diff --git a/internal/controller/runtime/fsm/runtime_fsm_configure_oidc.go b/internal/controller/runtime/fsm/runtime_fsm_configure_oidc.go index 986b0964..60993be8 100644 --- a/internal/controller/runtime/fsm/runtime_fsm_configure_oidc.go +++ b/internal/controller/runtime/fsm/runtime_fsm_configure_oidc.go @@ -19,12 +19,23 @@ func DefaultAdditionalOidcIfNotPresent(runtime *imv1.Runtime, cfg RCCfg) { if nil == additionalOidcConfig { additionalOidcConfig = &[]gardener.OIDCConfig{} - defaultOIDCConfig := shoot.CreateDefaultOIDCConfig(cfg.Kubernetes.DefaultSharedIASTenant) + defaultOIDCConfig := CreateDefaultOIDCConfig(cfg.Kubernetes.DefaultSharedIASTenant) *additionalOidcConfig = append(*additionalOidcConfig, defaultOIDCConfig) runtime.Spec.Shoot.Kubernetes.KubeAPIServer.AdditionalOidcConfig = additionalOidcConfig } } +func CreateDefaultOIDCConfig(defaultSharedIASTenant shoot.OidcProvider) gardener.OIDCConfig { + return gardener.OIDCConfig{ + ClientID: &defaultSharedIASTenant.ClientID, + GroupsClaim: &defaultSharedIASTenant.GroupsClaim, + IssuerURL: &defaultSharedIASTenant.IssuerURL, + SigningAlgs: defaultSharedIASTenant.SigningAlgs, + UsernameClaim: &defaultSharedIASTenant.UsernameClaim, + UsernamePrefix: &defaultSharedIASTenant.UsernamePrefix, + } +} + func sFnConfigureOidc(ctx context.Context, m *fsm, s *systemState) (stateFn, *ctrl.Result, error) { m.log.Info("Configure OIDC state") diff --git a/internal/gardener/shoot/extender/oidc.go b/internal/gardener/shoot/extender/oidc.go index 57676bc8..820bdb53 100644 --- a/internal/gardener/shoot/extender/oidc.go +++ b/internal/gardener/shoot/extender/oidc.go @@ -21,7 +21,6 @@ func NewOidcExtender(clientId, groupsClaim, issuerURL, usernameClaim, usernamePr } oidcConfig := runtime.Spec.Shoot.Kubernetes.KubeAPIServer.OidcConfig - if ShouldDefaultOidcConfig(oidcConfig) { oidcConfig = gardener.OIDCConfig{ ClientID: &clientId, @@ -32,13 +31,11 @@ func NewOidcExtender(clientId, groupsClaim, issuerURL, usernameClaim, usernamePr UsernamePrefix: &usernamePrefix, } } - setKubeAPIServerOIDCConfig(shoot, oidcConfig) return nil } } - func CanEnableExtension(runtime imv1.Runtime) bool { canEnable := true createdByMigrator := runtime.Labels["operator.kyma-project.io/created-by-migrator"] diff --git a/internal/gardener/shoot/oidc_defaulter.go b/internal/gardener/shoot/oidc_defaulter.go deleted file mode 100644 index 75512a1c..00000000 --- a/internal/gardener/shoot/oidc_defaulter.go +++ /dev/null @@ -1,30 +0,0 @@ -package shoot - -import ( - gardener "github.com/gardener/gardener/pkg/apis/core/v1beta1" - imv1 "github.com/kyma-project/infrastructure-manager/api/v1" -) - -func DefaultOidcIfNotPresent(runtime *imv1.Runtime, oidcProviderCfg OidcProvider) { - oidcConfig := runtime.Spec.Shoot.Kubernetes.KubeAPIServer.OidcConfig - - if ShouldDefaultOidcConfig(oidcConfig) { - defaultOIDCConfig := CreateDefaultOIDCConfig(oidcProviderCfg) - runtime.Spec.Shoot.Kubernetes.KubeAPIServer.OidcConfig = defaultOIDCConfig - } -} - -func ShouldDefaultOidcConfig(config gardener.OIDCConfig) bool { - return config.ClientID == nil && config.IssuerURL == nil -} - -func CreateDefaultOIDCConfig(defaultSharedIASTenant OidcProvider) gardener.OIDCConfig { - return gardener.OIDCConfig{ - ClientID: &defaultSharedIASTenant.ClientID, - GroupsClaim: &defaultSharedIASTenant.GroupsClaim, - IssuerURL: &defaultSharedIASTenant.IssuerURL, - SigningAlgs: defaultSharedIASTenant.SigningAlgs, - UsernameClaim: &defaultSharedIASTenant.UsernameClaim, - UsernamePrefix: &defaultSharedIASTenant.UsernamePrefix, - } -} diff --git a/internal/gardener/shoot/oidc_defaulter_test.go b/internal/gardener/shoot/oidc_defaulter_test.go deleted file mode 100644 index 6f6dff3e..00000000 --- a/internal/gardener/shoot/oidc_defaulter_test.go +++ /dev/null @@ -1,52 +0,0 @@ -package shoot - -import ( - "testing" - - gardener "github.com/gardener/gardener/pkg/apis/core/v1beta1" - imv1 "github.com/kyma-project/infrastructure-manager/api/v1" - "github.com/stretchr/testify/assert" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/utils/ptr" -) - -func TestOidcDefaulter(t *testing.T) { - t.Run("Create shoot from Runtime", func(t *testing.T) { - // given - runtime := CreateRuntimeStub("runtime") - - // when - DefaultOidcConfigurationIfNotPresent(runtime) - - // then - assert.NotNil(t, runtime.Spec.Shoot.Kubernetes.KubeAPIServer.AdditionalOidcConfig) - assert.Equal(t, runtime.Spec.Shoot.Kubernetes.KubeAPIServer.OidcConfig, (*runtime.Spec.Shoot.Kubernetes.KubeAPIServer.AdditionalOidcConfig)[0]) - }) -} - -func CreateRuntimeStub(resourceName string) *imv1.Runtime { - resource := &imv1.Runtime{ - ObjectMeta: metav1.ObjectMeta{ - Name: resourceName, - Namespace: "default", - }, - Spec: imv1.RuntimeSpec{ - Shoot: imv1.RuntimeShoot{ - Name: resourceName, - Kubernetes: imv1.Kubernetes{ - KubeAPIServer: imv1.APIServer{ - OidcConfig: gardener.OIDCConfig{ - ClientID: ptr.To("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"), - GroupsClaim: ptr.To("groups"), - IssuerURL: ptr.To("https://example.com"), - SigningAlgs: []string{"RSA256"}, - UsernameClaim: ptr.To("sub"), - UsernamePrefix: ptr.To("-"), - }, - }, - }, - }, - }, - } - return resource -}