authentik.providers.proxy.controllers.k8s.traefik_3

  1"""Kubernetes Traefik Middleware Reconciler"""
  2
  3from dataclasses import asdict, dataclass, field
  4from typing import TYPE_CHECKING
  5
  6from dacite.core import from_dict
  7from kubernetes.client import ApiextensionsV1Api, CustomObjectsApi
  8
  9from authentik.outposts.controllers.base import FIELD_MANAGER
 10from authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler
 11from authentik.outposts.controllers.k8s.triggers import NeedsUpdate
 12from authentik.providers.proxy.models import ProxyMode, ProxyProvider
 13
 14if TYPE_CHECKING:
 15    from authentik.outposts.controllers.kubernetes import KubernetesController
 16
 17
 18@dataclass(slots=True)
 19class TraefikMiddlewareSpecForwardAuth:
 20    """traefik middleware forwardAuth spec"""
 21
 22    address: str
 23
 24    authResponseHeadersRegex: str = field(default="")
 25
 26    authResponseHeaders: list[str] = field(default_factory=list)
 27
 28    trustForwardHeader: bool = field(default=True)
 29
 30    maxResponseBodySize: int = field(default=1024 * 1024 * 4)
 31
 32
 33@dataclass(slots=True)
 34class TraefikMiddlewareSpec:
 35    """Traefik middleware spec"""
 36
 37    forwardAuth: TraefikMiddlewareSpecForwardAuth
 38
 39
 40@dataclass(slots=True)
 41class TraefikMiddlewareMetadata:
 42    """Traefik Middleware metadata"""
 43
 44    name: str
 45    namespace: str
 46    labels: dict = field(default_factory=dict)
 47
 48
 49@dataclass(slots=True)
 50class TraefikMiddleware:
 51    """Traefik Middleware"""
 52
 53    apiVersion: str
 54    kind: str
 55    metadata: TraefikMiddlewareMetadata
 56    spec: TraefikMiddlewareSpec
 57
 58
 59class Traefik3MiddlewareReconciler(KubernetesObjectReconciler[TraefikMiddleware]):
 60    """Kubernetes Traefik Middleware Reconciler"""
 61
 62    def __init__(self, controller: KubernetesController) -> None:
 63        super().__init__(controller)
 64        self.api_ex = ApiextensionsV1Api(controller.client)
 65        self.api = CustomObjectsApi(controller.client)
 66        self.crd_name = "middlewares.traefik.io"
 67        self.crd_group = "traefik.io"
 68        self.crd_version = "v1alpha1"
 69        self.crd_plural = "middlewares"
 70
 71    @staticmethod
 72    def reconciler_name() -> str:
 73        return "traefik middleware"
 74
 75    @property
 76    def noop(self) -> bool:
 77        if not ProxyProvider.objects.filter(
 78            outpost__in=[self.controller.outpost],
 79            mode__in=[ProxyMode.FORWARD_SINGLE, ProxyMode.FORWARD_DOMAIN],
 80        ).exists():
 81            self.logger.debug("No providers with forward auth enabled.")
 82            return True
 83        if not self.crd_exists():
 84            self.logger.debug("CRD doesn't exist")
 85            return True
 86        return False
 87
 88    def crd_exists(self) -> bool:
 89        """Check if the traefik middleware exists"""
 90        return bool(
 91            len(
 92                self.api_ex.list_custom_resource_definition(
 93                    field_selector=f"metadata.name={self.crd_name}"
 94                ).items
 95            )
 96        )
 97
 98    def reconcile(self, current: TraefikMiddleware, reference: TraefikMiddleware):
 99        super().reconcile(current, reference)
100        if current.spec.forwardAuth.address != reference.spec.forwardAuth.address:
101            raise NeedsUpdate()
102        if (
103            current.spec.forwardAuth.authResponseHeadersRegex
104            != reference.spec.forwardAuth.authResponseHeadersRegex
105        ):
106            raise NeedsUpdate()
107        # Ensure all of our headers are set, others can be added by the user.
108        if not set(current.spec.forwardAuth.authResponseHeaders).issubset(
109            reference.spec.forwardAuth.authResponseHeaders
110        ):
111            raise NeedsUpdate()
112
113    def get_reference_object(self) -> TraefikMiddleware:
114        """Get deployment object for outpost"""
115        return TraefikMiddleware(
116            apiVersion=f"{self.crd_group}/{self.crd_version}",
117            kind="Middleware",
118            metadata=TraefikMiddlewareMetadata(
119                name=self.name,
120                namespace=self.namespace,
121                labels=self.get_object_meta().labels,
122            ),
123            spec=TraefikMiddlewareSpec(
124                forwardAuth=TraefikMiddlewareSpecForwardAuth(
125                    address=(
126                        f"http://{self.name}.{self.namespace}:9000/"
127                        "outpost.goauthentik.io/auth/traefik"
128                    ),
129                    authResponseHeaders=[
130                        "X-authentik-username",
131                        "X-authentik-groups",
132                        "X-authentik-entitlements",
133                        "X-authentik-email",
134                        "X-authentik-name",
135                        "X-authentik-uid",
136                        "X-authentik-jwt",
137                        "X-authentik-meta-jwks",
138                        "X-authentik-meta-outpost",
139                        "X-authentik-meta-provider",
140                        "X-authentik-meta-app",
141                        "X-authentik-meta-version",
142                    ],
143                    authResponseHeadersRegex="",
144                    trustForwardHeader=True,
145                    maxResponseBodySize=1024 * 1024 * 4,
146                )
147            ),
148        )
149
150    def create(self, reference: TraefikMiddleware):
151        return self.api.create_namespaced_custom_object(
152            group=self.crd_group,
153            version=self.crd_version,
154            plural=self.crd_plural,
155            namespace=self.namespace,
156            body=asdict(reference),
157            field_manager=FIELD_MANAGER,
158        )
159
160    def delete(self, reference: TraefikMiddleware):
161        return self.api.delete_namespaced_custom_object(
162            group=self.crd_group,
163            version=self.crd_version,
164            plural=self.crd_plural,
165            namespace=self.namespace,
166            name=self.name,
167        )
168
169    def retrieve(self) -> TraefikMiddleware:
170        return from_dict(
171            TraefikMiddleware,
172            self.api.get_namespaced_custom_object(
173                group=self.crd_group,
174                version=self.crd_version,
175                plural=self.crd_plural,
176                namespace=self.namespace,
177                name=self.name,
178            ),
179        )
180
181    def update(self, current: TraefikMiddleware, reference: TraefikMiddleware):
182        return self.api.patch_namespaced_custom_object(
183            group=self.crd_group,
184            version=self.crd_version,
185            plural=self.crd_plural,
186            namespace=self.namespace,
187            name=self.name,
188            body=asdict(reference),
189            field_manager=FIELD_MANAGER,
190        )