Repository navigation
Add namespace-scoped Kubernetes configuration and generated CRDs - #5
Merged
Merged
Conversation
Read Upstream and Relay custom resources and referenced Secrets from one namespace, with watch-driven updates and complete validated snapshots. Generate structural CRDs from shared Rust types and validate them in CI against a disposable Kubernetes API server. Require jwksUrl for PrivateKeyJwt URL sources and typed jwks for inline keys so both forms have structural schemas. File and SSM accept optional namespace metadata without changing resource identities.
Keep the installable CRD bundle under deploy/ and point generation, CI drift checks, and Kubernetes integration tests at that artifact.
There was a problem hiding this comment.
🔵 Needs a closer look
It is a large, security-sensitive change (namespace RBAC, secret resolution, auth key material, a breaking PrivateKeyJwt config change) introducing a new crate and generated CRD/schema artifacts that cannot be fully verified without the toolchain, so it warrants final human review.
Pull request overview
This PR adds a namespace-scoped Kubernetes configuration provider to oauthrelay. It introduces a new oauthrelay-provider-kubernetes crate that watches Upstream/Relay custom resources and Secret metadata in one namespace, resolves secretKeyRef values, and publishes complete validated snapshots (retaining the last valid config on failure). It also generates installable, structural CRDs from shared Rust types via a new oauthrelay crds command, and reworks PrivateKeyJwt to use typed inline jwks (RSA/EC/OKP) or a separate jwksUrl.
Changes:
- New read-only, single-namespace Kubernetes provider (
OAUTHRELAY_PROVIDER_KUBERNETES=true) with watches, periodic refresh, andsecretKeyRefresolution; precedence File → SSM → Kubernetes. - Typed public JWKS model (
PublicJwkSet/PublicJwk) replacing the untypedjwksvalue;PrivateKeyJwtnow requires exactly one ofjwks(inline) orjwksUrl(breaking change, documented). - Generated namespaced CRD bundle plus CI checks (
crds:check, disposable Kind harness), RBAC/deployment example, and provider documentation.
File summaries
| File | Description |
|---|---|
| crates/oauthrelay-provider-kubernetes/src/lib.rs | New provider: CR discovery, watches, store, secret resolution, CRD YAML |
| crates/oauthrelay-provider-kubernetes/src/schema.rs | Converts serde union schemas into structural OpenAPI for CRDs |
| crates/oauthrelay-provider-kubernetes/src/tests.rs | Mock-based unit tests for reads, watches, refresh, RBAC errors |
| crates/oauthrelay-provider-kubernetes/tests/kubernetes.rs | Integration test against a Kind cluster (validation, isolation, rotation) |
| crates/oauthrelay-provider-kubernetes/Cargo.toml | New crate manifest and dependencies |
| crates/oauthrelay-core/src/jwks.rs | New typed public JWK/JWKS model |
| crates/oauthrelay-core/src/config.rs | jwks/jwksUrl split, Metadata.namespace, SecretKeyRef, redacted secret Debug, tests |
| crates/oauthrelay-core/src/lib.rs | Exposes the new jwks module |
| crates/oauthrelay-secret-resolver/src/lib.rs | Adds Kubernetes secret resolution dispatch |
| crates/oauthrelay-provider-ssm/src/lib.rs | Treats SecretKeyRef as a non-AWS source |
| crates/oauthrelay/src/main.rs | Adds crds command and Kubernetes provider wiring |
| crates/oauthrelay/Cargo.toml | Adds default kubernetes feature and deps |
| Cargo.toml / Cargo.lock | Adds kube/k8s-openapi/serde-saphyr; MSRV bump to 1.89 |
| docs/public/oauthrelay.crds.yaml | Generated CRD bundle |
| docs/public/oauthrelay.schema.json | Regenerated JSON schema |
| docs/* , README.md, SPEC.md | Kubernetes provider docs and reference updates |
| deploy/kubernetes.yaml | Read-only RBAC + Deployment/Service example |
| mise.toml, .github/workflows/ci.yml, tests/kubernetes/run.py | CRD checks and Kind-based CI harness |
Review details
- Files reviewed: 25/26 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Allow oauthrelay to consume
UpstreamandRelayKubernetes custom resources from one configurable namespace, defaulting to the pod namespace in-cluster. CR and Secret metadata watches trigger complete validated snapshots; failed updates retain the last valid configuration. Enable discovery withOAUTHRELAY_PROVIDER_KUBERNETES=true.secretKeyRefvalues alongside the existing inline, environment, file, and AWS sources. Periodic refresh handles sources without Kubernetes events.oauthrelay crds. Commit the generated bundle, check regeneration in CI, and validate schemas and provider behavior against Kubernetes 1.35.metadata.namespacewithout changing resource identities or URL keys.Compatibility: PrivateKeyJwt URL sources must use
jwksUrl;jwksaccepts typed inline RSA, EC, or OKP public keys. This replaces URL strings underjwksacross all providers. The default build includes the Kubernetes feature, and the declared Rust minimum is 1.89.Test plan
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.