@@ -2,12 +2,14 @@ use indoc::{formatdoc, indoc};
22use snafu:: { OptionExt , ResultExt , Snafu } ;
33use stackable_operator:: {
44 client:: Client ,
5+ commons:: opa:: OpaConfig ,
56 crd:: authentication:: ldap,
67 k8s_openapi:: api:: core:: v1:: { ConfigMap , ConfigMapKeySelector , EnvVar , EnvVarSource } ,
8+ kube:: ResourceExt ,
79} ;
810
911use super :: authentication:: NifiAuthenticationConfig ;
10- use crate :: crd:: NifiAuthorization ;
12+ use crate :: crd:: { NifiAuthorization , v1alpha1 } ;
1113
1214pub const OPA_TLS_VOLUME_NAME : & str = "opa-tls" ;
1315pub const OPA_TLS_MOUNT_PATH : & str = "/stackable/opa_tls" ;
@@ -27,58 +29,51 @@ pub enum Error {
2729 } ,
2830}
2931
30- pub enum NifiAuthorizationConfig {
32+ pub enum NifiAuthorizationConfig < ' a > {
3133 Opa {
32- configmap_name : String ,
34+ config : & ' a OpaConfig ,
3335 cache_entry_time_to_live_secs : u64 ,
3436 cache_max_entries : u32 ,
3537 secret_class : Option < String > ,
3638 } ,
3739 Default ,
3840}
3941
40- impl NifiAuthorizationConfig {
42+ impl < ' a > NifiAuthorizationConfig < ' a > {
4143 pub async fn from (
42- nifi_authorization : & Option < NifiAuthorization > ,
44+ nifi_authorization : Option < & ' a NifiAuthorization > ,
4345 client : & Client ,
4446 namespace : & str ,
4547 ) -> Result < Self , Error > {
46- let config = match nifi_authorization {
47- Some ( authorization_config) => match authorization_config. opa . clone ( ) {
48- Some ( opa_config) => {
49- let configmap_name = opa_config. opa . config_map_name . clone ( ) ;
50-
51- // Resolve the secret class from the ConfigMap
52- let secret_class = client
53- . get :: < ConfigMap > ( & configmap_name, namespace)
54- . await
55- . with_context ( |_| FetchOpaConfigMapSnafu {
56- configmap_name : configmap_name. clone ( ) ,
57- namespace : namespace. to_string ( ) ,
58- } ) ?
59- . data
60- . and_then ( |mut data| data. remove ( "OPA_SECRET_CLASS" ) ) ;
61-
62- NifiAuthorizationConfig :: Opa {
63- configmap_name,
64- cache_entry_time_to_live_secs : opa_config
65- . cache
66- . entry_time_to_live
67- . as_secs ( ) ,
68- cache_max_entries : opa_config. cache . max_entries ,
69- secret_class,
70- }
71- }
72- None => NifiAuthorizationConfig :: Default ,
73- } ,
74- None => NifiAuthorizationConfig :: Default ,
48+ let Some ( NifiAuthorization {
49+ opa : Some ( opa_config) ,
50+ } ) = nifi_authorization
51+ else {
52+ return Ok ( NifiAuthorizationConfig :: Default ) ;
7553 } ;
7654
77- Ok ( config)
55+ // Resolve the secret class from the ConfigMap
56+ let secret_class = client
57+ . get :: < ConfigMap > ( & opa_config. opa . config_map_name , namespace)
58+ . await
59+ . with_context ( |_| FetchOpaConfigMapSnafu {
60+ configmap_name : & opa_config. opa . config_map_name ,
61+ namespace,
62+ } ) ?
63+ . data
64+ . and_then ( |mut data| data. remove ( "OPA_SECRET_CLASS" ) ) ;
65+
66+ Ok ( NifiAuthorizationConfig :: Opa {
67+ config : & opa_config. opa ,
68+ cache_entry_time_to_live_secs : opa_config. cache . entry_time_to_live . as_secs ( ) ,
69+ cache_max_entries : opa_config. cache . max_entries ,
70+ secret_class,
71+ } )
7872 }
7973
8074 pub fn get_authorizers_config (
8175 & self ,
76+ nifi_cluster : & v1alpha1:: NifiCluster ,
8277 authentication_config : & NifiAuthenticationConfig ,
8378 ) -> Result < String , Error > {
8479 let mut authorizers_xml = indoc ! { r#"
@@ -91,16 +86,19 @@ impl NifiAuthorizationConfig {
9186 NifiAuthorizationConfig :: Opa {
9287 cache_entry_time_to_live_secs,
9388 cache_max_entries,
89+ config : OpaConfig { package, .. } ,
9490 ..
9591 } => {
92+ // According to [`OpaConfig::document_url`] we default the stacklet name
93+ let package = package. clone ( ) . unwrap_or_else ( || nifi_cluster. name_any ( ) ) ;
9694 authorizers_xml. push_str ( & formatdoc ! { r#"
9795 <authorizer>
9896 <identifier>authorizer</identifier>
9997 <class>org.nifiopa.nifiopa.OpaAuthorizer</class>
10098 <property name="CACHE_TIME_SECS">{cache_entry_time_to_live_secs}</property>
10199 <property name="CACHE_MAX_ENTRY_COUNT">{cache_max_entries}</property>
102100 <property name="OPA_URI">${{env:OPA_BASE_URL}}</property>
103- <property name="OPA_RULE_HEAD">nifi /allow</property>
101+ <property name="OPA_RULE_HEAD">{package} /allow</property>
104102 </authorizer>
105103 "# } ) ;
106104 }
@@ -172,13 +170,18 @@ impl NifiAuthorizationConfig {
172170
173171 pub fn get_env_vars ( & self ) -> Vec < EnvVar > {
174172 match self {
175- NifiAuthorizationConfig :: Opa { configmap_name, .. } => {
173+ NifiAuthorizationConfig :: Opa {
174+ config : OpaConfig {
175+ config_map_name, ..
176+ } ,
177+ ..
178+ } => {
176179 vec ! [ EnvVar {
177180 name: "OPA_BASE_URL" . to_owned( ) ,
178181 value_from: Some ( EnvVarSource {
179182 config_map_key_ref: Some ( ConfigMapKeySelector {
180183 key: "OPA" . to_owned( ) ,
181- name: configmap_name . to_owned( ) ,
184+ name: config_map_name . to_owned( ) ,
182185 ..Default :: default ( )
183186 } ) ,
184187 ..Default :: default ( )
0 commit comments