Skip to content

Commit 1c275a9

Browse files
pantierrapantierra
committed
Added custom filter logic for stac-auth-proxy.
1 parent 0cf94ad commit 1c275a9

5 files changed

Lines changed: 156 additions & 7 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1212
- Added support for annotations on the PgSTAC bootstrap job via `pgstacBootstrap.jobAnnotations` in values.yaml [#381](https://github.com/developmentseed/eoapi-k8s/pull/381)
1313
- Added load testing scripts [#373](https://github.com/developmentseed/eoapi-k8s/pull/373)
1414
- Added auth support to STAC Browser [#376](https://github.com/developmentseed/eoapi-k8s/pull/376)
15+
- Added support for custom filters configuration via `customFiltersFile` in values.yaml [#388](https://github.com/developmentseed/eoapi-k8s/pull/388)
1516

1617
### Fixed
1718

‎charts/eoapi/data/stac-auth-proxy/custom_filters.py‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
"""
2+
Sample custom filters for STAC Auth Proxy.
3+
This file demonstrates the structure needed for custom collection and item filters.
4+
"""
5+
6+
import dataclasses
7+
from typing import Any
8+
9+
10+
@dataclasses.dataclass
11+
class CollectionsFilter:
12+
"""Filter collections based on user permissions."""
13+
14+
async def __call__(self, context: dict[str, Any]) -> str:
15+
"""Return True if user can access this collection."""
16+
# Example: Allow all collections for authenticated users
17+
return "1=1"
18+
19+
20+
@dataclasses.dataclass
21+
class ItemsFilter:
22+
"""Filter items based on user permissions."""
23+
24+
async def __call__(self, context: dict[str, Any]) -> str:
25+
"""Return True if user can access this item."""
26+
# Example: Allow all items for authenticated users
27+
return "1=1"

‎charts/eoapi/templates/core/stac-auth-proxy-filters-configmap.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if index .Values "stac-auth-proxy" "enabled" }}
2+
{{- $stacAuthProxy := index .Values "stac-auth-proxy" }}
3+
{{- if and (hasKey $stacAuthProxy "extraVolumes") $stacAuthProxy.extraVolumes }}
4+
{{- $filterFile := $stacAuthProxy.customFiltersFile | default "data/stac-auth-proxy/custom_filters.py" }}
5+
apiVersion: v1
6+
kind: ConfigMap
7+
metadata:
8+
name: {{ .Release.Name }}-stac-auth-proxy-filters
9+
labels:
10+
{{- include "eoapi.labels" . | nindent 4 }}
11+
app.kubernetes.io/component: stac-auth-proxy
12+
data:
13+
custom_filters.py: |
14+
{{ .Files.Get $filterFile | indent 4 }}
15+
{{- end }}
16+
{{- end }}

‎charts/eoapi/tests/stac-auth-proxy-filters_test.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
suite: test stac-auth-proxy custom filters ConfigMap
2+
templates:
3+
- templates/_helpers/core.tpl
4+
- templates/core/stac-auth-proxy-filters-configmap.yaml
5+
6+
tests:
7+
- it: should create ConfigMap when stac-auth-proxy is enabled and extraVolumes is defined
8+
set:
9+
stac-auth-proxy.enabled: true
10+
stac-auth-proxy.extraVolumes:
11+
- name: filters
12+
configMap:
13+
name: test-filters
14+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
15+
asserts:
16+
- isKind:
17+
of: ConfigMap
18+
- equal:
19+
path: metadata.name
20+
value: RELEASE-NAME-stac-auth-proxy-filters
21+
- isNotEmpty:
22+
path: data
23+
24+
- it: should not create ConfigMap when stac-auth-proxy is disabled
25+
set:
26+
stac-auth-proxy.enabled: false
27+
stac-auth-proxy.extraVolumes:
28+
- name: filters
29+
configMap:
30+
name: test-filters
31+
asserts:
32+
- hasDocuments:
33+
count: 0
34+
35+
- it: should not create ConfigMap when extraVolumes is not defined
36+
set:
37+
stac-auth-proxy.enabled: true
38+
asserts:
39+
- hasDocuments:
40+
count: 0
41+
42+
- it: should have correct labels
43+
set:
44+
stac-auth-proxy.enabled: true
45+
stac-auth-proxy.extraVolumes:
46+
- name: filters
47+
configMap:
48+
name: test-filters
49+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
50+
asserts:
51+
- equal:
52+
path: metadata.labels["app.kubernetes.io/component"]
53+
value: stac-auth-proxy
54+
- exists:
55+
path: metadata.labels["app.kubernetes.io/name"]
56+
- exists:
57+
path: metadata.labels["app.kubernetes.io/instance"]
58+
- exists:
59+
path: metadata.labels["helm.sh/chart"]
60+
61+
- it: should use custom file path when customFiltersFile is specified
62+
set:
63+
stac-auth-proxy.enabled: true
64+
stac-auth-proxy.customFiltersFile: "data/eoepca_filters.py"
65+
stac-auth-proxy.extraVolumes:
66+
- name: filters
67+
configMap:
68+
name: test-filters
69+
template: templates/core/stac-auth-proxy-filters-configmap.yaml
70+
asserts:
71+
- isKind:
72+
of: ConfigMap
73+
- equal:
74+
path: metadata.name
75+
value: RELEASE-NAME-stac-auth-proxy-filters
76+
- isNotEmpty:
77+
path: data

‎charts/eoapi/values.yaml‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -416,18 +416,46 @@ stac:
416416
stac-auth-proxy:
417417
enabled: false
418418
image:
419-
tag: "v0.11.0"
420-
env:
421-
ROOT_PATH: "/stac"
422-
OVERRIDE_HOST: "false"
423-
DEFAULT_PUBLIC: "true"
424-
# UPSTREAM_URL will be set dynamically in template to point to stac service
425-
# OIDC_DISCOVERY_URL must be configured when enabling auth
419+
tag: "v0.11.1"
426420
ingress:
427421
enabled: false # Handled by main eoapi ingress
428422
service:
429423
port: 8080
430424
resources: {}
425+
env:
426+
ROOT_PATH: "/stac"
427+
OVERRIDE_HOST: "false"
428+
# UPSTREAM_URL will be set dynamically in template to point to stac service
429+
# OIDC_DISCOVERY_URL must be configured when enabling auth
430+
# OIDC_DISCOVERY_URL must be configured when enabling auth
431+
# UPSTREAM_URL will be set dynamically in template to point to stac service
432+
#
433+
# Authentication filters settings:
434+
DEFAULT_PUBLIC: "true" # This enables standard profile for authentication filters
435+
# Alternatively with the following settings custom filters can be added
436+
# These must be mounted with extraVolumes/extraVolumeMounts (see below)
437+
# COLLECTIONS_FILTER_CLS: stac_auth_proxy.custom_filters:CollectionsFilter
438+
# ITEMS_FILTER_CLS: stac_auth_proxy.custom_filters:ItemsFilter
439+
440+
# Path to custom filters file (relative to chart root)
441+
# When extraVolumes is configured, a ConfigMap will be created from this file
442+
# customFiltersFile: "data/stac-auth-proxy/custom_filters.py"
443+
444+
# Additional volumes to mount (e.g., for custom filter files)
445+
extraVolumes: []
446+
# Example:
447+
# extraVolumes:
448+
# - name: filters
449+
# configMap:
450+
# name: stac-auth-proxy-filters
451+
# Additional volume mounts for the container
452+
extraVolumeMounts: []
453+
# Example:
454+
# extraVolumeMounts:
455+
# - name: filters
456+
# mountPath: /app/src/stac_auth_proxy/custom_filters.py
457+
# subPath: custom_filters.py
458+
# readOnly: true
431459

432460
vector:
433461
enabled: true

0 commit comments

Comments
 (0)