Implement OIDC based authentication and authorization

PROJECT

@@ -28,4 +28,11 @@ resources:
   domain: jumpstarter.dev
   kind: Lease
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: jumpstarter.dev
+  kind: ExporterAccessPolicy
+  path: github.com/jumpstarter-dev/jumpstarter-controller/api/v1alpha1
+  version: v1alpha1
 version: "3"

api/v1alpha1/authenticationconfiguration_types.go

@@ -0,0 +1,19 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	apiserverv1beta1 "k8s.io/apiserver/pkg/apis/apiserver/v1beta1"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// AuthenticationConfiguration provides versioned configuration for authentication.
+type AuthenticationConfiguration struct {
+	metav1.TypeMeta
+
+	JWT []apiserverv1beta1.JWTAuthenticator `json:"jwt"`
+}
+
+func init() {
+	SchemeBuilder.Register(&AuthenticationConfiguration{})
+}

api/v1alpha1/client_types.go

@@ -26,8 +26,7 @@ import (
 
 // ClientSpec defines the desired state of Identity
 type ClientSpec struct {
-	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
-	// Important: Run "make" to regenerate code after modifying this file
+	Username *string `json:"username,omitempty"`
 }
 
 // ClientStatus defines the observed state of Identity

api/v1alpha1/exporter_types.go

@@ -26,8 +26,7 @@ import (
 
 // ExporterSpec defines the desired state of Exporter
 type ExporterSpec struct {
-	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
-	// Important: Run "make" to regenerate code after modifying this file
+	Username *string `json:"username,omitempty"`
 }
 
 // ExporterStatus defines the observed state of Exporter

api/v1alpha1/exporteraccesspolicy_types.go

@@ -0,0 +1,72 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+type From struct {
+	ClientSelector metav1.LabelSelector `json:"clientSelector,omitempty"`
+}
+
+type Policy struct {
+	Priority        int              `json:"priority,omitempty"`
+	From            []From           `json:"from,omitempty"`
+	MaximumDuration *metav1.Duration `json:"maximumDuration,omitempty"`
+	SpotAccess      bool             `json:"spotAccess,omitempty"`
+}
+
+// ExporterAccessPolicySpec defines the desired state of ExporterAccessPolicy.
+type ExporterAccessPolicySpec struct {
+	ExporterSelector metav1.LabelSelector `json:"exporterSelector,omitempty"`
+	Policies         []Policy             `json:"policies,omitempty"`
+}
+
+// ExporterAccessPolicyStatus defines the observed state of ExporterAccessPolicy.
+type ExporterAccessPolicyStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+
+// ExporterAccessPolicy is the Schema for the exporteraccesspolicies API.
+type ExporterAccessPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ExporterAccessPolicySpec   `json:"spec,omitempty"`
+	Status ExporterAccessPolicyStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ExporterAccessPolicyList contains a list of ExporterAccessPolicy.
+type ExporterAccessPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ExporterAccessPolicy `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ExporterAccessPolicy{}, &ExporterAccessPolicyList{})
+}

api/v1alpha1/lease_types.go

@@ -41,6 +41,8 @@ type LeaseStatus struct {
 	EndTime     *metav1.Time                 `json:"endTime,omitempty"`
 	ExporterRef *corev1.LocalObjectReference `json:"exporterRef,omitempty"`
 	Ended       bool                         `json:"ended"`
+	Priority    int                          `json:"priority,omitempty"`
+	SpotAccess  bool                         `json:"spotAccess,omitempty"`
 	Conditions  []metav1.Condition           `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
 }