Skip to content

Commit 4895c37

Browse files
sabre1041sabre1041
committed
Added cron schedule, enhancements to keycloak provided and new github provider
1 parent 33e8d7e commit 4895c37

File tree

11 files changed

+643
-57
lines changed

11 files changed

+643
-57
lines changed

‎README.md

+104-8
Original file line numberDiff line numberDiff line change
@@ -43,22 +43,82 @@ oc -n group-sync-operator apply -f deploy
4343

4444
Integration with external systems is made possible through a set of plugable external providers. The following providers are currently supported:
4545

46+
* [GitHub](https://github.com)
4647
* [Keycloak](https://www.keycloak.org/)/[Red Hat Single Sign On](https://access.redhat.com/products/red-hat-single-sign-on)
4748

48-
The following sections describe the configuration options provided by each provider
49+
The following sections describe the configuration options available for each provider
50+
51+
52+
### GitHub
53+
54+
Teams stored within a GitHub organization can be synchronized into OpenShift. The following table describes the set of configuration options for the GitHub provider:
55+
56+
| Name | Description | Defaults | Required |
57+
| ----- | ---------- | -------- | ----- |
58+
| `caSecretRef` | Reference to a secret containing a SSL certificate to use for communication (See below) | | No |
59+
| `credentialsSecretName` | Name of the secret containing authentication details (See below) | | Yes |
60+
| `insecure` | Ignore SSL verification | 'false' | No |
61+
| `organization` | Organization to synchronize against | | Yes |
62+
| `teams` | List of teams to filter against | | No |
63+
| `url` | Base URL for the GitHub or GitHub Enterprise host (Must contain a trailing slash) | | No |
64+
65+
66+
The following is an example of a minimal configuration that can be applied to integrate with a Github provider:
67+
68+
```shell
69+
apiVersion: redhatcop.redhat.io/v1alpha1
70+
kind: GroupSync
71+
metadata:
72+
name: github-groupsync
73+
namespace: group-sync-operator
74+
spec:
75+
providers:
76+
- github:
77+
organization: ocp
78+
credentialsSecretName: github-group-sync
79+
```
80+
81+
#### Authenticating to GitHub
82+
83+
Authentication to GitHub can be performed using an OAuth Personal Access Token or a Username and Password (Note: 2FA not supported). A secret must be created in the same namespace that contains the `GroupSync` resource:
84+
85+
When using an OAuth token, the following key is required:
86+
87+
* `token` - OAuth token
88+
89+
The secret can be created by executing the following command:
90+
91+
```shell
92+
oc create secret generic github-group-sync --from-literal=token=<token>
93+
```
94+
95+
96+
The following keys are required for username and password:
97+
98+
* `username` - Username for authenticating with Keycloak
99+
* `password` - Password for authenticating with Keycloak
100+
101+
The secret can be created by executing the following command:
102+
103+
```shell
104+
oc create secret generic github-group-sync --from-literal=username=<username> --from-literal=password=<password>
105+
```
49106

50107
### Keycloak
51108

52109
Groups stored within Keycloak can be synchronized into OpenShift. The following table describes the set of configuration options for the Keycloak provider:
53110

54111
| Name | Description | Defaults | Required |
55112
| ----- | ---------- | -------- | ----- |
56-
| `url` | URL Location for Keycloak | | Yes |
113+
| `caSecretRef` | Reference to a secret containing a SSL certificate to use for communication (See below) | | No |
114+
| `credentialsSecretName` | Name of the secret containing authentication details (See below) | | Yes |
115+
| `groups` | List of groups to filter against | | No |
116+
| `insecure` | Ignore SSL verification | 'false' | No |
57117
| `loginRealm` | Realm to authenticate against | `master` | No |
58118
| `realm` | Realm to synchronize | | Yes |
59-
| `secretName` | Name of the secret containing authentication details (See below) | | Yes |
60-
| `insecure` | Ignore SSL verification | 'false' | No |
61119
| `scope` | Scope for group synchronization. Options are `one` for one level or `sub` to include subgroups | `sub` | No |
120+
| `url` | URL Location for Keycloak | | Yes |
121+
62122

63123
The following is an example of a minimal configuration that can be applied to integrate with a Keycloak provider:
64124

@@ -72,7 +132,7 @@ spec:
72132
providers:
73133
- keycloak:
74134
realm: ocp
75-
secretName: keycloak-group-sync
135+
credentialsSecretName: keycloak-group-sync
76136
url: https://keycloak-keycloak-operator.apps.openshift.com
77137
```
78138

@@ -83,12 +143,47 @@ A secret must be created in the same namespace that contains the `GroupSync` res
83143
* `username` - Username for authenticating with Keycloak
84144
* `password` - Password for authenticating with Keycloak
85145

86-
To specify the TLS certificates that should be used to communicate with Keycloak, add the certificates to `ca.crt` key
146+
## CA Certificates
147+
148+
Each provider allows for certificates to be provided in a secret to communicate to the target host. The secret must be placed in the same namespace as the `GroupSync`. An example of how a CA certificate for the Keycloak provider can be found below:
87149

88-
## Sync Period
89150

90-
To specify the period for which synchronization should occur on a regular basis, the `syncPeriodMinutes` field can be set as described below
151+
```shell
152+
apiVersion: redhatcop.redhat.io/v1alpha1
153+
kind: GroupSync
154+
metadata:
155+
name: keycloak-groupsync
156+
namespace: group-sync-operator
157+
spec:
158+
providers:
159+
- keycloak:
160+
realm: ocp
161+
credentialsSecretName: keycloak-group-sync
162+
url: https://keycloak-keycloak-operator.apps.openshift.com
163+
caSecretRef:
164+
name: keycloak-certs
165+
key: tls.crt
166+
```
167+
168+
169+
## Scheduled Execution
170+
171+
A cron style expression can be specified for which a synchronization event will occur. The following specifies that a synchronization should occur nightly at 3AM
172+
173+
174+
```shell
175+
apiVersion: redhatcop.redhat.io/v1alpha1
176+
kind: GroupSync
177+
metadata:
178+
name: keycloak-groupsync
179+
namespace: group-sync-operator
180+
spec:
181+
schedule: "0 3 * * *"
182+
providers:
183+
- ...
184+
```
91185

186+
If a schedule is not provided, synchronization will occur only when the object is reconciled by the platform.
92187

93188

94189
## Local Development
@@ -110,3 +205,4 @@ Using the [operator-sdk](https://github.com/operator-framework/operator-sdk), ru
110205
```shell
111206
oc apply -f deploy/crds/redhatcop.redhat.io_groupsyncs_crd.yaml
112207
OPERATOR_NAME='group-sync-operator' operator-sdk run --local --watch-namespace ""
208+
```

‎deploy/crds/redhatcop.redhat.io_groupsyncs_crd.yaml

+49-5
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,55 @@ spec:
3737
items:
3838
description: Provider represents the container for a single provider
3939
properties:
40+
github:
41+
description: GitHubProvider represents integration with GitHub
42+
properties:
43+
caSecretRef:
44+
description: SecretRef represents a reference to an item within
45+
a Secret
46+
properties:
47+
key:
48+
type: string
49+
name:
50+
type: string
51+
required:
52+
- name
53+
type: object
54+
credentialsSecretName:
55+
type: string
56+
insecure:
57+
type: boolean
58+
organization:
59+
type: string
60+
teams:
61+
items:
62+
type: string
63+
type: array
64+
url:
65+
type: string
66+
required:
67+
- credentialsSecretName
68+
type: object
4069
keycloak:
4170
description: KeycloakProvider represents integration with Keycloak
4271
properties:
72+
caSecretRef:
73+
description: SecretRef represents a reference to an item within
74+
a Secret
75+
properties:
76+
key:
77+
type: string
78+
name:
79+
type: string
80+
required:
81+
- name
82+
type: object
83+
credentialsSecretName:
84+
type: string
85+
groups:
86+
items:
87+
type: string
88+
type: array
4389
insecure:
4490
type: boolean
4591
loginRealm:
@@ -51,13 +97,11 @@ spec:
5197
- one
5298
- sub
5399
type: string
54-
secretName:
55-
type: string
56100
url:
57101
type: string
58102
required:
103+
- credentialsSecretName
59104
- realm
60-
- secretName
61105
- url
62106
type: object
63107
name:
@@ -66,8 +110,8 @@ spec:
66110
- name
67111
type: object
68112
type: array
69-
resyncPeriodMinutes:
70-
type: integer
113+
schedule:
114+
type: string
71115
type: object
72116
status:
73117
description: GroupSyncStatus defines the observed state of GroupSync

‎examples/github.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: redhatcop.redhat.io/v1alpha1
2+
kind: GroupSync
3+
metadata:
4+
name: github-groupsync
5+
spec:
6+
providers:
7+
- name: github
8+
github:
9+
credentialsSecretName: github-group-sync
10+
organization: myorg

‎examples/keycloak.yaml

+2-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ spec:
66
providers:
77
- name: keycloak
88
keycloak:
9-
insecure: true
109
realm: ocp
11-
url: "https://keycloak-keycloak-operator.apps.cluster-a8b1.a8b1.example.opentlc.com"
12-
secretName: keycloak-group-sync
10+
url: "https://keycloak-keycloak-operator.apps.openshift.com"
11+
credentialsSecretName: keycloak-group-sync

‎go.mod

+5
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,15 @@ go 1.13
44

55
require (
66
github.com/Nerzal/gocloak/v5 v5.1.0
7+
github.com/google/go-github v17.0.0+incompatible
8+
github.com/google/go-github/v31 v31.0.0
79
github.com/openshift/api v3.9.1-0.20190924102528-32369d4db2ad+incompatible
810
github.com/operator-framework/operator-sdk v0.16.0
911
github.com/redhat-cop/operator-utils v0.2.1
12+
github.com/robfig/cron/v3 v3.0.1
1013
github.com/spf13/pflag v1.0.5
14+
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
15+
google.golang.org/appengine v1.6.5
1116
k8s.io/api v0.17.4
1217
k8s.io/apimachinery v0.17.4
1318
k8s.io/client-go v12.0.0+incompatible

‎pkg/apis/redhatcop/v1alpha1/groupsync_types.go

+25-6
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ type GroupSyncSpec struct {
2323
// +patchStrategy=merge,retainKeys
2424
Providers []Provider `json:"providers,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,1,rep,name=providers"`
2525

26-
ResyncPeriodMinutes *int `json:"resyncPeriodMinutes,omitempty"`
26+
Schedule string `json:"schedule,omitempty"`
2727
}
2828

2929
// GroupSyncStatus defines the observed state of GroupSync
@@ -63,17 +63,36 @@ type Provider struct {
6363
// ProviderType represents the provider to synchronize against
6464
type ProviderType struct {
6565
Keycloak *KeycloakProvider `json:"keycloak,omitempty"`
66+
GitHub *GitHubProvider `json:"github,omitempty"`
6667
}
6768

6869
// KeycloakProvider represents integration with Keycloak
6970
type KeycloakProvider struct {
70-
URL string `json:"url"`
71-
LoginRealm string `json:"loginRealm,omitempty"`
72-
Realm string `json:"realm"`
73-
SecretName string `json:"secretName"`
74-
Insecure bool `json:"insecure,omitempty"`
71+
CaSecretRef *SecretRef `json:"caSecretRef,omitempty"`
72+
CredentialsSecretName string `json:"credentialsSecretName"`
73+
Groups []string `json:"groups,omitempty"`
74+
Insecure bool `json:"insecure,omitempty"`
75+
LoginRealm string `json:"loginRealm,omitempty"`
76+
Realm string `json:"realm"`
7577
// +kubebuilder:validation:Enum=one;sub
7678
Scope SyncScope `json:"scope,omitempty"`
79+
URL string `json:"url"`
80+
}
81+
82+
// GitHubProvider represents integration with GitHub
83+
type GitHubProvider struct {
84+
CaSecretRef *SecretRef `json:"caSecretRef,omitempty"`
85+
CredentialsSecretName string `json:"credentialsSecretName"`
86+
Insecure bool `json:"insecure,omitempty"`
87+
Organization string `json:"organization,omitempty"`
88+
Teams []string `json:"teams,omitempty"`
89+
URL *string `json:"url,omitempty"`
90+
}
91+
92+
// SecretRef represents a reference to an item within a Secret
93+
type SecretRef struct {
94+
Name string `json:"name"`
95+
Key string `json:"key,omitempty"`
7796
}
7897

7998
func (s *GroupSync) GetReconcileStatus() status.Conditions {

0 commit comments

Comments
 (0)