Tmp test failing build

changelog/v1.17.0-rc6/authconfig-cel-rules.yaml

@@ -0,0 +1,6 @@
+changelog:
+  - type: NEW_FEATURE
+    issueLink: https://github.com/solo-io/gloo-mesh-enterprise/issues/16010
+    description: |
+      Adds pre-admission [validation rules](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules) to the `AuthConfig` CRD.
+    resolvesIssue: false

go.mod

@@ -51,14 +51,14 @@ require (
 	github.com/solo-io/go-utils v0.24.8
 	github.com/solo-io/k8s-utils v0.7.2
 	github.com/solo-io/protoc-gen-ext v0.0.18
-	github.com/solo-io/protoc-gen-openapi v0.2.2
+	github.com/solo-io/protoc-gen-openapi v0.2.4
 	github.com/solo-io/skv2 v0.39.1
 
 	// Pinned to the `sa-k8s-1.29-bump` tag of solo-apis on `gloo-main` branch
 	// Ref: https://github.com/solo-io/gloo/pull/9463/files#r1594409655 && https://solo-io-corp.slack.com/archives/C03MFATU265/p1716913420716729?thread_ts=1716476992.938679&cid=C03MFATU265
 	// as to why it is now based off `gloo-main` and not `gloo-repo-branch`
 	github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9
-	github.com/solo-io/solo-kit v0.35.0
+	github.com/solo-io/solo-kit v0.35.3-0.20240617205358-ffe0eaa62e6b
 	github.com/spf13/afero v1.9.2
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5

go.sum

@@ -2028,14 +2028,14 @@ github.com/solo-io/k8s-utils v0.7.2 h1:pIRiTOpwymdCHUOSjzKDi/Ay16FNtF7JV7NIRlC2Z
 github.com/solo-io/k8s-utils v0.7.2/go.mod h1:RrT6PVTSD1X0vteKCQmGzoAAfjI1U5oV/wA+T3T+NoM=
 github.com/solo-io/protoc-gen-ext v0.0.18 h1:zSAL8NzWpJUGYoA5IyjHiKASNyHjR0uxBQ7eQS94i3A=
 github.com/solo-io/protoc-gen-ext v0.0.18/go.mod h1:iGyCvmKmhJNXs5MgBcYFBF0om7LDnCVD2WwhOZGnqeA=
-github.com/solo-io/protoc-gen-openapi v0.2.2 h1:OzyOAxiZuMAaLYWMNoTl2v9E7IXcl7UEeiTeCSwvCJ0=
-github.com/solo-io/protoc-gen-openapi v0.2.2/go.mod h1:osEjRl1miHqlq4Wl/8SEqHFoyydptPL1EzEdM9c4vfE=
+github.com/solo-io/protoc-gen-openapi v0.2.4 h1:9tqGhCAq83IRSzHhKDzpWnPlbPPORTM2izVxjLk0Ftw=
+github.com/solo-io/protoc-gen-openapi v0.2.4/go.mod h1:osEjRl1miHqlq4Wl/8SEqHFoyydptPL1EzEdM9c4vfE=
 github.com/solo-io/skv2 v0.39.1 h1:dWaZTWgntAsvh4lTlojd3xE+g7NF4oYNonfcdpy0nXE=
 github.com/solo-io/skv2 v0.39.1/go.mod h1:Zsnl+OYmOkj+6KeaMfkzYIxHTVMC0w2gVApzNJRadM8=
 github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9 h1:4DNulNBJdaVz+fOaMQes1MqVCIO/db2vmwz7bVe3iIU=
 github.com/solo-io/solo-apis v0.0.0-20240528173540-7879b7d12cb9/go.mod h1:fA+jJC7TXNM+i3uXvq7fpVrJ6JpNu1BgBxc4U9ntUW0=
-github.com/solo-io/solo-kit v0.35.0 h1:iX7Wl9h59M7sPAH+fLVdjalY+nAfeG2ry+zrXYuyXTo=
-github.com/solo-io/solo-kit v0.35.0/go.mod h1:fxakm2fhYzT3UNsM4baURVz19wCa75sv/KBNi4lwv6Q=
+github.com/solo-io/solo-kit v0.35.3-0.20240617205358-ffe0eaa62e6b h1:MzYJWnRb9XIu0py7uvBp5lYDshmU9Qmi72oKdsmJlwU=
+github.com/solo-io/solo-kit v0.35.3-0.20240617205358-ffe0eaa62e6b/go.mod h1:KBCEfl59/wE0K68s90aDcrTc36gKR5L97TbVelwL8n4=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=

install/helm/gloo/crds/enterprise.gloo.solo.io_v1_AuthConfig.yaml

@@ -207,6 +207,12 @@ spec:
                               type: object
                           type: object
                       type: object
+                      x-kubernetes-validations:
+                      - message: Either apr or both encryption and userSource must
+                          be set; apr may not be set alongside either encryption or
+                          userSource
+                        rule: 'has(self.apr) ? !has(self.encryption) && !has(self.userList)
+                          : has(self.encryption) && has(self.userList)'
                     hmacAuth:
                       properties:
                         parametersInHeaders:
@@ -221,15 +227,21 @@ spec:
                                   namespace:
                                     type: string
                                 type: object
+                              minItems: 1
                               type: array
+                          required:
+                          - secretRefs
                           type: object
+                      required:
+                      - secretRefs
                       type: object
                     jwt:
                       maxProperties: 0
                       type: object
                     ldap:
                       properties:
                         address:
+                          minLength: 1
                           type: string
                         allowedGroups:
                           items:
@@ -268,13 +280,16 @@ spec:
                           type: string
                         userDnTemplate:
                           type: string
+                      required:
+                      - address
                       type: object
                     name:
                       nullable: true
                       type: string
                     oauth:
                       properties:
                         appUrl:
+                          minLength: 1
                           type: string
                         authEndpointQueryParams:
                           additionalProperties:
@@ -297,6 +312,8 @@ spec:
                           items:
                             type: string
                           type: array
+                      required:
+                      - appUrl
                       type: object
                     oauth2:
                       properties:
@@ -323,11 +340,22 @@ spec:
                                   nullable: true
                                   type: boolean
                                 introspectionUrl:
+                                  minLength: 1
                                   type: string
                                 userIdAttributeName:
                                   type: string
-                              type: object
+                              required:
+                              - introspectionUrl
+                              type: object
+                              x-kubernetes-validations:
+                              - message: If clientId is set, clientSecretRef must
+                                  be set or disableClientSecret must be true. Otherwise,
+                                  clientSecretRef must not be set.
+                                rule: 'has(self.clientId) && size(self.clientId) >
+                                  0 ? has(self.clientSecretRef) || (has(self.disableClientSecret)
+                                  && self.disableClientSecret) : !has(self.clientSecretRef)'
                             introspectionUrl:
+                              minLength: 1
                               type: string
                             jwt:
                               properties:
@@ -336,14 +364,20 @@ spec:
                                 localJwks:
                                   properties:
                                     inlineString:
+                                      minLength: 1
                                       type: string
+                                  required:
+                                  - inlineString
                                   type: object
                                 remoteJwks:
                                   properties:
                                     refreshInterval:
                                       type: string
                                     url:
+                                      minLength: 1
                                       type: string
+                                  required:
+                                  - url
                                   type: object
                               type: object
                             requiredScopes:
@@ -361,16 +395,20 @@ spec:
                             afterLogoutUrl:
                               type: string
                             appUrl:
+                              minLength: 1
                               type: string
                             authEndpoint:
+                              minLength: 1
                               type: string
                             authEndpointQueryParams:
                               additionalProperties:
                                 type: string
                               type: object
                             callbackPath:
+                              minLength: 1
                               type: string
                             clientId:
+                              minLength: 1
                               type: string
                             clientSecretRef:
                               properties:
@@ -469,12 +507,24 @@ spec:
                                   type: object
                               type: object
                             tokenEndpoint:
+                              minLength: 1
                               type: string
                             tokenEndpointQueryParams:
                               additionalProperties:
                                 type: string
                               type: object
+                          required:
+                          - clientId
+                          - appUrl
+                          - callbackPath
+                          - authEndpoint
+                          - tokenEndpoint
                           type: object
+                          x-kubernetes-validations:
+                          - message: Either clientSecretRef must be set or disableClientSecret
+                              must be true
+                            rule: has(self.clientSecretRef) || (has(self.disableClientSecret)
+                              && self.disableClientSecret)
                         oidcAuthorizationCode:
                           properties:
                             accessToken:
@@ -494,6 +544,7 @@ spec:
                             afterLogoutUrl:
                               type: string
                             appUrl:
+                              minLength: 1
                               type: string
                             authEndpointQueryParams:
                               additionalProperties:
@@ -535,6 +586,7 @@ spec:
                                   type: string
                               type: object
                             callbackPath:
+                              minLength: 1
                               type: string
                             clientAuthentication:
                               properties:
@@ -551,6 +603,11 @@ spec:
                                       nullable: true
                                       type: boolean
                                   type: object
+                                  x-kubernetes-validations:
+                                  - message: Either clientSecretRef must be set or
+                                      disableClientSecret must be true
+                                    rule: has(self.clientSecretRef) || (has(self.disableClientSecret)
+                                      && self.disableClientSecret)
                                 privateKeyJwt:
                                   properties:
                                     signingKeyRef:
@@ -562,9 +619,15 @@ spec:
                                       type: object
                                     validFor:
                                       type: string
+                                  required:
+                                  - signingKeyRef
                                   type: object
                               type: object
+                              x-kubernetes-validations:
+                              - message: Must specify clientSecret or privateKeyJwt
+                                rule: has(self.clientSecret) || has(self.privateKeyJwt)
                             clientId:
+                              minLength: 1
                               type: string
                             clientSecretRef:
                               properties:
@@ -652,6 +715,7 @@ spec:
                                   type: array
                               type: object
                             issuerUrl:
+                              minLength: 1
                               type: string
                             jwksCacheRefreshPolicy:
                               properties:
@@ -758,7 +822,19 @@ spec:
                               additionalProperties:
                                 type: string
                               type: object
+                          required:
+                          - clientId
+                          - issuerUrl
+                          - appUrl
+                          - callbackPath
                           type: object
+                          x-kubernetes-validations:
+                          - message: If clientAuthentication is set, neither clientSecretRef
+                              nor disableClientSecret may be set. Otherwise, clientSecretRef
+                              must be set or disableClientSecret must be true.
+                            rule: 'has(self.clientAuthentication) ? !has(self.clientSecretRef)
+                              && !has(self.disableClientSecret) : has(self.clientSecretRef)
+                              || (has(self.disableClientSecret) && self.disableClientSecret)'
                       type: object
                     opaAuth:
                       properties:
@@ -779,7 +855,10 @@ spec:
                               type: boolean
                           type: object
                         query:
+                          minLength: 1
                           type: string
+                      required:
+                      - query
                       type: object
                     opaServerAuth:
                       properties:
@@ -791,11 +870,14 @@ spec:
                               type: boolean
                           type: object
                         package:
+                          minLength: 1
                           type: string
                         ruleName:
                           type: string
                         serverAddr:
                           type: string
+                      required:
+                      - package
                       type: object
                     passThroughAuth:
                       properties:
@@ -807,6 +889,7 @@ spec:
                         grpc:
                           properties:
                             address:
+                              minLength: 1
                               type: string
                             connectionTimeout:
                               type: string
@@ -827,6 +910,8 @@ spec:
                               type: object
                             tlsConfig:
                               type: object
+                          required:
+                          - address
                           type: object
                         http:
                           properties:
@@ -867,9 +952,15 @@ spec:
                                   type: boolean
                               type: object
                             url:
+                              minLength: 1
                               type: string
+                          required:
+                          - url
                           type: object
                       type: object
+                      x-kubernetes-validations:
+                      - message: Must specify grpc or http
+                        rule: has(self.grpc) || has(self.http)
                     pluginAuth:
                       properties:
                         config:
@@ -881,8 +972,11 @@ spec:
                           type: string
                         pluginFileName:
                           type: string
+                      required:
+                      - config
                       type: object
                   type: object
+                minItems: 1
                 type: array
               failOnRedirect:
                 type: boolean
@@ -894,6 +988,8 @@ spec:
                       x-kubernetes-preserve-unknown-fields: true
                     type: object
                 type: object
+            required:
+            - configs
             type: object
           status:
             default: {}

projects/envoyinit/hack/filter_types/filter_types.gen.go

@@ -313,43 +313,5 @@ import (
 	_ "github.com/envoyproxy/go-control-plane/pkg/test/v3"
 	_ "github.com/envoyproxy/go-control-plane/ratelimit/config/ratelimit/v3"
 	_ "github.com/envoyproxy/go-control-plane/ratelimit/service/ratelimit/v3"
-
 	// gloo filter types
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/annotations"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/api/v2/cluster"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/api/v2/core"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/api/v2/route"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/common/mutation_rules/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/core/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/filter/http/gzip/v2"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/filter/listener/tls_cipher_inspector/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/matching/custom_matchers/server_name/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/matching/inputs/cipher_detection_input/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/route/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/config/trace/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/advanced_http"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/aws"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/cache/grpc"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/extauth"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/buffer/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/csrf/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/ext_proc/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/graphql/v2"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/jwt_authn/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/filters/http/wasm/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/http_path"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/jwt"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/proxylatency"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/transformation"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/transformation_ee"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/transformers/xslt"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/upstream_wait"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/waf"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/wasm/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/extensions/xff_offset"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/type"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/type/matcher/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/type/metadata/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/type/tracing/v3"
-	_ "github.com/solo-io/gloo/projects/gloo/pkg/api/external/envoy/type/v3"
 )