Skip to content

[RFC-0014] Upgrade auth #1776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matheuscscp merged 1 commit into from
Oct 22, 2026
Merged

[RFC-0014] Upgrade auth #1776

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions api/v1/metrics.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,9 @@ const (
// decryption attempts using GCP KMS.
MetricDecryptWithGCP = "decrypt_with_gcp"

// MetricDecryptWithVault is the metric name for counting
// decryption attempts using OpenBao/Vault transit
// authenticated with the Kubernetes auth method.
MetricDecryptWithVault = "decrypt_with_vault"
// MetricDecryptWithTransitEngine is the metric name for counting
// decryption attempts using OpenBao/Vault's transit engine.
MetricDecryptWithTransitEngine = "decrypt_with_transit_engine"

@matheuscscp matheuscscp Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a breaking change but I consider it very minor:

  • Released in Flux 2.9 (last release, too recent).
  • Sort of niche feature.
  • Chances of someone using it + relying on the cache metrics?

I will personally apologize to anyone we break with this.

)

// AllMetrics is the list of all supported cache metrics.
Expand All @@ -45,5 +44,5 @@ var AllMetrics = []string{
MetricDecryptWithAWS,
MetricDecryptWithAzure,
MetricDecryptWithGCP,
MetricDecryptWithVault,
MetricDecryptWithTransitEngine,
}
13 changes: 7 additions & 6 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,16 @@ require (
github.com/fluxcd/cli-utils v1.4.0
github.com/fluxcd/kustomize-controller/api v1.9.0
github.com/fluxcd/pkg/apis/acl v0.12.0
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/apis/event v0.32.0
github.com/fluxcd/pkg/apis/kustomize v1.23.0
github.com/fluxcd/pkg/apis/meta v1.35.0
github.com/fluxcd/pkg/auth v0.62.0
github.com/fluxcd/pkg/cache v0.17.0
github.com/fluxcd/pkg/http/fetch v0.28.0
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/kustomize v1.43.0
github.com/fluxcd/pkg/masktoken v0.10.0
github.com/fluxcd/pkg/runtime v0.119.0
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/ssa v0.80.0
github.com/fluxcd/pkg/tar v1.3.0
github.com/fluxcd/pkg/testserver v0.15.0
Expand Down Expand Up @@ -219,7 +220,7 @@ require (
github.com/ryanuber/go-glob v1.0.0 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/spf13/cobra v1.10.2 // indirect
github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
github.com/spiffe/go-spiffe/v2 v2.9.0 // indirect
github.com/tidwall/gjson v1.18.0 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
Expand Down
26 changes: 14 additions & 12 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,26 +205,28 @@ github.com/fluxcd/cli-utils v1.4.0 h1:zlTiCWcVDQvvwZXILYeu5rpbnGt1sS+w32y3+rkOpi
github.com/fluxcd/cli-utils v1.4.0/go.mod h1:OupUOj2boEKTbiguMbGMz5Z/d59JUcb1c7pPESe8Pjw=
github.com/fluxcd/pkg/apis/acl v0.12.0 h1:UWpZDqKxpKDW38wdXIMHV8Uv3POPu2vUrra0JH1frH0=
github.com/fluxcd/pkg/apis/acl v0.12.0/go.mod h1:PJrGIu5Bw/6/siO95uhS+pi5oKSU+gVJqHqsPHb8Kok=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad h1:SAzeZibDaqyyq7CaccwDEySCcsOMGGuHmEN28LcRPvM=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
github.com/fluxcd/pkg/apis/event v0.32.0 h1:3zyjdUspwQN+EQJPlUXwCvCMbeqtB+azlNmeenAcbuE=
github.com/fluxcd/pkg/apis/event v0.32.0/go.mod h1:ALma8dTqo+NbI+z4BawSzt0pAPjetCSNNUSSS/9p0VU=
github.com/fluxcd/pkg/apis/kustomize v1.23.0 h1:tT/sUURyh6ixQG4+Y/ZoUu+hh5/DQLRraWBgy42ubqQ=
github.com/fluxcd/pkg/apis/kustomize v1.23.0/go.mod h1:Jm/LmEsqJIldhhTmhkORAq8JKVZK3ZV2Q88rntjGxEI=
github.com/fluxcd/pkg/apis/meta v1.35.0 h1:/k5d7uEFrxkz/hf6JTrdsKBr3UQWVHW2J4G6VSSae/k=
github.com/fluxcd/pkg/apis/meta v1.35.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
github.com/fluxcd/pkg/auth v0.62.0 h1:ZhrkfoLTaH5Q095sNGLZ47zLYw/AHw4nVnPAspGwT/c=
github.com/fluxcd/pkg/auth v0.62.0/go.mod h1:46lKYjDvx5Q7fsq09ZC1BxXJcstTOfm2X/NFLLFn7wA=
github.com/fluxcd/pkg/cache v0.17.0 h1:197ST7bSJD2Nw4G01y5cMjtWQpwQsyjpl2ox4MaGeU8=
github.com/fluxcd/pkg/cache v0.17.0/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad h1:p/W9d+gf9FuNNmiwUZJT7ReGzTzwuYLUago5szqkq5I=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad h1:lUjY+hEXSYG8RdJhuNYl5mjkrnLpwuG/+A+iSybCRlE=
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad/go.mod h1:gWbB4MzuHWalVyI0o4lE84aINidor9+S63ithckm+94=
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad h1:Lf7S9vl776ZW7SDxdQtZcEu1vjWroZS86ePd8gost4M=
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
github.com/fluxcd/pkg/envsubst v1.9.0 h1:QTagwV4WLmqF+JsD1rGkcKFmmj4HV64BnqNM1T311kc=
github.com/fluxcd/pkg/envsubst v1.9.0/go.mod h1:9VgSWepmQj/H3icObqh65DNodrUz8P88QnM3EaSE5mA=
github.com/fluxcd/pkg/http/fetch v0.28.0 h1:kpHUma2XiyFvko4ZSNL9fvrcuPtfGAg07/2IZ2ZaPCw=
github.com/fluxcd/pkg/http/fetch v0.28.0/go.mod h1:SOq8vrzru2zipskTEguXzKHabn2ASyXESQ/DY93FafY=
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261020182949-c5194b17fdad h1:4p82I7nwRjpjoSoh8d0MOsJNf1GmurOyd8UVgKFznTY=
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261020182949-c5194b17fdad/go.mod h1:SOq8vrzru2zipskTEguXzKHabn2ASyXESQ/DY93FafY=
github.com/fluxcd/pkg/kustomize v1.43.0 h1:WNa1+KaoNvR1GNafPP6lCj+PZssOWycYIJBE/3h+yxI=
github.com/fluxcd/pkg/kustomize v1.43.0/go.mod h1:V/hHWuJyD0aqwA9tZJC6jPQHUuOJYTn0kaY3V8FGkiQ=
github.com/fluxcd/pkg/masktoken v0.10.0 h1:jY9tuBIS1T7z9F8nJc9ozT0QrI391Se9vMu0eMd/wvE=
github.com/fluxcd/pkg/masktoken v0.10.0/go.mod h1:zOCZp3trYmD5/csLOizvIGTi4gn76nnkTFu+vKOJufo=
github.com/fluxcd/pkg/runtime v0.119.0 h1:cY2KpQ4WwpQKG+pFToslSIXUjKK8ckHQ7cvPUc/QHiY=
github.com/fluxcd/pkg/runtime v0.119.0/go.mod h1:7LJFbZPXwl++ATADx6bt63Jh9CverBoXQxbluxPwspw=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad h1:AcQzxznBRZyRthcVgFjPV49uLfu7eDOoHO1B5WyRsO8=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
github.com/fluxcd/pkg/sourceignore v0.21.0 h1:p65j81RzXAeL4KJKgbkFRou+xiA0841CUdAsOCSAb5o=
github.com/fluxcd/pkg/sourceignore v0.21.0/go.mod h1:N9NFuxbEMm+UPtP9t+Oyx5LEs0uHu7W+WVPmdlIbCeY=
github.com/fluxcd/pkg/ssa v0.80.0 h1:GgakpCFz4pY+unpOscPYlc5eVLUsB7hw9TmWSNr3yp8=
Expand Down Expand Up @@ -481,8 +483,8 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E=
github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
github.com/spiffe/go-spiffe/v2 v2.9.0 h1:g5qTg3qIP1HXV+GzuyEfSJFVxUCpEP5Ui1OINVJHPB4=
github.com/spiffe/go-spiffe/v2 v2.9.0/go.mod h1:w2CLWKLMTX/PPYUEUPv3ltH0RXsw5S8suwNF46w9/Aw=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
Expand Down
15 changes: 12 additions & 3 deletions internal/controller/kustomization_configuration_error_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,13 @@ import (
"time"

. "github.com/onsi/gomega"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"sigs.k8s.io/controller-runtime/pkg/client"

"github.com/fluxcd/pkg/apis/kustomize"
"github.com/fluxcd/pkg/apis/meta"
"github.com/fluxcd/pkg/auth"
"github.com/fluxcd/pkg/runtime/conditions"
"github.com/fluxcd/pkg/testserver"
sourcev1 "github.com/fluxcd/source-controller/api/v1"
Expand Down Expand Up @@ -178,8 +178,8 @@ data: {}
t.Run("object level workload identity feature gate enabled", func(t *testing.T) {
g := NewWithT(t)

auth.EnableObjectLevelWorkloadIdentity()
t.Cleanup(auth.DisableObjectLevelWorkloadIdentity)
reconciler.ObjectLevelWorkloadIdentity = true
t.Cleanup(func() { reconciler.ObjectLevelWorkloadIdentity = false })

kustomizationKey := types.NamespacedName{
Name: fmt.Sprintf("invalid-config-%s", randStringRunes(5)),
Expand All @@ -206,6 +206,15 @@ data: {}
},
}

sa := &corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
Namespace: id,
},
}
g.Expect(k8sClient.Create(context.Background(), sa)).To(Succeed())
t.Cleanup(func() { _ = k8sClient.Delete(context.Background(), sa) })

err = k8sClient.Create(context.Background(), kustomization)
g.Expect(err).NotTo(HaveOccurred())

Expand Down
64 changes: 39 additions & 25 deletions internal/controller/kustomization_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,13 +103,15 @@ type KustomizationReconciler struct {

// Multi-tenancy and security options

DefaultServiceAccount string
DisallowedFieldManagers []string
NoCrossNamespaceRefs bool
NoRemoteBases bool
SOPSAgeSecret string
SOPSVaultConfigMap string
TokenCache *cache.TokenCache
DefaultServiceAccount string
DefaultDecryptionServiceAccount string
DefaultKubeConfigServiceAccount string
DisallowedFieldManagers []string
NoCrossNamespaceRefs bool
NoRemoteBases bool
SOPSAgeSecret string
SOPSVaultConfigMap string
TokenCache *cache.TokenCache

// Retry and requeue options

Expand All @@ -118,14 +120,15 @@ type KustomizationReconciler struct {

// Feature gates

AdditiveCELDependencyCheck bool
AllowExternalArtifact bool
DisableCommitStatusEvent bool
DirectSourceFetch bool
FailFast bool
GroupChangeLog bool
MigrateAPIVersion bool
StrictSubstitutions bool
AdditiveCELDependencyCheck bool
AllowExternalArtifact bool
DisableCommitStatusEvent bool
DirectSourceFetch bool
FailFast bool
GroupChangeLog bool
MigrateAPIVersion bool
ObjectLevelWorkloadIdentity bool
StrictSubstitutions bool
}

func (r *KustomizationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, retErr error) {
Expand Down Expand Up @@ -210,7 +213,7 @@ func (r *KustomizationReconciler) Reconcile(ctx context.Context, req ctrl.Reques
}

// Check object-level workload identity feature gate and decryption with service account.
if d := obj.Spec.Decryption; d != nil && d.ServiceAccountName != "" && !auth.IsObjectLevelWorkloadIdentityEnabled() {
if d := obj.Spec.Decryption; d != nil && d.ServiceAccountName != "" && !r.ObjectLevelWorkloadIdentity {
const gate = auth.FeatureGateObjectLevelWorkloadIdentity
const msgFmt = "to use spec.decryption.serviceAccountName for decryption authentication please enable the %s feature gate in the controller"
msg := fmt.Sprintf(msgFmt, gate)
Expand Down Expand Up @@ -809,6 +812,9 @@ func (r *KustomizationReconciler) build(ctx context.Context,
if r.TokenCache != nil {
decryptorOpts = append(decryptorOpts, decryptor.WithTokenCache(*r.TokenCache))
}
if r.DefaultDecryptionServiceAccount != "" {
decryptorOpts = append(decryptorOpts, decryptor.WithDefaultServiceAccount(r.DefaultDecryptionServiceAccount))
}
if name, ns := r.SOPSAgeSecret, os.Getenv(runtimeCtrl.EnvRuntimeNamespace); name != "" && ns != "" {
decryptorOpts = append(decryptorOpts, decryptor.WithSOPSAgeSecret(name, ns))
}
Expand All @@ -827,7 +833,9 @@ func (r *KustomizationReconciler) build(ctx context.Context,
}

// Set options for secret-less authentication with cloud providers for decryption.
dec.SetAuthOptions(ctx)
if err := dec.SetAuthOptions(ctx); err != nil {
return nil, err
}

// Decrypt Kustomize EnvSources files before build
if err = dec.DecryptSources(dirPath); err != nil {
Expand Down Expand Up @@ -1442,16 +1450,22 @@ func (r *KustomizationReconciler) getClientAndPoller(
func (r *KustomizationReconciler) getProviderRESTConfigFetcher(obj *kustomizev1.Kustomization) runtimeClient.ProviderRESTConfigFetcher {
var provider runtimeClient.ProviderRESTConfigFetcher
if kc := obj.Spec.KubeConfig; kc != nil && kc.SecretRef == nil && kc.ConfigMapRef != nil {
var opts []auth.Option
var opts []authutils.Option
if r.DefaultKubeConfigServiceAccount != "" {
opts = append(opts, authutils.WithDefaultServiceAccount(r.DefaultKubeConfigServiceAccount))
}
if r.ObjectLevelWorkloadIdentity {
opts = append(opts, authutils.WithObjectLevelWorkloadIdentity())
}
authOpts := []auth.Option{
auth.WithObject(kustomizev1.GroupVersion.Group, kustomizev1.KustomizationKind, obj),
}
if r.TokenCache != nil {
involvedObject := cache.InvolvedObject{
Kind: kustomizev1.KustomizationKind,
Name: obj.GetName(),
Namespace: obj.GetNamespace(),
Operation: kustomizev1.MetricFetchKubeConfig,
}
opts = append(opts, auth.WithCache(*r.TokenCache, involvedObject))
authOpts = append(authOpts,
auth.WithCache(*r.TokenCache),
auth.WithCacheOperation(kustomizev1.MetricFetchKubeConfig))
}
opts = append(opts, authutils.WithAuthOptions(authOpts...))
provider = runtimeClient.ProviderRESTConfigFetcher(authutils.GetRESTConfigFetcher(opts...))
}
return provider
Expand Down
Loading
Loading