
| --- | --- | --- | --- |
976+
| `webACL` _string_ | ACL The WebACL to configure with the Gateway | | |
977+
978+

‎go.mod‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,22 +29,22 @@ require (
2929
github.com/onsi/gomega v1.37.0
3030
github.com/pkg/errors v0.9.1
3131
github.com/prometheus/client_golang v1.22.0
32-
github.com/spf13/pflag v1.0.6
32+
github.com/spf13/pflag v1.0.7
3333
github.com/stretchr/testify v1.10.0
3434
go.uber.org/zap v1.27.0
3535
golang.org/x/net v0.41.0
3636
golang.org/x/time v0.9.0
3737
gomodules.xyz/jsonpatch/v2 v2.4.0
38-
helm.sh/helm/v3 v3.18.4
39-
k8s.io/api v0.33.2
40-
k8s.io/apimachinery v0.33.2
41-
k8s.io/cli-runtime v0.33.2
42-
k8s.io/client-go v0.33.2
38+
helm.sh/helm/v3 v3.18.5
39+
k8s.io/api v0.33.3
40+
k8s.io/apimachinery v0.33.3
41+
k8s.io/cli-runtime v0.33.3
42+
k8s.io/client-go v0.33.3
4343
k8s.io/klog/v2 v2.130.1
4444
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
4545
sigs.k8s.io/controller-runtime v0.21.0
4646
sigs.k8s.io/gateway-api v1.2.0
47-
sigs.k8s.io/yaml v1.4.0
47+
sigs.k8s.io/yaml v1.5.0
4848
)
4949

5050
require (
@@ -139,6 +139,7 @@ require (
139139
github.com/rubenv/sql-migrate v1.8.0 // indirect
140140
github.com/russross/blackfriday/v2 v2.1.0 // indirect
141141
github.com/sanity-io/litter v1.5.5 // indirect
142+
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
142143
github.com/sergi/go-diff v1.2.0 // indirect
143144
github.com/shopspring/decimal v1.4.0 // indirect
144145
github.com/sirupsen/logrus v1.9.3 // indirect
@@ -155,24 +156,26 @@ require (
155156
github.com/yudai/gojsondiff v1.0.0 // indirect
156157
github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
157158
go.uber.org/multierr v1.11.0 // indirect
158-
golang.org/x/crypto v0.39.0 // indirect
159+
go.yaml.in/yaml/v2 v2.4.2 // indirect
160+
go.yaml.in/yaml/v3 v3.0.3 // indirect
161+
golang.org/x/crypto v0.40.0 // indirect
159162
golang.org/x/oauth2 v0.28.0 // indirect
160-
golang.org/x/sync v0.15.0 // indirect
161-
golang.org/x/sys v0.33.0 // indirect
162-
golang.org/x/term v0.32.0 // indirect
163-
golang.org/x/text v0.26.0 // indirect
163+
golang.org/x/sync v0.16.0 // indirect
164+
golang.org/x/sys v0.34.0 // indirect
165+
golang.org/x/term v0.33.0 // indirect
166+
golang.org/x/text v0.27.0 // indirect
164167
golang.org/x/tools v0.34.0 // indirect
165168
google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
166169
google.golang.org/grpc v1.68.1 // indirect
167170
google.golang.org/protobuf v1.36.5 // indirect
168171
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
169172
gopkg.in/inf.v0 v0.9.1 // indirect
170173
gopkg.in/yaml.v3 v3.0.1 // indirect
171-
k8s.io/apiextensions-apiserver v0.33.2 // indirect
172-
k8s.io/apiserver v0.33.2 // indirect
173-
k8s.io/component-base v0.33.2 // indirect
174+
k8s.io/apiextensions-apiserver v0.33.3 // indirect
175+
k8s.io/apiserver v0.33.3 // indirect
176+
k8s.io/component-base v0.33.3 // indirect
174177
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
175-
k8s.io/kubectl v0.33.2 // indirect
178+
k8s.io/kubectl v0.33.3 // indirect
176179
moul.io/http2curl/v2 v2.3.0 // indirect
177180
oras.land/oras-go/v2 v2.6.0 // indirect
178181
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect

0 commit comments

Comments
 (0)