SovereignCloudStack / cluster-stacks

Definition of Cluster Stacks based on the ClusterAPI ClusterClass feature
https://scs.community/
Apache License 2.0
7 stars 6 forks source link

Make kube-apiserver oidc flags configurable #84

Closed DEiselt closed 1 month ago

DEiselt commented 2 months ago

closes: #75

Marked as draft because there are still TODO's left. But i wanted to commit what i have so far to get feedback.

I created an object oidc_config to group all relevant flags for better readability and because of a 'dependency'. The usage of OIDC in itself is optional, but if it is used, the oidc-issuer-url and oidc-client-id are required. This is the reason why i build the variable object and it's corresponding patch like this and i would love some feedback if there is a better way.

Besides the two mentioned flags, all the other flags are optional. The question would be if we want them not to be used if omitted, or if we use sensible defaults.

And another open TODO are the descriptions. The question here is if we want to adopt the upstream docs (relatively much text) or think of something own.

A minimal config would look like this right now, while every option not provided will be set to the default value.

...
topology:
    variables:
      - name: oidc_config
        value:
          issuer_url: "https://dex.k8s.scs.community"
          client_id: "kubectl"
...

I tested the patching of values which is working already. But i could not do an actual "real world" test yet (cc @jschoone).

TODO's:

mxmxchere commented 1 month ago

Nicely wrote together. Regarding the description: I prefer to use the upstream text. I do not see lengthiness as a problem. Additionaly it is nice that the user has an additional indicator that this is referring 1:1 to the upstream flags. And third: you do not have to think about your own text :)

mxmxchere commented 1 month ago

Regarding the "grouping" via an object: i like that too :+1: