Add kubebuilder validations in proto for extauth AuthConfig

changelog/v1.18.0-beta1/authconfig-cel-rules.yaml

@@ -0,0 +1,6 @@
+changelog:
+  - type: NEW_FEATURE
+    issueLink: https://github.com/solo-io/gloo-mesh-enterprise/issues/16010
+    description: |
+      Adds pre-admission [validation rules](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules) to the `AuthConfig` CRD.
+    resolvesIssue: false

generate.go

@@ -75,6 +75,7 @@ func main() {
 				"gloo.solo.io.HybridListener",
 				"gloo.solo.io.AggregateListener",
 			},
+			DisableKubeMarkers: true,
 		},
 	}
 	if err := cmd.Generate(generateOptions); err != nil {

go.mod

@@ -51,14 +51,14 @@ require (
 	github.com/solo-io/go-utils v0.24.8
 	github.com/solo-io/k8s-utils v0.7.2
 	github.com/solo-io/protoc-gen-ext v0.0.18
-	github.com/solo-io/protoc-gen-openapi v0.2.2
+	github.com/solo-io/protoc-gen-openapi v0.2.4
 	github.com/solo-io/skv2 v0.39.1
 
 	// Pinned to the `sa-k8s-1.29-bump` tag of solo-apis on `gloo-main` branch
 	// Ref: https://github.com/solo-io/gloo/pull/9463/files#r1594409655 && https://solo-io-corp.slack.com/archives/C03MFATU265/p1716913420716729?thread_ts=1716476992.938679&cid=C03MFATU265
 	// as to why it is now based off `gloo-main` and not `gloo-repo-branch`
 	github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9
-	github.com/solo-io/solo-kit v0.35.0
+	github.com/solo-io/solo-kit v0.35.3
 	github.com/spf13/afero v1.9.2
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5

go.sum

@@ -2028,14 +2028,14 @@ github.com/solo-io/k8s-utils v0.7.2 h1:pIRiTOpwymdCHUOSjzKDi/Ay16FNtF7JV7NIRlC2Z
 github.com/solo-io/k8s-utils v0.7.2/go.mod h1:RrT6PVTSD1X0vteKCQmGzoAAfjI1U5oV/wA+T3T+NoM=
 github.com/solo-io/protoc-gen-ext v0.0.18 h1:zSAL8NzWpJUGYoA5IyjHiKASNyHjR0uxBQ7eQS94i3A=
 github.com/solo-io/protoc-gen-ext v0.0.18/go.mod h1:iGyCvmKmhJNXs5MgBcYFBF0om7LDnCVD2WwhOZGnqeA=
-github.com/solo-io/protoc-gen-openapi v0.2.2 h1:OzyOAxiZuMAaLYWMNoTl2v9E7IXcl7UEeiTeCSwvCJ0=
-github.com/solo-io/protoc-gen-openapi v0.2.2/go.mod h1:osEjRl1miHqlq4Wl/8SEqHFoyydptPL1EzEdM9c4vfE=
+github.com/solo-io/protoc-gen-openapi v0.2.4 h1:9tqGhCAq83IRSzHhKDzpWnPlbPPORTM2izVxjLk0Ftw=
+github.com/solo-io/protoc-gen-openapi v0.2.4/go.mod h1:osEjRl1miHqlq4Wl/8SEqHFoyydptPL1EzEdM9c4vfE=
 github.com/solo-io/skv2 v0.39.1 h1:dWaZTWgntAsvh4lTlojd3xE+g7NF4oYNonfcdpy0nXE=
 github.com/solo-io/skv2 v0.39.1/go.mod h1:Zsnl+OYmOkj+6KeaMfkzYIxHTVMC0w2gVApzNJRadM8=
 github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9 h1:4DNulNBJdaVz+fOaMQes1MqVCIO/db2vmwz7bVe3iIU=
 github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9/go.mod h1:fA+jJC7TXNM+i3uXvq7fpVrJ6JpNu1BgBxc4U9ntUW0=
-github.com/solo-io/solo-kit v0.35.0 h1:iX7Wl9h59M7sPAH+fLVdjalY+nAfeG2ry+zrXYuyXTo=
-github.com/solo-io/solo-kit v0.35.0/go.mod h1:fxakm2fhYzT3UNsM4baURVz19wCa75sv/KBNi4lwv6Q=
+github.com/solo-io/solo-kit v0.35.3 h1:cm+uHB5cFFlAnghwKdboaKI0Ki+t1ECA0Db3TnTL6KU=
+github.com/solo-io/solo-kit v0.35.3/go.mod h1:KBCEfl59/wE0K68s90aDcrTc36gKR5L97TbVelwL8n4=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=

install/helm/gloo/crds/enterprise.gloo.solo.io_v1_AuthConfig.yaml

@@ -222,7 +222,11 @@ spec:
                                     type: string
                                 type: object
                               type: array
+                          required:
+                          - secretRefs
                           type: object
+                      required:
+                      - secretRefs
                       type: object
                     jwt:
                       maxProperties: 0
@@ -268,6 +272,8 @@ spec:
                           type: string
                         userDnTemplate:
                           type: string
+                      required:
+                      - address
                       type: object
                     name:
                       nullable: true
@@ -297,6 +303,8 @@ spec:
                           items:
                             type: string
                           type: array
+                      required:
+                      - appUrl
                       type: object
                     oauth2:
                       properties:
@@ -326,6 +334,8 @@ spec:
                                   type: string
                                 userIdAttributeName:
                                   type: string
+                              required:
+                              - introspectionUrl
                               type: object
                             introspectionUrl:
                               type: string
@@ -337,13 +347,17 @@ spec:
                                   properties:
                                     inlineString:
                                       type: string
+                                  required:
+                                  - inlineString
                                   type: object
                                 remoteJwks:
                                   properties:
                                     refreshInterval:
                                       type: string
                                     url:
                                       type: string
+                                  required:
+                                  - url
                                   type: object
                               type: object
                             requiredScopes:
@@ -474,6 +488,12 @@ spec:
                               additionalProperties:
                                 type: string
                               type: object
+                          required:
+                          - clientId
+                          - appUrl
+                          - callbackPath
+                          - authEndpoint
+                          - tokenEndpoint
                           type: object
                         oidcAuthorizationCode:
                           properties:
@@ -562,6 +582,8 @@ spec:
                                       type: object
                                     validFor:
                                       type: string
+                                  required:
+                                  - signingKeyRef
                                   type: object
                               type: object
                             clientId:
@@ -758,6 +780,11 @@ spec:
                               additionalProperties:
                                 type: string
                               type: object
+                          required:
+                          - clientId
+                          - issuerUrl
+                          - appUrl
+                          - callbackPath
                           type: object
                       type: object
                     opaAuth:
@@ -780,6 +807,8 @@ spec:
                           type: object
                         query:
                           type: string
+                      required:
+                      - query
                       type: object
                     opaServerAuth:
                       properties:
@@ -796,6 +825,8 @@ spec:
                           type: string
                         serverAddr:
                           type: string
+                      required:
+                      - package
                       type: object
                     passThroughAuth:
                       properties:
@@ -827,6 +858,8 @@ spec:
                               type: object
                             tlsConfig:
                               type: object
+                          required:
+                          - address
                           type: object
                         http:
                           properties:
@@ -868,6 +901,8 @@ spec:
                               type: object
                             url:
                               type: string
+                          required:
+                          - url
                           type: object
                       type: object
                     pluginAuth:
@@ -881,6 +916,8 @@ spec:
                           type: string
                         pluginFileName:
                           type: string
+                      required:
+                      - config
                       type: object
                   type: object
                 type: array
@@ -894,6 +931,8 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: object
                 type: object
+            required:
+            - configs
             type: object
           status:
             default: {}