[WIP] Add mTLS and OAuth authentication to PTP event publisher #632
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
openshift-ci
bot
added
the
do-not-merge/work-in-progress
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jzding The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
jzding
force-pushed
the
secure-event-api
branch
10 times, most recently
from
879a50d to
eba393b
Compare
jzding
changed the title
jzding
changed the title
jzding
changed the title
jzding
force-pushed
the
secure-event-api
branch
2 times, most recently
from
61e93bb to
27d2464
Compare
jzding
changed the title
jzding
force-pushed
the
secure-event-api
branch
3 times, most recently
from
be11cf0 to
35140a3
Compare
This commit introduces comprehensive authentication support for the PTP event publisher,
enabling secure communication between PTP daemons and event consumers in production
OpenShift environments.
**Authentication Infrastructure:**
- mTLS (Mutual TLS) authentication with Service CA integration
- OAuth JWT token authentication with OpenShift OAuth server support
- Dynamic cluster configuration via CLUSTER_NAME environment variable
- Automated certificate management using OpenShift Service CA
**Core Implementation:**
- `controllers/ptpoperatorconfig_controller.go`: Enhanced controller with authentication resource management
- `bindata/linuxptp/auth-config.yaml`: Complete authentication configuration template (77 lines)
- `bindata/linuxptp/ptp-daemon.yaml`: Enhanced DaemonSet with authentication support
- `bindata/linuxptp/README.md`: Comprehensive authentication setup guide (288 lines)
**OpenShift Service CA Integration:**
- Automatic certificate generation via Service CA annotations
- CA bundle injection for trust establishment
- Per-node and global certificate management
- Zero-configuration certificate rotation
**ConfigMaps:**
- `cluster-info`: Dynamic cluster name configuration with {{.ClusterName}} templating
- `ptp-event-publisher-ca-bundle`: Service CA bundle injection for trust establishment
- `ptp-event-publisher-auth`: Complete authentication configuration for cloud-event-proxy
**Services for Certificate Generation:**
- `cloud-event-proxy-ca`: CA certificate generation service
- `ptp-event-publisher-service-{{.NodeName}}`: Per-node certificate generation
- Automatic TLS secret creation via Service CA annotations
**Cloud-Event-Proxy Container:**
- Added `--auth-config` flag for authentication configuration
- Mounted authentication ConfigMaps and TLS secrets
- Enhanced health check with HTTPS and certificate validation
- Dynamic cluster name support via template variables
**Volume Mounts:**
- `ptp-event-publisher-auth`: Authentication configuration
- `ca-bundle`: Service CA certificate bundle
- `server-certs`: Server TLS certificates for mTLS
**Template Data:**
- Added `ClusterName` template variable for dynamic cluster configuration
- Environment-based cluster name resolution with fallback to "openshift.local"
- Template processing for authentication resources
**Resource Management:**
- Automatic authentication resource creation when `EnableEventPublisher` is true
- Per-node authentication resource deployment
- Integration with existing PTP configuration workflow
**CLUSTER_NAME Support:**
- `config/manager/env.yaml`: Default cluster name configuration
- `config/manager/manager.yaml`: Environment variable template
- `bundle/manifests/ptp-operator.clusterserviceversion.yaml`: OLM integration
- `manifests/stable/ptp-operator.clusterserviceversion.yaml`: Stable release support
**Comprehensive Setup Guide:**
- `bindata/linuxptp/README.md`: Complete authentication configuration guide (288 lines)
- OpenShift Service CA setup instructions
- Certificate management and troubleshooting
- OAuth server configuration examples
- Dynamic cluster name configuration
**Updated Main Documentation:**
- `README.md`: Enhanced with authentication overview and setup instructions
- Integration with existing PTP operator documentation
- Links to detailed authentication guides
**OpenShift Integration:**
- Native Service CA certificate management
- OpenShift OAuth server integration
- ServiceAccount-based authentication
- Secure inter-pod communication
**Certificate Management:**
- Automatic certificate generation and rotation
- Per-node certificate isolation
- CA bundle distribution and trust establishment
- TLS configuration for secure communication
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: ptp-event-publisher-auth
namespace: openshift-ptp
data:
config.json: |
{
"enableMTLS": true,
"useServiceCA": true,
"caCertPath": "/etc/cloud-event-proxy/ca-bundle/service-ca.crt",
"serverCertPath": "/etc/cloud-event-proxy/server-certs/tls.crt",
"serverKeyPath": "/etc/cloud-event-proxy/server-certs/tls.key",
"enableOAuth": true,
"useOpenShiftOAuth": true,
"oauthIssuer": "https://oauth-openshift.apps.{{.ClusterName}}",
"oauthJWKSURL": "https://oauth-openshift.apps.{{.ClusterName}}/oauth/jwks",
"requiredScopes": ["user:info"],
"requiredAudience": "openshift"
}
```
**Automatic Activation:**
- Authentication resources created automatically when `EnableEventPublisher: true`
- No additional configuration required for basic setup
- Seamless integration with existing PTP operator workflow
**Multi-Cluster Support:**
- Dynamic cluster name configuration via environment variables
- Template-based OAuth URL generation
- Flexible deployment across different OpenShift environments
- Authentication is automatically enabled with event publishing
- No breaking changes to existing PTP operator functionality
- Graceful handling of authentication configuration
- Clear error messages for configuration issues
- Comprehensive authentication resource validation
- Template rendering verification
- OpenShift Service CA integration testing
- Multi-node deployment validation
This implementation provides enterprise-grade security for PTP event publishing while
maintaining seamless integration with OpenShift's native security infrastructure.
The authentication system automatically configures secure communication between PTP
daemons and event consumers without requiring manual certificate management.
Resolves authentication requirements for secure PTP event publishing in production
OpenShift environments with support for dynamic cluster configuration and automated
certificate lifecycle management.
Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
force-pushed
the
secure-event-api
branch
from
35140a3 to
40dbdc5
Compare
Contributor
|
@jzding: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
|
Issues go stale after 90d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle stale |
openshift-ci
bot
added
the
lifecycle/stale
openshift-merge-robot
added
the
needs-rebase
Contributor
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Assisted by Cursor AI
This PR introduces enterprise-grade authentication support for the PTP event publisher, enabling secure communication between PTP daemons and event consumers in production OpenShift environments.
🚀 Key Features
Authentication Methods
OpenShift Service CA Integration
🏗️ Architecture Overview
Authentication Resources
bindata/linuxptp/auth-config.yaml- Complete authentication configuration template (77 lines)Enhanced PTP Daemon
bindata/linuxptp/ptp-daemon.yaml- Enhanced DaemonSet with authentication support--auth-configflag and certificate mounts📦 Operator Controller Integration
Enhanced Controller Logic
controllers/ptpoperatorconfig_controller.go- Authentication resource management (31+ lines added)ClusterNamevariable for dynamic configurationEnableEventPublisher: trueEnvironment Configuration
config/manager/env.yaml- DefaultCLUSTER_NAMEconfigurationconfig/manager/manager.yaml- Environment variable templating🔧 Dynamic Cluster Configuration
Environment-Based Setup
Template Processing
📚 Comprehensive Documentation
Setup Guide
bindata/linuxptp/README.md- Complete authentication setup guide (288 lines)Updated Main Documentation
README.md- Authentication overview and integration guide (79+ lines added)🛡️ Security Features
Certificate-Based Authentication
OAuth Integration
🔄 Resource Management
Automatic Resource Creation
Template Variables
{{.ClusterName}}- Dynamic cluster name substitution{{.NodeName}}- Per-node resource namingCLUSTER_NAMEenvironment variable support🚀 Deployment Integration
Automatic Activation
EnableEventPublisher: trueMulti-Environment Support
openshift.localcluster name📊 Impact
🎯 Use Cases
This authentication system enables:
🧪 Testing and Validation
The implementation includes:
🔄 Backward Compatibility