From 2624d76c684a2bd4eaf1b91cb9883303912ad44c Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 20 Aug 2026 10:48:38 +0100 Subject: [PATCH 1/3] feat(charts): add default validation rules to reduce duplication in authenticationConfiguration --- .../templates/authn-config-configmap.yaml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/charts/workflows-cluster/templates/authn-config-configmap.yaml b/charts/workflows-cluster/templates/authn-config-configmap.yaml index d0c019b7b..9c96a3128 100644 --- a/charts/workflows-cluster/templates/authn-config-configmap.yaml +++ b/charts/workflows-cluster/templates/authn-config-configmap.yaml @@ -1,10 +1,26 @@ +{{- $auth := .Values.authenticationConfiguration -}} +{{- $issuerDefaults := $auth.issuerDefaults | default dict -}} +{{- $jwt := list -}} + +{{- range $issuer := $auth.jwt }} + {{- $mergedIssuer := mustMergeOverwrite + (deepCopy $issuerDefaults) + (deepCopy $issuer) + -}} + {{- $jwt = append $jwt $mergedIssuer -}} +{{- end -}} + +{{- $config := dict + "apiVersion" "apiserver.config.k8s.io/v1beta1" + "kind" "AuthenticationConfiguration" + "jwt" $jwt +-}} + apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "common.names.fullname" $ }}-authn-config + name: {{ include "common.names.fullname" . }}-authn-config namespace: {{ .Release.Namespace }} data: authn-config.yaml: | - apiVersion: apiserver.config.k8s.io/v1beta1 - kind: AuthenticationConfiguration - {{- .Values.authenticationConfiguration | toYaml | nindent 4 }} +{{ toYaml $config | indent 4 }} From 33d8ae2fdd786d07e361191cf3e4ed7fffa0fe7a Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 20 Aug 2026 10:51:51 +0100 Subject: [PATCH 2/3] refactor(charts): eliminate duplicated values in authenticationConfiguration --- charts/workflows-cluster/staging-values.yaml | 82 ------------------- charts/workflows-cluster/values.yaml | 84 ++++++++++---------- 2 files changed, 43 insertions(+), 123 deletions(-) diff --git a/charts/workflows-cluster/staging-values.yaml b/charts/workflows-cluster/staging-values.yaml index 22957a664..8189f9a9d 100644 --- a/charts/workflows-cluster/staging-values.yaml +++ b/charts/workflows-cluster/staging-values.yaml @@ -112,91 +112,9 @@ authenticationConfiguration: - workflows-cluster-staging - graph audienceMatchPolicy: MatchAny - claimMappings: - username: - expression: > - claims.?fedid.hasValue() - ? ('oidc:' + claims.fedid) - : ('oidc:' + claims.iss + '/' + claims.client_id) - uid: - expression: "claims.?fedid.orValue(claims.sub)" - groups: - claim: groups - prefix: "oidc:" - extra: - - key: "workflows.diamond.ac.uk/posixuid" - valueExpression: "string(claims.?posix_uid.orValue(36055))" # use k8s-workflows uid - - key: "workflows.diamond.ac.uk/is-service-account" - valueExpression: "claims.?fedid.hasValue() ? '' : 'true'" - claimValidationRules: - - expression: > - claims.?fedid.hasValue() - || - claims.?client_id.hasValue() - message: "Invalid access token (no fedid or client_id). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - claims.?preferred_username.orValue('').startsWith('service-account-') - message: "Invalid access token (service-account tokens must use service-account-* preferred_username). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - ( - claims.?client_id.hasValue() - && - ['k6Operator'].exists(allowed, allowed == claims.client_id) - ) - message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - userValidationRules: - - expression: "!user.username.startsWith('system:')" - message: "username cannot use reserved system: prefix" - - expression: "user.groups.all(group, !group.startsWith('system:'))" - message: "groups cannot use reserved system: prefix" - issuer: url: https://identity-test.diamond.ac.uk/realms/dls audiences: - workflows-cluster-staging - graph audienceMatchPolicy: MatchAny - claimMappings: - username: - expression: > - claims.?fedid.hasValue() - ? ('oidc:' + claims.fedid) - : ('oidc:' + claims.iss + '/' + claims.client_id) - uid: - expression: "claims.?fedid.orValue(claims.sub)" - groups: - claim: groups - prefix: "oidc:" - extra: - - key: "workflows.diamond.ac.uk/posixuid" - valueExpression: "string(claims.?posix_uid.orValue(36055))" # use k8s-workflows uid - - key: "workflows.diamond.ac.uk/is-service-account" - valueExpression: "claims.?fedid.hasValue() ? '' : 'true'" - claimValidationRules: - - expression: > - claims.?fedid.hasValue() - || - claims.?client_id.hasValue() - message: "Invalid access token (no fedid or client_id). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - claims.?preferred_username.orValue('').startsWith('service-account-') - message: "Invalid access token (service-account tokens must use service-account-* preferred_username). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - ( - claims.?client_id.hasValue() - && - ['k6Operator'].exists(allowed, allowed == claims.client_id) - ) - message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - userValidationRules: - - expression: "!user.username.startsWith('system:')" - message: "username cannot use reserved system: prefix" - - expression: "user.groups.all(group, !group.startsWith('system:'))" - message: "groups cannot use reserved system: prefix" diff --git a/charts/workflows-cluster/values.yaml b/charts/workflows-cluster/values.yaml index 8b182e793..4f59cb7d1 100644 --- a/charts/workflows-cluster/values.yaml +++ b/charts/workflows-cluster/values.yaml @@ -232,6 +232,49 @@ ingress: pathType: Prefix authenticationConfiguration: + issuerDefaults: + claimMappings: + username: + expression: > + claims.?fedid.hasValue() + ? ('oidc:' + claims.fedid) + : ('oidc:' + claims.iss + '/' + claims.client_id) + uid: + expression: "claims.?fedid.orValue(claims.sub)" + groups: + claim: groups + prefix: "oidc:" + extra: + - key: "workflows.diamond.ac.uk/posixuid" + valueExpression: "string(claims.?posix_uid.orValue(36055))" # use k8s-workflows uid + - key: "workflows.diamond.ac.uk/is-service-account" + valueExpression: "claims.?fedid.hasValue() ? '' : 'true'" + claimValidationRules: + - expression: > + claims.?fedid.hasValue() + || + claims.?client_id.hasValue() + message: "Invalid access token (no fedid or client_id). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" + - expression: > + claims.?fedid.hasValue() + || + claims.?preferred_username.orValue('').startsWith('service-account-') + message: "Invalid access token (service-account tokens must use service-account-* preferred_username). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" + - expression: > + claims.?fedid.hasValue() + || + ( + claims.?client_id.hasValue() + && + ['k6Operator'].exists(allowed, allowed == claims.client_id) + ) + message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" + userValidationRules: + - expression: "!user.username.startsWith('system:')" + message: "username cannot use reserved system: prefix" + - expression: "user.groups.all(group, !group.startsWith('system:'))" + message: "groups cannot use reserved system: prefix" + jwt: - issuer: url: https://identity.diamond.ac.uk/realms/dls @@ -239,44 +282,3 @@ authenticationConfiguration: - workflows-cluster - graph audienceMatchPolicy: MatchAny - claimMappings: - username: - expression: > - claims.?fedid.hasValue() - ? ('oidc:' + claims.fedid) - : ('oidc:' + claims.iss + '/' + claims.client_id) - uid: - expression: "claims.?fedid.orValue(claims.sub)" - groups: - claim: groups - prefix: "oidc:" - extra: - - key: "workflows.diamond.ac.uk/posixuid" - valueExpression: "string(claims.?posix_uid.orValue(36055))" # use k8s-workflows uid - - key: "workflows.diamond.ac.uk/is-service-account" - valueExpression: "claims.?fedid.hasValue() ? '' : 'true'" - claimValidationRules: - - expression: > - claims.?fedid.hasValue() - || - claims.?client_id.hasValue() - message: "Invalid access token (no fedid or client_id). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - claims.?preferred_username.orValue('').startsWith('service-account-') - message: "Invalid access token (service-account tokens must use service-account-* preferred_username). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - - expression: > - claims.?fedid.hasValue() - || - ( - claims.?client_id.hasValue() - && - ['k6Operator'].exists(allowed, allowed == claims.client_id) - ) - message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" - userValidationRules: - - expression: "!user.username.startsWith('system:')" - message: "username cannot use reserved system: prefix" - - expression: "user.groups.all(group, !group.startsWith('system:'))" - message: "groups cannot use reserved system: prefix" From c233ea21c26835263d497a825767840fd34b6eea Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 20 Aug 2026 11:16:33 +0100 Subject: [PATCH 3/3] chore(charts): increment workflows-cluster chart version --- charts/workflows-cluster/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/workflows-cluster/Chart.yaml b/charts/workflows-cluster/Chart.yaml index c992f78a8..edfa1edf4 100644 --- a/charts/workflows-cluster/Chart.yaml +++ b/charts/workflows-cluster/Chart.yaml @@ -3,7 +3,7 @@ name: workflows-cluster description: A virtual cluster for Data Analysis workflows type: application -version: 0.13.23 +version: 0.13.24 dependencies: - name: common version: 2.23.0