Skip to content

Commit 2defc9f

Browse files
matheuscscpmatheuscscp
committed
[RFC-0010] Introduce workload identity auth for remote clusters
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
1 parent 124402b commit 2defc9f

8 files changed

Lines changed: 270 additions & 56 deletions

File tree

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.24.0
44

55
require (
66
github.com/fluxcd/pkg/apis/kustomize v1.10.0
7-
github.com/fluxcd/pkg/apis/meta v1.12.0
7+
github.com/fluxcd/pkg/apis/meta v1.13.1-0.20250702221702-0f768bb14abf
88
k8s.io/apiextensions-apiserver v0.33.0
99
k8s.io/apimachinery v0.33.0
1010
sigs.k8s.io/controller-runtime v0.21.0

‎api/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
44
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
55
github.com/fluxcd/pkg/apis/kustomize v1.10.0 h1:47EeSzkQvlQZdH92vHMe2lK2iR8aOSEJq95avw5idts=
66
github.com/fluxcd/pkg/apis/kustomize v1.10.0/go.mod h1:UsqMV4sqNa1Yg0pmTsdkHRJr7bafBOENIJoAN+3ezaQ=
7-
github.com/fluxcd/pkg/apis/meta v1.12.0 h1:XW15TKZieC2b7MN8VS85stqZJOx+/b8jATQ/xTUhVYg=
8-
github.com/fluxcd/pkg/apis/meta v1.12.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
7+
github.com/fluxcd/pkg/apis/meta v1.13.1-0.20250702221702-0f768bb14abf h1:fvOZ91lrAwVnv54YpgaL3kx0xguXTR+IUvyGDbiwUqA=
8+
github.com/fluxcd/pkg/apis/meta v1.13.1-0.20250702221702-0f768bb14abf/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
99
github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
1010
github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
1111
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=

‎config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml‎

Lines changed: 82 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -256,16 +256,47 @@ spec:
256256
a controller level fallback for when KustomizationSpec.ServiceAccountName
257257
is empty.
258258
properties:
259+
address:
260+
description: |-
261+
Address is the optional address of the Kubernetes API server.
262+
Not supported for the generic provider, optional for the
263+
other providers. The address is used to select among a list
264+
of endpoints in the cluster resource. If not set, the first
265+
endpoint on the list is used. If none of the addresses in the
266+
cluster resource match a provided address, the controller will
267+
error out and the reconciliation will fail. Must be a valid
268+
HTTPS endpoint, e.g. "https://api.example.com:6443".
269+
pattern: ^https://.*
270+
type: string
271+
cluster:
272+
description: |-
273+
Cluster is the optional fully qualified resource name of the
274+
Kubernetes cluster in the cloud provider to connect to.
275+
Not supported for the generic provider, required for the
276+
other providers.
277+
type: string
278+
provider:
279+
default: generic
280+
description: |-
281+
Provider is the optional name of the cloud provider that should be used
282+
to authenticate to the Kubernetes API server. Can be one of "aws",
283+
"azure", "gcp", or "generic". Defaults to "generic".
284+
enum:
285+
- aws
286+
- azure
287+
- gcp
288+
- generic
289+
type: string
259290
secretRef:
260291
description: |-
261-
SecretRef holds the name of a secret that contains a key with
292+
SecretRef holds an optional name of a secret that contains a key with
262293
the kubeconfig file as the value. If no key is set, the key will default
263294
to 'value'.
264295
It is recommended that the kubeconfig is self-contained, and the secret
265296
is regularly updated if credentials such as a cloud-access-token expire.
266297
Cloud specific `cmd-path` auth helpers will not function without adding
267298
binaries and credentials to the Pod that is responsible for reconciling
268-
Kubernetes resources.
299+
Kubernetes resources. Supported only for the generic provider.
269300
properties:
270301
key:
271302
description: Key in the Secret, when not specified an implementation-specific
@@ -277,8 +308,14 @@ spec:
277308
required:
278309
- name
279310
type: object
280-
required:
281-
- secretRef
311+
serviceAccountName:
312+
description: |-
313+
ServiceAccountName is the optional name of the Kubernetes
314+
ServiceAccount in the same namespace that should be used
315+
to authenticate to the Kubernetes API server. If not set,
316+
the controller ServiceAccount will be used. Not supported
317+
for the generic provider.
318+
type: string
282319
type: object
283320
namePrefix:
284321
description: NamePrefix will prefix the names of all managed resources.
@@ -1347,16 +1384,47 @@ spec:
13471384
a controller level fallback for when KustomizationSpec.ServiceAccountName
13481385
is empty.
13491386
properties:
1387+
address:
1388+
description: |-
1389+
Address is the optional address of the Kubernetes API server.
1390+
Not supported for the generic provider, optional for the
1391+
other providers. The address is used to select among a list
1392+
of endpoints in the cluster resource. If not set, the first
1393+
endpoint on the list is used. If none of the addresses in the
1394+
cluster resource match a provided address, the controller will
1395+
error out and the reconciliation will fail. Must be a valid
1396+
HTTPS endpoint, e.g. "https://api.example.com:6443".
1397+
pattern: ^https://.*
1398+
type: string
1399+
cluster:
1400+
description: |-
1401+
Cluster is the optional fully qualified resource name of the
1402+
Kubernetes cluster in the cloud provider to connect to.
1403+
Not supported for the generic provider, required for the
1404+
other providers.
1405+
type: string
1406+
provider:
1407+
default: generic
1408+
description: |-
1409+
Provider is the optional name of the cloud provider that should be used
1410+
to authenticate to the Kubernetes API server. Can be one of "aws",
1411+
"azure", "gcp", or "generic". Defaults to "generic".
1412+
enum:
1413+
- aws
1414+
- azure
1415+
- gcp
1416+
- generic
1417+
type: string
13501418
secretRef:
13511419
description: |-
1352-
SecretRef holds the name of a secret that contains a key with
1420+
SecretRef holds an optional name of a secret that contains a key with
13531421
the kubeconfig file as the value. If no key is set, the key will default
13541422
to 'value'.
13551423
It is recommended that the kubeconfig is self-contained, and the secret
13561424
is regularly updated if credentials such as a cloud-access-token expire.
13571425
Cloud specific `cmd-path` auth helpers will not function without adding
13581426
binaries and credentials to the Pod that is responsible for reconciling
1359-
Kubernetes resources.
1427+
Kubernetes resources. Supported only for the generic provider.
13601428
properties:
13611429
key:
13621430
description: Key in the Secret, when not specified an implementation-specific
@@ -1368,8 +1436,14 @@ spec:
13681436
required:
13691437
- name
13701438
type: object
1371-
required:
1372-
- secretRef
1439+
serviceAccountName:
1440+
description: |-
1441+
ServiceAccountName is the optional name of the Kubernetes
1442+
ServiceAccount in the same namespace that should be used
1443+
to authenticate to the Kubernetes API server. If not set,
1444+
the controller ServiceAccount will be used. Not supported
1445+
for the generic provider.
1446+
type: string
13731447
type: object
13741448
patches:
13751449
description: |-

‎go.mod‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
1515
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
1616
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0
17-
github.com/aws/aws-sdk-go-v2 v1.36.3
17+
github.com/aws/aws-sdk-go-v2 v1.36.4
1818
github.com/aws/aws-sdk-go-v2/credentials v1.17.67
1919
github.com/cyphar/filepath-securejoin v0.4.1
2020
github.com/dimchansky/utfbom v1.1.1
@@ -23,12 +23,12 @@ require (
2323
github.com/fluxcd/pkg/apis/acl v0.7.0
2424
github.com/fluxcd/pkg/apis/event v0.17.0
2525
github.com/fluxcd/pkg/apis/kustomize v1.10.0
26-
github.com/fluxcd/pkg/apis/meta v1.12.0
27-
github.com/fluxcd/pkg/auth v0.16.0
26+
github.com/fluxcd/pkg/apis/meta v1.13.1-0.20250702221702-0f768bb14abf
27+
github.com/fluxcd/pkg/auth v0.18.1-0.20250702221702-0f768bb14abf
2828
github.com/fluxcd/pkg/cache v0.9.0
2929
github.com/fluxcd/pkg/http/fetch v0.16.0
3030
github.com/fluxcd/pkg/kustomize v1.18.0
31-
github.com/fluxcd/pkg/runtime v0.60.0
31+
github.com/fluxcd/pkg/runtime v0.63.1-0.20250702221702-0f768bb14abf
3232
github.com/fluxcd/pkg/ssa v0.49.0
3333
github.com/fluxcd/pkg/tar v0.12.0
3434
github.com/fluxcd/pkg/testserver v0.11.0
@@ -64,14 +64,16 @@ require (
6464
cloud.google.com/go v0.120.1 // indirect
6565
cloud.google.com/go/auth v0.16.1 // indirect
6666
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
67-
cloud.google.com/go/compute/metadata v0.6.0 // indirect
67+
cloud.google.com/go/compute/metadata v0.7.0 // indirect
6868
cloud.google.com/go/iam v1.5.2 // indirect
6969
cloud.google.com/go/longrunning v0.6.7 // indirect
7070
cloud.google.com/go/monitoring v1.24.2 // indirect
7171
cloud.google.com/go/storage v1.51.0 // indirect
7272
dario.cat/mergo v1.0.1 // indirect
7373
filippo.io/edwards25519 v1.1.0 // indirect
74+
github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect
7475
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
76+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice v1.0.0 // indirect
7577
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 // indirect
7678
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect
7779
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
@@ -88,11 +90,13 @@ require (
8890
github.com/aws/aws-sdk-go-v2/config v1.29.14 // indirect
8991
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
9092
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.72 // indirect
91-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
92-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
93+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.35 // indirect
94+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.35 // indirect
9395
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
9496
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
9597
github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3 // indirect
98+
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.33.0 // indirect
99+
github.com/aws/aws-sdk-go-v2/service/eks v1.66.0 // indirect
96100
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
97101
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 // indirect
98102
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
@@ -155,7 +159,7 @@ require (
155159
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
156160
github.com/google/uuid v1.6.0 // indirect
157161
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
158-
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
162+
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
159163
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
160164
github.com/goware/prefixer v0.0.0-20160118172347-395022866408 // indirect
161165
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
@@ -237,11 +241,11 @@ require (
237241
golang.org/x/text v0.25.0 // indirect
238242
golang.org/x/time v0.11.0 // indirect
239243
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
240-
google.golang.org/api v0.230.0 // indirect
241-
google.golang.org/genproto v0.0.0-20250425173222-7b384671a197 // indirect
242-
google.golang.org/genproto/googleapis/api v0.0.0-20250425173222-7b384671a197 // indirect
243-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250425173222-7b384671a197 // indirect
244-
google.golang.org/grpc v1.72.0 // indirect
244+
google.golang.org/api v0.234.0 // indirect
245+
google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
246+
google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
247+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 // indirect
248+
google.golang.org/grpc v1.72.1 // indirect
245249
google.golang.org/protobuf v1.36.6 // indirect
246250
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
247251
gopkg.in/inf.v0 v0.9.1 // indirect

0 commit comments

Comments
 (0)