Skip to content

Commit f820540

Browse files
calebdoxseycalebdoxsey
committed
add bearer_token_format and idp_access_token_allowed_audiences
1 parent 2adafa1 commit f820540

11 files changed

+156
-27
lines changed

‎apis/ingress/v1/pomerium_types.go

+11
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,17 @@ type PomeriumSpec struct {
289289
// +kubebuilder:validation:Optional
290290
// +kubebuilder:validation:Enum=auto;http1;http2;http3
291291
CodecType *string `json:"codecType,omitempty"`
292+
293+
// BearerTokenFormat sets the <a href="https://www.pomerium.com/docs/reference/bearer-token-format">Bearer Token Format</a>.
294+
//
295+
// +kubebuilder:validation:Optional
296+
// +kubebuilder:validation:Enum=default;idp_access_token;idp_identity_token
297+
BearerTokenFormat *string `json:"bearerTokenFormat,omitempty"`
298+
299+
// IDPAccessTokenAllowedAudiences specifies the
300+
// <a href="https://www.pomerium.com/docs/reference/idp-access-token-allowed-audiences">idp access token allowed audiences</a>
301+
// list.
302+
IDPAccessTokenAllowedAudiences *[]string `json:"idpAccessTokenAllowedAudiences,omitempty"`
292303
}
293304

294305
// Timeouts allows to configure global timeouts for all routes.

‎apis/ingress/v1/zz_generated.deepcopy.go

+14
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/ingress.pomerium.io_pomerium.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ spec:
8383
items:
8484
type: string
8585
type: array
86+
bearerTokenFormat:
87+
description: BearerTokenFormat sets the <a href="https://www.pomerium.com/docs/reference/bearer-token-format">Bearer
88+
Token Format</a>.
89+
enum:
90+
- default
91+
- idp_access_token
92+
- idp_identity_token
93+
type: string
8694
caSecrets:
8795
description: CASecret should refer to k8s secrets with key <code>ca.crt</code>
8896
containing a CA certificate.
@@ -222,6 +230,14 @@ spec:
222230
- provider
223231
- secret
224232
type: object
233+
idpAccessTokenAllowedAudiences:
234+
description: |-
235+
IDPAccessTokenAllowedAudiences specifies the
236+
<a href="https://www.pomerium.com/docs/reference/idp-access-token-allowed-audiences">idp access token allowed audiences</a>
237+
list.
238+
items:
239+
type: string
240+
type: array
225241
jwtClaimHeaders:
226242
additionalProperties:
227243
type: string

‎deployment.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,14 @@ spec:
225225
items:
226226
type: string
227227
type: array
228+
bearerTokenFormat:
229+
description: BearerTokenFormat sets the <a href="https://www.pomerium.com/docs/reference/bearer-token-format">Bearer
230+
Token Format</a>.
231+
enum:
232+
- default
233+
- idp_access_token
234+
- idp_identity_token
235+
type: string
228236
caSecrets:
229237
description: CASecret should refer to k8s secrets with key <code>ca.crt</code>
230238
containing a CA certificate.
@@ -364,6 +372,14 @@ spec:
364372
- provider
365373
- secret
366374
type: object
375+
idpAccessTokenAllowedAudiences:
376+
description: |-
377+
IDPAccessTokenAllowedAudiences specifies the
378+
<a href="https://www.pomerium.com/docs/reference/idp-access-token-allowed-audiences">idp access token allowed audiences</a>
379+
list.
380+
items:
381+
type: string
382+
type: array
367383
jwtClaimHeaders:
368384
additionalProperties:
369385
type: string

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ require (
1818
github.com/martinlindhe/base36 v1.1.1
1919
github.com/open-policy-agent/opa v1.1.0
2020
github.com/pomerium/csrf v1.7.0
21-
github.com/pomerium/pomerium v0.28.1-0.20250204182906-81a52db74940
21+
github.com/pomerium/pomerium v0.28.1-0.20250218154031-3f5a0416cd8c
2222
github.com/rs/zerolog v1.33.0
2323
github.com/sergi/go-diff v1.3.1
2424
github.com/spf13/cobra v1.8.1

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -541,8 +541,8 @@ github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524 h1:3YQY1sb5
541541
github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524/go.mod h1:7fGbUYJnU8RcxZJvUvhukOIBv1G7LWDAHMfDxAf5+Y0=
542542
github.com/pomerium/envoy-custom v1.32.4-0.20250114182541-6f6d2147bea6 h1:QLVgpx23jcbgR9qJzIicJ+uXGjQXO0GAy55SCo0Jd9o=
543543
github.com/pomerium/envoy-custom v1.32.4-0.20250114182541-6f6d2147bea6/go.mod h1:afbaKE6YfshVUOrYc6XWUWfZcXencWmi1jTc00ki0Oo=
544-
github.com/pomerium/pomerium v0.28.1-0.20250204182906-81a52db74940 h1:Gi6ZFj2KUoI71thjzNKH4y13ip4LPLjABTQN+33P9IY=
545-
github.com/pomerium/pomerium v0.28.1-0.20250204182906-81a52db74940/go.mod h1:8Uf1ya/wSjJyeUo5X4TqctlrYxbc5iPfFG18x1t0Deo=
544+
github.com/pomerium/pomerium v0.28.1-0.20250218154031-3f5a0416cd8c h1:OGo6R2u98pDiX2WKLNfpVfbPjECFRH0wd4/mAsXPwLI=
545+
github.com/pomerium/pomerium v0.28.1-0.20250218154031-3f5a0416cd8c/go.mod h1:8Uf1ya/wSjJyeUo5X4TqctlrYxbc5iPfFG18x1t0Deo=
546546
github.com/pomerium/protoutil v0.0.0-20240813175624-47b7ac43ff46 h1:NRTg8JOXCxcIA1lAgD74iYud0rbshbWOB3Ou4+Huil8=
547547
github.com/pomerium/protoutil v0.0.0-20240813175624-47b7ac43ff46/go.mod h1:QqZmx6ZgPxz18va7kqoT4t/0yJtP7YFIDiT/W2n2fZ4=
548548
github.com/pomerium/webauthn v0.0.0-20240603205124-0428df511172 h1:TqoPqRgXSHpn+tEJq6H72iCS5pv66j3rPprThUEZg0E=

‎pomerium/config.go

+23
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,29 @@ func applySetOtherOptions(_ context.Context, p *pb.Config, c *model.Config) erro
132132
} else {
133133
p.Settings.PassIdentityHeaders = nil
134134
}
135+
if c.Spec.BearerTokenFormat != nil {
136+
switch *c.Spec.BearerTokenFormat {
137+
case "":
138+
p.Settings.BearerTokenFormat = pb.BearerTokenFormat_BEARER_TOKEN_FORMAT_UNKNOWN.Enum()
139+
case "default":
140+
p.Settings.BearerTokenFormat = pb.BearerTokenFormat_BEARER_TOKEN_FORMAT_DEFAULT.Enum()
141+
case "idp_access_token":
142+
p.Settings.BearerTokenFormat = pb.BearerTokenFormat_BEARER_TOKEN_FORMAT_IDP_ACCESS_TOKEN.Enum()
143+
case "idp_identity_token":
144+
p.Settings.BearerTokenFormat = pb.BearerTokenFormat_BEARER_TOKEN_FORMAT_IDP_IDENTITY_TOKEN.Enum()
145+
default:
146+
return fmt.Errorf("unknown bearerTokenFormat %s", *c.Spec.BearerTokenFormat)
147+
}
148+
} else {
149+
p.Settings.BearerTokenFormat = nil
150+
}
151+
if c.Spec.IDPAccessTokenAllowedAudiences != nil {
152+
p.Settings.IdpAccessTokenAllowedAudiences = &pb.Settings_StringList{
153+
Values: *c.Spec.IDPAccessTokenAllowedAudiences,
154+
}
155+
} else {
156+
p.Settings.IdpAccessTokenAllowedAudiences = nil
157+
}
135158
return nil
136159
}
137160

‎pomerium/ingress_annotations.go

+2
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,15 @@ var (
2424
"allow_public_unauthenticated_access",
2525
"allow_spdy",
2626
"allow_websockets",
27+
"bearer_token_format",
2728
"cors_allow_preflight",
2829
"description",
2930
"host_path_regex_rewrite_pattern",
3031
"host_path_regex_rewrite_substitution",
3132
"host_rewrite_header",
3233
"host_rewrite",
3334
"idle_timeout",
35+
"idp_access_token_allowed_audiences",
3436
"logo_url",
3537
"pass_identity_headers",
3638
"prefix_rewrite",

‎pomerium/ingress_annotations_test.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ func TestAnnotations(t *testing.T) {
4545
"a/allowed_domains": `["a"]`,
4646
"a/allowed_idp_claims": `key: ["val1", "val2"]`,
4747
"a/allowed_users": `["a"]`,
48+
"a/bearer_token_format": `idp_access_token`,
4849
"a/cors_allow_preflight": "true",
4950
"a/description": "DESCRIPTION",
5051
"a/health_checks": `[{"timeout": "10s", "interval": "1m", "healthy_threshold": 1, "unhealthy_threshold": 2, "http_health_check": {"path": "/"}}]`,
@@ -53,6 +54,7 @@ func TestAnnotations(t *testing.T) {
5354
"a/host_rewrite_header": "rewrite-header",
5455
"a/host_rewrite": "rewrite",
5556
"a/idle_timeout": `60s`,
57+
"a/idp_access_token_allowed_audiences": `["x","y","z"]`,
5658
"a/kubernetes_service_account_token_secret": "k8s_token",
5759
"a/lb_policy": "LEAST_REQUEST",
5860
"a/logo_url": "LOGO_URL",
@@ -191,12 +193,15 @@ func TestAnnotations(t *testing.T) {
191193
},
192194
SourcePpl: proto.String(`{"allow":{"or":[{"domain":{"is":"pomerium.com"}}]}}`),
193195
}},
194-
TlsSkipVerify: true,
195-
TlsServerName: "my.server.name",
196-
Description: "DESCRIPTION",
197-
LogoUrl: "LOGO_URL",
196+
TlsSkipVerify: true,
197+
TlsServerName: "my.server.name",
198+
Description: "DESCRIPTION",
199+
LogoUrl: "LOGO_URL",
200+
BearerTokenFormat: pb.BearerTokenFormat_BEARER_TOKEN_FORMAT_IDP_ACCESS_TOKEN.Enum(),
201+
IdpAccessTokenAllowedAudiences: &pb.Route_StringList{Values: []string{"x", "y", "z"}},
198202
}, cmpopts.IgnoreUnexported(
199203
pb.Route{},
204+
pb.Route_StringList{},
200205
pb.RouteRewriteHeader{},
201206
pb.Policy{},
202207
structpb.ListValue{},

‎pomerium/proto.go

+18
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ func preprocessAnnotationMessage(md protoreflect.MessageDescriptor, data any) an
4343
if v, ok := data.(string); ok {
4444
return goDurationStringToProtoJSONDurationString(v)
4545
}
46+
case "pomerium.config.Route.StringList":
47+
if v, ok := data.([]any); ok {
48+
return map[string]any{"values": v}
49+
}
4650
default:
4751
// preprocess all the fields
4852
if v, ok := data.(map[string]any); ok {
@@ -62,6 +66,20 @@ func preprocessAnnotationMessage(md protoreflect.MessageDescriptor, data any) an
6266
}
6367

6468
func preprocessAnnotationField(fd protoreflect.FieldDescriptor, data any) any {
69+
if fd.Enum() != nil && fd.Enum().FullName() == "pomerium.config.BearerTokenFormat" {
70+
if v, ok := data.(string); ok {
71+
switch v {
72+
case "":
73+
return "BEARER_TOKEN_FORMAT_UNKNOWN"
74+
case "default":
75+
return "BEARER_TOKEN_FORMAT_DEFAULT"
76+
case "idp_access_token":
77+
return "BEARER_TOKEN_FORMAT_IDP_ACCESS_TOKEN"
78+
case "idp_identity_token":
79+
return "BEARER_TOKEN_FORMAT_IDP_IDENTITY_TOKEN"
80+
}
81+
}
82+
}
6583
// if this is a repeated field, handle each of the field values separately
6684
if fd.IsList() {
6785
vs, ok := data.([]any)

0 commit comments

Comments
 (0)