CEL Support #495

alexsnaps · 2024-10-14T19:32:00Z

Fixes #475

guicassolato · 2024-10-15T13:27:16Z

install/rbac/role.yaml

+- apiGroups:
+  - operator.authorino.kuadrant.io
+  resources:
+  - authorinos


There's something wrong going on here. It's somehow bringing to the operand permissions that only belong to the operator.

Ah! Again... remember it happened to me already when I refactored the controller to v1beta2 🤔

Could you try and run it on your machine and push the changes to this branch please? I have no idea what's screwed up on my end 🤷

Done. 28e7fb9

❯ git st On branch cel Your branch is up to date with 'origin/cel'. nothing to commit, working tree clean ❯ make generate manifests go mod tidy go: downloading github.com/envoyproxy/go-control-plane v0.12.1-0.20240621013728-1eb8caab5155 go: downloading github.com/prometheus/client_golang v1.20.2 go: downloading github.com/open-policy-agent/opa v0.68.0 go: downloading google.golang.org/grpc v1.66.0 go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 go: downloading github.com/google/cel-go v0.21.0 go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 go: downloading github.com/klauspost/compress v1.17.9 go: downloading golang.org/x/time v0.6.0 go: downloading github.com/stoewer/go-strcase v1.2.0 go: downloading cloud.google.com/go/compute/metadata v0.3.0 go: downloading github.com/golang/glog v1.2.1 go: downloading golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d go: downloading cloud.google.com/go/compute v1.23.0 go: downloading cloud.google.com/go v0.34.0 go mod vendor controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..." /Library/Developer/CommandLineTools/usr/bin/make fmt vet go fmt ./... go vet ./... controller-gen crd:crdVersions=v1 rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=install/crd output:rbac:artifacts:config=install/rbac && /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/bin/kustomize build install > /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/install/manifests.yaml /Library/Developer/CommandLineTools/usr/bin/make patch-webhook envsubst \ < /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/install/manifests.yaml \ > /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/install/manifests.yaml.tmp && \ mv /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/install/manifests.yaml.tmp /Users/guilherme.cassolato/Workspace/go/src/github.com/kuadrant/authorino/install/manifests.yaml ❯ git st On branch cel Your branch is up to date with 'origin/cel'. Changes not staged for commit: (use "git add <file>..." to update what will be committed) (use "git restore <file>..." to discard changes in working directory) modified: install/manifests.yaml modified: install/rbac/role.yaml no changes added to commit (use "git add" and/or "git commit -a") ❯ grep "controller-gen@" Makefile $(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/[email protected]) ❯ ./bin/controller-gen --version Version: v0.15.0

alexsnaps · 2024-10-15T14:40:58Z

🤦 This should in v1beta3 ...
I think we still miss

Some "CEL enabled" HttpEndpointSpec.Url alternative
PlainIdentitySpec.CelExpression
Delete response.DynamicCEL
... and moving this to v1beta3

@guicassolato am I missing something else?

alexsnaps · 2024-10-15T14:42:59Z

pkg/evaluators/authorization/kubernetes_authz.go

-		return fmt.Sprintf("%s", value.ResolveFor(authJSON))
+	jsonValueToStr := func(value expressions.Value) (string, error) {
+		if value == nil {
+			return "", nil


Ugh... Now that it is a pointer, we could get nil indeed... I don't know whether all these cases are now covered, hard to tell what can or not be nil in those specs

guicassolato · 2024-10-16T08:18:29Z

api/v1beta1/zz_generated.deepcopy.go

@@ -1,5 +1,4 @@
 //go:build !ignore_autogenerated
-// +build !ignore_autogenerated


The // +build syntax has been deprecated since Go v1.17.

https://go.googlesource.com/proposal/+/master/design/draft-gobuild.md

guicassolato · 2024-10-16T08:23:52Z

api/v1beta3/auth_config_types.go

+// AuthConfig is the schema for Authorino's AuthConfig API
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion


Shall we remove it from v1beta2?

One and only one version must be marked as the storage version.

https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/#specify-multiple-versions

guicassolato · 2024-10-16T08:25:20Z

api/v1beta3/auth_config_conversion.go

+package v1beta3
+
+// Hub marks this version as a conversion hub.
+func (a *AuthConfig) Hub() {}


I don't know for sure how this works, but can we have 2 versions marked as conversion hub? I believe right now v1beta2 is also marked as hub, right?

Signed-off-by: Alex Snaps <[email protected]>

This reverts commit c3fa020. Signed-off-by: Alex Snaps <[email protected]>

Signed-off-by: Alex Snaps <[email protected]>

Signed-off-by: Guilherme Cassolato <[email protected]>

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps · 2024-10-22T11:16:16Z

@KevFan could you have a look at this wrt the v1beta3 changes... my environment is acting up on these generated changes... 🙏

KevFan · 2024-10-22T11:40:03Z

@alexsnaps Sure, I'll take a look 👀

Signed-off-by: KevFan <[email protected]>

KevFan · 2024-10-22T13:22:45Z

@alexsnaps when running make manifests generate, I got a diff compared to yours. I've a PR at #499 to merge to this PR if you want to merge it into this or take the changes or if you want me to push directly to this PR 🤔 Whichever works best for you anyway 👍

KevFan · 2024-10-22T13:36:44Z

tests/v1beta3/authconfig.yaml

-    - selector: context.request.http.path
-      operator: matches
-      value: ^/admin(/.*)?$
+    - predicate: request.http.path.matches("^/admin(/.*)?$")


Out of curiosity, are these changes still WIP for this file? 🤔
Just wondering cause running make e2e is erroring due to invalid AuthConfig with this since it's not expecting predicate currently:

authorino/api/v1beta3/auth_config_types.go

Line 118 in 3925889

NamedPatterns map[string]PatternExpressions `json:"patterns,omitempty"`

authorino/api/v1beta3/auth_config_types.go

Lines 152 to 165 in 3925889

type PatternExpressions []PatternExpression

type PatternExpression struct {

// Path selector to fetch content from the authorization JSON (e.g. 'request.method').

// Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used.

// Authorino custom JSON path modifiers are also supported.

Selector string `json:"selector,omitempty"`

// The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value".

// Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex)

Operator PatternExpressionOperator `json:"operator,omitempty"`

// The value of reference for the comparison with the content fetched from the authorization JSON.

// If used with the "matches" operator, the value must compile to a valid Golang regex.

Value string `json:"value,omitempty"`

}

Error from server (BadRequest): error when creating "/Users/chfan/dev/authorino/tests/v1beta3/authconfig.yaml": AuthConfig in version "v1beta3" cannot be handled as a AuthConfig: strict decoding error: unknown field "spec.patterns.admin-path[0].predicate", unknown field "spec.patterns.resource-path[0].predicate" waiting authconfig readyError from server (NotFound): authconfigs.authorino.kuadrant.io "e2e-test" not found .Error from server (NotFound): authconfigs.authorino.kuadrant.io "e2e-test" not found

And also, failing on the oneOf validations such as:

authorino/install/crd/patches/oneof_in_authconfigs.yaml

Lines 305 to 321 in 3925889

- op: add

path: /spec/versions/1/schema/openAPIV3Schema/properties/spec/properties/authorization/additionalProperties/properties/patternMatching/properties/patterns/items/oneOf

value:

- properties:

patternRef: {}

required: [patternRef]

- properties:

operator: {}

selector: {}

value: {}

required: [operator, selector]

- properties:

all: {}

required: [all]

- properties:

any: {}

required: [any]

The AuthConfig "e2e-test" is invalid: * <nil>: Invalid value: "": "spec.response.success.headers.wristband.when[0]" must validate one and only one schema (oneOf). Found none valid * spec.response.success.headers.wristband.when[0].patternRef: Required value * <nil>: Invalid value: "": "spec.authentication.anonymous.when[0]" must validate one and only one schema (oneOf). Found none valid * spec.authentication.anonymous.when[0].patternRef: Required value * <nil>: Invalid value: "": "spec.authentication.anonymous.when[1]" must validate one and only one schema (oneOf). Found none valid * spec.authentication.anonymous.when[1].patternRef: Required value * <nil>: Invalid value: "": "spec.authorization.admin-kubernetes-rbac.when[1]" must validate one and only one schema (oneOf). Found none valid * spec.authorization.admin-kubernetes-rbac.when[1].patternRef: Required value * <nil>: Invalid value: "": "spec.authorization.admin-jwt-rbac.when[1]" must validate one and only one schema (oneOf). Found none valid * spec.authorization.admin-jwt-rbac.when[1].patternRef: Required value * <nil>: Invalid value: "": "spec.authorization.admin-jwt-rbac.patternMatching.patterns[0]" must validate one and only one schema (oneOf). Found none valid * spec.authorization.admin-jwt-rbac.patternMatching.patterns[0].patternRef: Required value waiting authconfig readyError from server (NotFound): authconfigs.authorino.kuadrant.io "e2e-test" not found

Darn, looks like I screwed up my rebasing then 🤦

Actually... no! I made this fail on purpose, I need @guicassolato 's opinion here... cause adding CEL there is either recursive or a breaking change, or needs another NamedCelExpression mechanism, or...

So, I'm thinking of adding a celFunctions at the same level as

NamedPatterns map[string]PatternExpressions `json:"patterns,omitempty"`

Same "pattern", but map[string]CelExpression that then register the key as a fn() in cel. So that:

celFunctions: userGroup: request.headers['someHeader']

become usable in a cel expression:

expression: userGroup().startWith("admin")

If we think that makes sense, I'd add this in a subsequent PR tho and "just get rid of NamedPatterns equivalence for Cel for now... wdyt?

manifests: generate v1beta3 changes

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps force-pushed the cel branch 2 times, most recently from fc65fbc to dc50681 Compare October 14, 2024 20:05

alexsnaps changed the title ~~First seam: DynamicCEL~~ CEL Support Oct 14, 2024

alexsnaps force-pushed the cel branch 3 times, most recently from 00949f1 to 7f17d95 Compare October 15, 2024 11:19

guicassolato reviewed Oct 15, 2024

View reviewed changes

alexsnaps force-pushed the cel branch from 6147481 to 5a229aa Compare October 15, 2024 14:29

alexsnaps commented Oct 15, 2024

View reviewed changes

alexsnaps force-pushed the cel branch 2 times, most recently from 901996d to 067f83d Compare October 15, 2024 15:35

alexsnaps requested a review from guicassolato October 15, 2024 17:06

alexsnaps marked this pull request as ready for review October 15, 2024 17:06

alexsnaps force-pushed the cel branch from b0b2967 to 41caa3b Compare October 15, 2024 17:18

guicassolato reviewed Oct 16, 2024

View reviewed changes

alexsnaps force-pushed the cel branch 2 times, most recently from dc2777a to a25343f Compare October 18, 2024 12:06

alexsnaps added 10 commits October 18, 2024 16:37

First seam: DynamicCEL

3d79881

Signed-off-by: Alex Snaps <[email protected]>

Refactored Cel into own pkg, removed CelResponse

79882b3

Signed-off-by: Alex Snaps <[email protected]>

Adding the new seams

95d3bfa

Signed-off-by: Alex Snaps <[email protected]>

Cel Predicates

e138990

Signed-off-by: Alex Snaps <[email protected]>

Add context to Cel's context

6087b3c

Signed-off-by: Alex Snaps <[email protected]>

Cel Expressions

e469c17

Signed-off-by: Alex Snaps <[email protected]>

Abstracted expressions.Value away somewhat

d6dc884

Signed-off-by: Alex Snaps <[email protected]>

Fix imports

cd1b510

Signed-off-by: Alex Snaps <[email protected]>

Wired cel.Expression in the AuthConfig

5431fed

Signed-off-by: Alex Snaps <[email protected]>

Fix imports

69d0613

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps and others added 9 commits October 18, 2024 16:37

Deal with nil expression.Value as ""

d946f1b

Signed-off-by: Alex Snaps <[email protected]>

v1beta3 API

ca31308

This reverts commit c3fa020. Signed-off-by: Alex Snaps <[email protected]>

HttpEndpointSpec.DynamicUrl

af463e7

Signed-off-by: Alex Snaps <[email protected]>

Facilitate StringValue, mimics expressions.Value

c1c2418

Signed-off-by: Alex Snaps <[email protected]>

PlainIdentitySpec.Value

90201ce

Signed-off-by: Alex Snaps <[email protected]>

Deleted response.DynamicCEL

c9580a4

Signed-off-by: Alex Snaps <[email protected]>

remove unrelated rbac from the manifests

bd7b2fc

Signed-off-by: Guilherme Cassolato <[email protected]>

Bind all well known attributes, no 'context' anymore

686fb5d

Signed-off-by: Alex Snaps <[email protected]>

Update examples

3925889

Signed-off-by: Alex Snaps <[email protected]>

alexsnaps force-pushed the cel branch from a4a4236 to 3925889 Compare October 18, 2024 20:37

KevFan added 2 commits October 22, 2024 13:41

makefile: use project bin controller-gen & bump kustomize

9e7168e

Signed-off-by: KevFan <[email protected]>

manifests: generate v1beta3 changes

9fce964

Signed-off-by: KevFan <[email protected]>

alexsnaps mentioned this pull request Oct 22, 2024

RateLimitPolicy v1beta4 Kuadrant/kuadrant-operator#951

Open

KevFan reviewed Oct 22, 2024

View reviewed changes

alexsnaps added 3 commits October 23, 2024 08:24

Merge pull request #499 from KevFan/cel-v1beta3-generate

6144d78

manifests: generate v1beta3 changes

Fix update examples

4cad931

Signed-off-by: Alex Snaps <[email protected]>

Use beta3 in e2e

7ab0532

Signed-off-by: Alex Snaps <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CEL Support #495

CEL Support #495

alexsnaps commented Oct 14, 2024 •

edited

Loading

guicassolato Oct 15, 2024

alexsnaps Oct 15, 2024

alexsnaps Oct 15, 2024

guicassolato Oct 16, 2024

alexsnaps commented Oct 15, 2024 •

edited

Loading

alexsnaps Oct 15, 2024

guicassolato Oct 16, 2024

guicassolato Oct 16, 2024

guicassolato Oct 16, 2024 •

edited

Loading

guicassolato Oct 16, 2024

alexsnaps commented Oct 22, 2024

KevFan commented Oct 22, 2024

KevFan commented Oct 22, 2024

KevFan Oct 22, 2024

alexsnaps Oct 22, 2024

alexsnaps Oct 22, 2024

alexsnaps Oct 22, 2024 •

edited

Loading

		@@ -1,5 +1,4 @@
		//go:build !ignore_autogenerated
		// +build !ignore_autogenerated

	type PatternExpressions []PatternExpression

	type PatternExpression struct {
	// Path selector to fetch content from the authorization JSON (e.g. 'request.method').
	// Any pattern supported by https://pkg.go.dev/github.com/tidwall/gjson can be used.
	// Authorino custom JSON path modifiers are also supported.
	Selector string `json:"selector,omitempty"`
	// The binary operator to be applied to the content fetched from the authorization JSON, for comparison with "value".
	// Possible values are: "eq" (equal to), "neq" (not equal to), "incl" (includes; for arrays), "excl" (excludes; for arrays), "matches" (regex)
	Operator PatternExpressionOperator `json:"operator,omitempty"`
	// The value of reference for the comparison with the content fetched from the authorization JSON.
	// If used with the "matches" operator, the value must compile to a valid Golang regex.
	Value string `json:"value,omitempty"`
	}

	- op: add
	path: /spec/versions/1/schema/openAPIV3Schema/properties/spec/properties/authorization/additionalProperties/properties/patternMatching/properties/patterns/items/oneOf
	value:
	- properties:
	patternRef: {}
	required: [patternRef]
	- properties:
	operator: {}
	selector: {}
	value: {}
	required: [operator, selector]
	- properties:
	all: {}
	required: [all]
	- properties:
	any: {}
	required: [any]

CEL Support #495

Are you sure you want to change the base?

CEL Support #495

Conversation

alexsnaps commented Oct 14, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alexsnaps commented Oct 15, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

guicassolato Oct 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alexsnaps commented Oct 22, 2024

KevFan commented Oct 22, 2024

KevFan commented Oct 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alexsnaps Oct 22, 2024 • edited Loading

Choose a reason for hiding this comment

alexsnaps commented Oct 14, 2024 •

edited

Loading

alexsnaps commented Oct 15, 2024 •

edited

Loading

guicassolato Oct 16, 2024 •

edited

Loading

alexsnaps Oct 22, 2024 •

edited

Loading