outposts: support json patch for Kubernetes by ChandonPierre · Pull Request #6319 · goauthentik/authentik

ChandonPierre · 2023-07-20T19:45:54Z

Details

Does this resolve an issue?
Resolves Support customizing kubernetes objects created by managed outposts #5908

Changes

New Features

Adds support to apply an RFC 6902 compliant JSON patch to Kubernetes outpost deployments via kubernetes_json_patch outpost config option.
Provides the ability to override the refrence deployment spec with nodeAffinity, tolerations, resources, etc
Changes to the JSON patch are reconciled, since a provided patch is compared against the current V1Deployment spec

Breaking Changes

Adds breaking change which causes <issue>.

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)
The translation files have been updated (make i18n-extract)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

netlify · 2023-07-20T19:46:02Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`6fd8c50`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/64bb1cc3955fb30008f78b68
😎 Deploy Preview	https://deploy-preview-6319--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2023-07-20T19:47:37Z

✅ Deploy Preview for authentik ready!

Name	Link
🔨 Latest commit	`6fd8c50`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik/deploys/64bb1cc350bbcf00081cb253
😎 Deploy Preview	https://deploy-preview-6319--authentik.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

codecov · 2023-07-20T19:52:52Z

Codecov Report

Patch coverage: 82.26% and no project coverage change.

Comparison is base (a728dad) 92.50% compared to head (6fd8c50) 92.50%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6319      +/-   ##
==========================================
- Coverage   92.50%   92.50%   -0.00%     
==========================================
  Files         560      560              
  Lines       26939    26993      +54     
==========================================
+ Hits        24917    24966      +49     
- Misses       2022     2027       +5

Flag	Coverage Δ
e2e	`51.63% <40.33%> (+0.01%)`	⬆️
integration	`26.53% <82.26%> (+0.11%)`	⬆️
unit	`89.29% <40.33%> (-0.09%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...entik/providers/proxy/controllers/k8s/traefik_3.py	`79.72% <66.67%> (-0.59%)`	⬇️
authentik/outposts/controllers/k8s/base.py	`83.74% <70.59%> (-5.27%)`	⬇️
authentik/outposts/controllers/k8s/deployment.py	`97.78% <100.00%> (+0.16%)`	⬆️
authentik/outposts/controllers/k8s/secret.py	`96.78% <100.00%> (+0.35%)`	⬆️
authentik/outposts/controllers/k8s/service.py	`97.23% <100.00%> (+0.26%)`	⬆️
...hentik/outposts/controllers/k8s/service_monitor.py	`90.91% <100.00%> (+0.53%)`	⬆️
authentik/outposts/controllers/kubernetes.py	`82.83% <100.00%> (ø)`
authentik/outposts/models.py	`88.62% <100.00%> (+0.05%)`	⬆️
...thentik/providers/proxy/controllers/k8s/ingress.py	`90.81% <100.00%> (+0.33%)`	⬆️
...thentik/providers/proxy/controllers/k8s/traefik.py	`78.58% <100.00%> (+2.58%)`	⬆️
... and 1 more

... and 2 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

BeryJu · 2023-07-21T11:02:51Z

@ChandonPierre thanks for the PR! I made quite a few changes with b0617d0 (what was supposed to be a small commit), lmk if you'd change anything about that commit

ChandonPierre · 2023-07-21T14:09:59Z

@ChandonPierre thanks for the PR! I made quite a few changes with b0617d0 (what was supposed to be a small commit), lmk if you'd change anything about that commit

The overall structure makes sense - I prefer this approach - Thanks for the refactor!

I think there were some regressions introduced (tests are failing) I will try to look into it

test patch on create and update

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

this was supposed to be a small change but turned out to rework quite a few things basically use the same keys as `kubernetes_disabled_components` to allow patches for all kinds of different objects, since people might want to patch the service or secret or something else, idk also moves all of the patching logic to the base reconciler Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* main: web/admin: hide pagination when no data is loaded yet (#6353) web/admin: adjust style of page header (#6355) root: set csrf cookie's secure flag same as session (#6350) outposts: Fix infinite self-recursion in traefik reconciler. (#6336) outposts: fix patch processing (#6338) web: bump API Client version (#6351) Updates for file web/xliff/en.xlf in zh_CN on branch main (#6340) Updates for file web/xliff/en.xlf in zh-Hans on branch main (#6341) enterprise: fix license check not using DER as spec specifies (#6348) core: bump goauthentik.io/api/v3 from 3.2023061.3 to 3.2023061.4 (#6342) core: bump drf-spectacular from 0.26.3 to 0.26.4 (#6343) core: bump ruff from 0.0.278 to 0.0.280 (#6344) website: bump postcss from 8.4.26 to 8.4.27 in /website (#6345) web: bump @esbuild/linux-arm64 from 0.18.15 to 0.18.16 in /web (#6347) web: bump @esbuild/darwin-arm64 from 0.18.15 to 0.18.16 in /web (#6346) outposts: support json patch for Kubernetes (#6319) providers/oauth2: fix grant_type password raising an exception (#6333) web: bump API Client version (#6331) enterprise: cleanup v2 (#6330) web: bump prettier from 2.8.8 to 3.0.0 in /web (#6329)

los93sol · 2023-11-17T20:47:27Z

Is there an example of using this in the web ui anywhere? I've been trying to get it to work but cannot seem to get any patches to apply

ChandonPierre · 2023-11-17T20:54:24Z

Is there an example of using this in the web ui anywhere? I've been trying to get it to work but cannot seem to get any patches to apply

here's a snippet I just copied from my web ui

check the worker container logs if it's not applying

object_naming_template: auth-outpost-%(name)s
authentik_host_insecure: false
kubernetes_json_patches:
  deployment:
    - op: add
      path: /spec/template/spec/containers/0/resources
      value:
        limits:
          cpu: 4000m
          memory: 8Gi
        requests:
          cpu: 1000m
          memory: 1Gi

los93sol · 2023-11-17T20:59:40Z

Thanks, that appears to work, is it possible to patch the service though? It seems to just not create the service when I do anything to it in the patches

ChandonPierre · 2023-11-17T21:11:26Z

Thanks, that appears to work, is it possible to patch the service though? It seems to just not create the service when I do anything to it in the patches

It should work, it's possible the patched spec is getting rejected by the api server - the worker container logs should reflect this

los93sol · 2023-11-17T21:19:46Z

Wierd, I'm trying to use this...

kubernetes_json_patches:
service:
- op: add
path: /spec
value:
loadBalancerIP: 192.168.80.101

and it isn't showing anything in the logs on either the worker or server, but the service never gets created when I reference it that way

ChandonPierre · 2023-11-17T21:36:53Z

Wierd, I'm trying to use this...

kubernetes_json_patches: service: - op: add path: /spec value: loadBalancerIP: 192.168.80.101

and it isn't showing anything in the logs on either the worker or server, but the service never gets created when I reference it that way

Outpost is ClusterIP by default; are you changing the type to LoadBalancer as well?

los93sol · 2023-11-17T21:40:26Z

Yes, I changed it to LoadBalancer and am attempting to configure the metallb annotation to allow sharing of the ip, but so far no luck getting the patch to apply

los93sol · 2023-11-17T21:46:55Z

kubernetes_json_patches:
service:
- op: add
path: /metadata/annotations/loadBalancerIPs
value: 192.168.80.101

Here's another attempt that seems to fail to create it, but I still am not seeing anything in the logs

This shall rather be configured using `kubernetes_json_patch` introduced with goauthentik#6319

* Allow specifying the service's ipFamilyPolicy and ipFamilies * Add documentation * Only create k8s TLS Ingress config if secretName is set * Fix linter issues. * Fix wrong attributes * Remove IP family configuration option This shall rather be configured using `kubernetes_json_patch` introduced with #6319 * Add test for k8s service reconciler * Fix linter issues

ChandonPierre requested a review from a team as a code owner July 20, 2023 19:45

ChandonPierre requested review from rissson and removed request for a team July 20, 2023 19:45

ChandonPierre mentioned this pull request Jul 20, 2023

outposts: configurable k8s affinity, tolerations, resources #5938

Closed

7 tasks

ChandonPierre force-pushed the cpierre/jsonpatch branch 2 times, most recently from d04bbb6 to 2c3c4af Compare July 21, 2023 03:49

ChandonPierre mentioned this pull request Jul 21, 2023

feat: add tolerations, affinity, resources to ldap provider outpost coreweave/authentik-helm#5

Merged

ChandonPierre and others added 6 commits July 22, 2023 02:02

outposts: support json patch for Kubernetes

3f356ec

docs: minor correction

a8baa1c

tests: simplify, more coverage

1d92996

test patch on create and update

minor style cleanups

fcb61ad

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix error due to property being called on class without instance

6fd8c50

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu force-pushed the cpierre/jsonpatch branch from a8aac5e to 6fd8c50 Compare July 22, 2023 00:03

BeryJu approved these changes Jul 22, 2023

View reviewed changes

BeryJu merged commit d435a65 into goauthentik:main Jul 22, 2023

ChandonPierre deleted the cpierre/jsonpatch branch July 23, 2023 15:10

ChandonPierre mentioned this pull request Jul 23, 2023

outposts: fix patch processing #6338

Merged

7 tasks

BeryJu mentioned this pull request Jul 25, 2023

Add support for nodeSelector, labels & annotations for Kubernetes-based outposts. #3910

Closed

PKizzle added a commit to PKizzle/authentik that referenced this pull request Nov 29, 2023

Remove IP family configuration option

27922b6

This shall rather be configured using `kubernetes_json_patch` introduced with goauthentik#6319

BeryJu mentioned this pull request Apr 18, 2024

allow to customize outposts ingress path #4039

Closed

Uh oh!

Conversation

ChandonPierre commented Jul 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Changes

New Features

Breaking Changes

Checklist

Uh oh!

netlify bot commented Jul 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented Jul 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik ready!

Uh oh!

codecov bot commented Jul 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

BeryJu commented Jul 21, 2023

Uh oh!

ChandonPierre commented Jul 21, 2023

Uh oh!

los93sol commented Nov 17, 2023

Uh oh!

ChandonPierre commented Nov 17, 2023

Uh oh!

los93sol commented Nov 17, 2023

Uh oh!

ChandonPierre commented Nov 17, 2023

Uh oh!

los93sol commented Nov 17, 2023

Uh oh!

ChandonPierre commented Nov 17, 2023

Uh oh!

los93sol commented Nov 17, 2023

Uh oh!

los93sol commented Nov 17, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ChandonPierre commented Jul 20, 2023 •

edited

Loading

netlify bot commented Jul 20, 2023 •

edited

Loading

netlify bot commented Jul 20, 2023 •

edited

Loading

codecov bot commented Jul 20, 2023 •

edited

Loading