Skip to content

Commit 50f0e31

Browse files
philipgoughphilipgough
committed
Fix issue with path matching logic
1 parent 06979c6 commit 50f0e31

10 files changed

Lines changed: 155 additions & 173 deletions

File tree

‎authentication/oidc.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,25 +327,31 @@ func (a oidcAuthenticator) Middleware() Middleware {
327327
return func(next http.Handler) http.Handler {
328328
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
329329
// Check if OIDC is required for this path
330+
level.Debug(a.logger).Log("msg", "OIDC middleware checking path", "path", r.URL.Path, "pathMatchers", len(a.pathMatchers))
330331
if len(a.pathMatchers) > 0 {
331332
shouldEnforceOIDC := false
332333

333334
for _, matcher := range a.pathMatchers {
334335
regexMatches := matcher.Regex.MatchString(r.URL.Path)
336+
level.Debug(a.logger).Log("msg", "OIDC path pattern check", "path", r.URL.Path, "operator", matcher.Operator, "pattern", matcher.Regex.String(), "matches", regexMatches)
335337

336338
if matcher.Operator == "=~" && regexMatches {
337339
// Positive match - enforce OIDC
340+
level.Debug(a.logger).Log("msg", "OIDC positive match - enforcing", "path", r.URL.Path)
338341
shouldEnforceOIDC = true
339342
break
340343
} else if matcher.Operator == "!~" && !regexMatches {
341344
// Negative match - enforce OIDC (path does NOT match pattern)
345+
level.Debug(a.logger).Log("msg", "OIDC negative match - enforcing", "path", r.URL.Path)
342346
shouldEnforceOIDC = true
343347
break
344348
}
345349
}
346350

351+
level.Debug(a.logger).Log("msg", "OIDC enforcement decision", "path", r.URL.Path, "shouldEnforceOIDC", shouldEnforceOIDC)
347352
// If no patterns matched requirements, skip OIDC enforcement
348353
if !shouldEnforceOIDC {
354+
level.Debug(a.logger).Log("msg", "OIDC skipping enforcement", "path", r.URL.Path)
349355
next.ServeHTTP(w, r)
350356
return
351357
}

‎main.go‎

Lines changed: 11 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -238,11 +238,10 @@ type tenant struct {
238238
IssuerRawCA []byte `json:"issuerCA"`
239239
IssuerCAPath string `json:"issuerCAPath"`
240240
issuerCA *x509.Certificate
241-
IssuerURL string `json:"issuerURL"`
242-
RedirectURL string `json:"redirectURL"`
243-
UsernameClaim string `json:"usernameClaim"`
244-
Paths []string `json:"paths"`
245-
pathMatchers []*regexp.Regexp
241+
IssuerURL string `json:"issuerURL"`
242+
RedirectURL string `json:"redirectURL"`
243+
UsernameClaim string `json:"usernameClaim"`
244+
Paths []authentication.PathPattern `json:"paths"`
246245
config map[string]interface{}
247246
} `json:"oidc"`
248247
OpenShift *struct {
@@ -258,12 +257,11 @@ type tenant struct {
258257
} `json:"authenticator"`
259258

260259
MTLS *struct {
261-
RawCA []byte `json:"ca"`
262-
CAPath string `json:"caPath"`
263-
Paths []string `json:"paths"`
264-
cas []*x509.Certificate
265-
pathMatchers []*regexp.Regexp
266-
config map[string]interface{}
260+
RawCA []byte `json:"ca"`
261+
CAPath string `json:"caPath"`
262+
Paths []authentication.PathPattern `json:"paths"`
263+
cas []*x509.Certificate
264+
config map[string]interface{}
267265
} `json:"mTLS"`
268266
OPA *struct {
269267
Query string `json:"query"`
@@ -368,23 +366,8 @@ func main() {
368366
continue
369367
}
370368

371-
// Compile OIDC path matchers
372-
for _, pathPattern := range t.OIDC.Paths {
373-
matcher, err := regexp.Compile(pathPattern)
374-
if err != nil {
375-
skip.Log("msg", "failed to compile OIDC path pattern", "pattern", pathPattern, "err", err, "tenant", t.Name)
376-
skippedTenants.WithLabelValues(t.Name).Inc()
377-
tenantsCfg.Tenants[i] = nil
378-
break
379-
}
380-
t.OIDC.pathMatchers = append(t.OIDC.pathMatchers, matcher)
381-
}
382-
if tenantsCfg.Tenants[i] == nil {
383-
continue
384-
}
385-
386369
// Add path patterns to the config that will be passed to the authenticator
387-
oidcConfig["pathPatterns"] = t.OIDC.Paths
370+
oidcConfig["paths"] = t.OIDC.Paths
388371
t.OIDC.config = oidcConfig
389372
}
390373

@@ -397,23 +380,8 @@ func main() {
397380
continue
398381
}
399382

400-
// Compile mTLS path matchers
401-
for _, pathPattern := range t.MTLS.Paths {
402-
matcher, err := regexp.Compile(pathPattern)
403-
if err != nil {
404-
skip.Log("msg", "failed to compile mTLS path pattern", "pattern", pathPattern, "err", err, "tenant", t.Name)
405-
skippedTenants.WithLabelValues(t.Name).Inc()
406-
tenantsCfg.Tenants[i] = nil
407-
break
408-
}
409-
t.MTLS.pathMatchers = append(t.MTLS.pathMatchers, matcher)
410-
}
411-
if tenantsCfg.Tenants[i] == nil {
412-
continue
413-
}
414-
415383
// Add path patterns to the config that will be passed to the authenticator
416-
mTLSConfig["pathPatterns"] = t.MTLS.Paths
384+
mTLSConfig["paths"] = t.MTLS.Paths
417385
t.MTLS.config = mTLSConfig
418386
}
419387

@@ -1605,7 +1573,6 @@ func tenantAuthenticatorConfig(t *tenant) (map[string]interface{}, string, error
16051573
}
16061574
}
16071575

1608-
16091576
type otelErrorHandler struct {
16101577
logger log.Logger
16111578
}

‎test/kind/extract-config.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,15 @@ tenants:
3131
redirectURL: http://localhost:8080/oidc/auth-tenant/callback
3232
usernameClaim: email
3333
paths:
34-
- "!^/api/(logs|metrics)/v1/auth-tenant/(loki/api/v1/push|api/v1/receive)"
34+
- operator: "!~"
35+
pattern: ".*(loki/api/v1/push|api/v1/receive).*"
3536
mTLS:
3637
caPath: /etc/certs/ca.crt
3738
paths:
38-
- "^/api/metrics/v1/auth-tenant/api/v1/receive.*"
39-
- "^/api/logs/v1/auth-tenant/loki/api/v1/push.*"
39+
- operator: "=~"
40+
pattern: ".*(api/v1/receive).*"
41+
- operator: "=~"
42+
pattern: ".*(loki/api/v1/push).*"
4043
EOF
4144

4245
# Generate RBAC configuration

‎test/kind/testdata/admin-client.crt‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIDdDCCAlygAwIBAgIQISXA9OIYkpj2FSjsrxRs0zANBgkqhkiG9w0BAQsFADBH
2+
MIIDdDCCAlygAwIBAgIQZwWAT+xXMnHkHRiyDqr1TTANBgkqhkiG9w0BAQsFADBH
33
MSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0b3JpdW0xGTAX
4-
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTUwNjQ3WhcNMjYwNzA4
5-
MTUwNjQ3WjBEMSswEwYDVQQLEwxBZG1pbiBDbGllbnQwFAYDVQQLEw1PYnNlcnZh
4+
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTYxNzIwWhcNMjYwNzA4
5+
MTYxNzIwWjBEMSswEwYDVQQLEwxBZG1pbiBDbGllbnQwFAYDVQQLEw1PYnNlcnZh
66
dG9yaXVtMRUwEwYDVQQDEwxhZG1pbi1jbGllbnQwggEiMA0GCSqGSIb3DQEBAQUA
7-
A4IBDwAwggEKAoIBAQDYVrY4uE7tyhhcdNkTOATicOYLbIKU742dfUYkD39eoa1o
8-
PZ72dd+smlzZdRfY94uyZZnaPbCa/WqdgeP2WmPQFw5pA3e3CKgYkSoo8CjgAMaJ
9-
PB7mcfGqyzu6otWSqTvbki6VogJqzng+oZSuNsiNEvC2ck7z/NQwkl7rvQOYttjb
10-
UUrEp3yGcTwja7dbrZPCIWGOL9K+voBTQ3z/mFrAx7JJBmcHLF5YmvwkIJYGRazn
11-
fiHNvznSO+gY7Gccpf5R6dNeV0fGMhc4+EJnza54HVUgJUk+rM16yzhictrYbXrY
12-
hV2tjmQwBPCEy9Kz2qPiOjU8WZ4ImDSvZrjoH6brAgMBAAGjXzBdMBMGA1UdJQQM
13-
MAoGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU4U8ywddzvSa/
14-
DJdyObCu+QXwip4wFwYDVR0RBBAwDoIMYWRtaW4tY2xpZW50MA0GCSqGSIb3DQEB
15-
CwUAA4IBAQCK46fCwAJuunj5nVUo2JAdfReZG176u6hqSd0T4XFT7B4YKLOmJXIR
16-
edWTpn79ooS52WRW41igfT6ko1eiZd7PjBbvMYofSajIXtgvORnX7JGxYs5Qev8r
17-
yxq0H4KrwUSygNWL00OXy/zAl7+VtJhzoGzdKoLf5pxi1QCxolh4URBF8caqb5/D
18-
u1YY7M3vlUVJFC7vObcorXr6kuPd/ywZnZALecOMMlwKds02R51xz+EakbNZnp6G
19-
sFCL1V3NIGkoH5dvSRkubvjUIHb1YZhaxk9iafsbxNUvYct9Glf0xyQkkQ+KlTgj
20-
69oWFJXWm0RJFVSMYi8oX8NgWEwifSsv
7+
A4IBDwAwggEKAoIBAQCxu5gX+vfEsnVKodrZNYBrIYjCJ+rK9+A4DOO8t4P4ZLjp
8+
oTubyRZsTNSk/UUNvlGmAhkZRdN8TqZWKoYb/F3/lljD4fGk6IhajFs9qZvUBEFZ
9+
F/+u8jk73pRSl2/nAgsiiRXh4kwzGniFwpO1mfQkBJZXtE0NLTMCWFG0ImHGtNQp
10+
/K/fPUdo69irOsqtmfYFCK0DZQ/zdtFeRAhbw/nv82OvVr16FdB4KUU7KMizjHdk
11+
jgoLH6EWGB7VYX3cl2p+Y6c94yfWWKhIQQ59HDwobM0t9vyFTlljI6Qm9hf8hlDZ
12+
PuKwK/2AIc8OLHSmUvI9t8KItguYqGmZ5o3EGbedAgMBAAGjXzBdMBMGA1UdJQQM
13+
MAoGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUoz7Q2xINENmG
14+
IyzlZmtAuTYAuuYwFwYDVR0RBBAwDoIMYWRtaW4tY2xpZW50MA0GCSqGSIb3DQEB
15+
CwUAA4IBAQCBbvc/v9jAfVW10h5NRKJe+Ppx9wwpE+eLQiK/BQs3X0KzLdwMH1nn
16+
tk5E2VzKmg2YlgCAx0Jf0bCEnI1PAt2HNKNmgreEYpicg/+EFr5xpaPfCvK4YCoT
17+
4i3lqXEa9FsosXEcXe7XsbPta6yVE2bISqi2zMM/PPdML2ws9bwDBrXSiMZ9bfCD
18+
zEVH4KuspLNzj2Gk0A7sTCx5kHGnHgFpikw97t9pvHL9VeaQPPxWddzLAylvUobq
19+
3cYLy/D5N3GmPxUm5HA9JDqgkjJRjVXygH1ZW3YIa1FTyIhEJ+Pje8yqdNPVP3hc
20+
V0XQe0C47IPgHPGJXUB1p+VZnJ/M+BbI
2121
-----END CERTIFICATE-----

‎test/kind/testdata/admin-client.key‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
11
-----BEGIN RSA PRIVATE KEY-----
2-
MIIEpQIBAAKCAQEA2Fa2OLhO7coYXHTZEzgE4nDmC2yClO+NnX1GJA9/XqGtaD2e
3-
9nXfrJpc2XUX2PeLsmWZ2j2wmv1qnYHj9lpj0BcOaQN3twioGJEqKPAo4ADGiTwe
4-
5nHxqss7uqLVkqk725IulaICas54PqGUrjbIjRLwtnJO8/zUMJJe670DmLbY21FK
5-
xKd8hnE8I2u3W62TwiFhji/Svr6AU0N8/5hawMeySQZnByxeWJr8JCCWBkWs534h
6-
zb850jvoGOxnHKX+UenTXldHxjIXOPhCZ82ueB1VICVJPqzNess4YnLa2G162IVd
7-
rY5kMATwhMvSs9qj4jo1PFmeCJg0r2a46B+m6wIDAQABAoIBAQCfEBJm3czatW73
8-
+8nngZbFz3C1EZFpZEDhfMxnkyV5NLLFJBmO6NgOlmiSUq+4DTqfbmiSuCzzqEQN
9-
jwVHiuo8g9dKiwwofarqdUFkXEARg0B2gsfNdBXWGBvQfA1ACkJCjNbHmhjg4vIy
10-
SqeA+DK41yY5Xw6CAnEZTWWROqY8T0orMOJzomTHredE9qrFGtwVgrj2e5LOuUuQ
11-
j+jj8AZAnCcB8916Sd4lg1YCOI/YQYi2lg50BPMhkKw9BuhNYz01NnKKPiTKULB4
12-
evooLet+ryRfkHyciZ5uT6Lzd51RVkkW5wcyA3bhhXyy8BKoaMMmzucqqGTf3OkZ
13-
ONkpfmIhAoGBAPILMH3r6BaiR6qx3qUVARbL4GtjUjjhEMGyCGJnVdo+iJWrAWm3
14-
mARtLycGcuMc3JFDuQunV0NuMDkz0NJdOM5FfQyUsuOqboNtn2+H4VrXhmEKrMxj
15-
O8Gom7HVITRzP8zSvM82IJHmMk/xbusZkwG+SAiQmIrW/QT13ExhyWppAoGBAOTQ
16-
FzUPChfQk3I1689Ilp1TQSELp9xu3Wi5NGxhR1MwC6pJUa08f+UVwYTdKwluSSF2
17-
PEyNWVtfbLHqCClE8uq/JcSFUQzA+4bo9pEASbn6vluX+qC5McQnB6QzsJ3Qvg6E
18-
WoolpBzqpfTdi8ahEpUl0NerV5Zq0KNfNrQgzVQzAoGBAJ9OzBDlN3HGR8NKpQ8k
19-
nv3hHImx6okzYXMLecdC2lf19rIDxr9NLoojTvixnuZqtaYK2/2Wm7HvEWBlAVmk
20-
L+JcDC0+peuA3pI0kc63sZS37GNswkUYP1l8X1WRwPQjsudeARWlO5Sr3YuOjgHB
21-
aGeqVQEGItCnJgugwumnJwmZAoGADVOVVnDGzLZIMCm1zz/SDd2weGU+ZJdMa/IF
22-
fJ550f2FYGieyjEw3b3TpJJhFE6JEdraDjdZUfoP0Zjo2sZ6Q3PYlkaRfuWqgKQG
23-
4FEc+ikBd0I1xbCjlmITjtu32Kk0uJG62DrzAQAlpEpW/r2Y4HjwXe9LzaXw+uLr
24-
w7f5XYMCgYEAjWqZMr0Kq2SkhWqErKPQedQfvjkWC/IGg0doKJ0MmijvG3drbRdF
25-
QCeGFPWFbs2/027tknHdqzov6EucD12p1cv04Dm2X1Gttn26rUK5pFTeim635mYI
26-
xxt0bT75MogZGFGv+KvNe1kR1SUuF15YgquK4ppJ/bvX3fB44iHur7c=
2+
MIIEogIBAAKCAQEAsbuYF/r3xLJ1SqHa2TWAayGIwifqyvfgOAzjvLeD+GS46aE7
3+
m8kWbEzUpP1FDb5RpgIZGUXTfE6mViqGG/xd/5ZYw+HxpOiIWoxbPamb1ARBWRf/
4+
rvI5O96UUpdv5wILIokV4eJMMxp4hcKTtZn0JASWV7RNDS0zAlhRtCJhxrTUKfyv
5+
3z1HaOvYqzrKrZn2BQitA2UP83bRXkQIW8P57/Njr1a9ehXQeClFOyjIs4x3ZI4K
6+
Cx+hFhge1WF93JdqfmOnPeMn1lioSEEOfRw8KGzNLfb8hU5ZYyOkJvYX/IZQ2T7i
7+
sCv9gCHPDix0plLyPbfCiLYLmKhpmeaNxBm3nQIDAQABAoIBACWHJNA7b8GapOWD
8+
U4B1qY31YLkOUKdWu4NaRWP9o+H48opyPvHf/doURvoneEM0omzZGI+bjNI8kSa0
9+
h+i02uwyxL9nn+xgJRppdIKKo5qa42l6hcRc5PTdRJhD3Z77cXpzU6mEbO6Fcllc
10+
AnBf94r7ZPtT2MkleBXQrD/K2rZn8hhHhUeNnayJjmODCnXZdoINqj589ScTyYzX
11+
ufEfNZwFURY2OCwSlnytoECc9eHB6veMOwjzw87J6SQS1lsC6omMy5VpTN7HLcJu
12+
7ZepjGxxt3f4cx/DwXRiiwQs+WwctYvfKh1bfdTxbZ0ETOM0/33jbTGATbk14pHe
13+
/GRbIQkCgYEA3VrfkJmfZPj4HX5PP7vtjH298HmXmWd5EPAsIrSY8dUCsC7FVrEb
14+
MnIUA/cq5edjccJFLP0BAAOg/ICk+gstlQdP3rwpvxsDF/L6h6DHC685MT5XaHuP
15+
6TdIk696bS2+0xePhZodP/VG1UqS/pDT9yhKeKrkLvSOA/rpa4gpensCgYEAzYzk
16+
QxFR3V2T2SAXf64AsMxw4KWkGq0gHNfjdEVIbssT+nBpeMxn51Ve+lU/g5WW7y9g
17+
+feI/SdgFa1svGSl7fNCmoyo5u+To533iEF37iucZL0L5IuPIVKYJKe7Dg62SvIH
18+
wX5K6qyAbWqd+huHcNZAbNBcegJZJvw8Zesj5scCgYAy8nN6aKFTMCqLP0MmPC7U
19+
oyxQaOwHltU6nMzLwB1jq89OlbU92s2TssYAk6b/+13cFQau8ByG0E8BTuqp0mDP
20+
aDtt3IkPPzxbCsW26b5mZhIXz2120tmwp9TAiSb4cgr1svqJmYsZ6W5AMUXb6aGf
21+
xVo+o7aZSBhXuix3X4OMeQKBgHeBncjcjgMs/+OyA9eI+//OrSX/R/z2gQAkCKs2
22+
CNnZmkD2EGxaM2LNQM48uBOx6jIgErriTzQYK4YO8XRK9Cn3T9b5Rs4VpnnvQtZm
23+
cer4UhJD02FKPqo6EhjlqByRMy05sIav/bCZIIX9AeJDFSjmeEiLj+ij6t9+sUL0
24+
RkhLAoGABswJ7kNEBK46suK+gdrL8+YqDtaqMXAcaZcWWI/1yBrCAy8Pqm5Oo8k9
25+
PQO6Iqs/HSmgmnLpSmtZIrS9JUh1NbYTAUeM/Kwi/BCxjGyFiU1nOdaiR+lJkE3f
26+
pTWoJA3S5NGl5TTpJeTytRUWdiWDinLXy6GO/YgvPRxKZP9EWLs=
2727
-----END RSA PRIVATE KEY-----

‎test/kind/testdata/ca.crt‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIDdzCCAl+gAwIBAgIQeKbBOk1XnoyvsmTA2VZvWDANBgkqhkiG9w0BAQsFADBH
2+
MIIDdzCCAl+gAwIBAgIQBLSr/dkALdFTTl/S72cxRDANBgkqhkiG9w0BAQsFADBH
33
MSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0b3JpdW0xGTAX
4-
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTUwNjQyWhcNMjcwNDA5
5-
MTUwNjQyWjBHMSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0
4+
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTYxNzE2WhcNMjcwNDA5
5+
MTYxNzE2WjBHMSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0
66
b3JpdW0xGTAXBgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwggEiMA0GCSqGSIb3DQEB
7-
AQUAA4IBDwAwggEKAoIBAQC218YfiRVaJsFgLsR/QWpWy7LLmWYY7u6lhr7Jy5ez
8-
5H4ZC484TDC+YyeNm9sHufuPaoAuS0r3JaYqmjvXdVEXbXajibkjvzL7152M/aov
9-
yUoQ9fd5H4yHrBeFCPzcoc1wi9bUvRDlEVcDpjHDoER6DAx6vTeElYwsO8TfuRZ+
10-
fcd/Lbnz7hKr3y3m132OvBNCMOwDiVNFg3+Wawu6jsRux8N6XnBbe0XIpdPkIxhD
11-
RPYdRRNgi44VOyytV6/Diklr8I+b6fWuItIB1pMCf4RhpX0cLEXQxhxLhEhatIlP
12-
UW7ks94vQwApzI2OdcVkWnMNQNPVxLrvxCLuNlGN82r7AgMBAAGjXzBdMA4GA1Ud
13-
DwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBThTzLB13O9Jr8M
14-
l3I5sK75BfCKnjAbBgNVHREEFDASghBvYnNlcnZhdG9yaXVtLWNhMA0GCSqGSIb3
15-
DQEBCwUAA4IBAQB/McIv7+RPRDLPq2X5PYiQ4OdbLx5ciPcF3WfAcbRUMjBT9Azv
16-
2MYNZDYkA91YY1V/719+7xoWXTpudg5N45KKBObPJtDs7oQdaKFJ7itH38JHvowf
17-
C6TCGIU4oI7q/GVhUSCPTlW6z7np/8jeQDH3mlXit7V3LvsHt0T5BExifln1MbXp
18-
O1cnekN4mwog9FX4ooCZek5UtcXC8TBkmGdIUWI86caSNemWqDLInbDWwzi+YhGz
19-
2S2A5GUzCxTkkk3cLWU4PbOvBmY9s5ZgHMBCBkD3Z2+KUYzsuPry9JZc1Pjik/fK
20-
/VU2/JK1jb6IRWsJCW8qS17X3Bo0WXAep/ve
7+
AQUAA4IBDwAwggEKAoIBAQCeSLo0uKPeaUZLkqn5uPxLpTYqK/ZEWHnXFEpO7v5i
8+
jH3B98sn/N8tZA1uF0KZAHRaP1XHPKtD7ywOxgq2dKXc+vT0Pq/HTGGAlzjnf/hi
9+
0ZmyxL7pnOoZWkGuiwBQ8QNLxHc8hkvVghGpmX9+LbaYGd11QBfAAATia8PVWBQD
10+
/Y5qW9f8cQJ69kIpYpem1HKm+QHkR65nc+szjGrtkS3FNIMohc7ti0dqMu/PDlky
11+
wR1JbsWeob9E/txlwAtpmG1LvNzrPNKYCtyamO8kL286kM9WsOQr/pu3YMGWoWv4
12+
sQlDZrYjX/jn7l1Bn1w+e0EQs5+7mV0L+BuNarlQdB15AgMBAAGjXzBdMA4GA1Ud
13+
DwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSjPtDbEg0Q2YYj
14+
LOVma0C5NgC65jAbBgNVHREEFDASghBvYnNlcnZhdG9yaXVtLWNhMA0GCSqGSIb3
15+
DQEBCwUAA4IBAQBfZTvAnkq5BDoKIXuQlVLjPHHf/ie+WlNXUm22bUWn4SBn9Kvv
16+
3zHHEJOOj+KjVrJYde2bQfK+jU8g4nLQOundCETIGuomv4XzgaSrAW99CqdzDS4v
17+
XRRK9D8cxpAf45AW4riRg4tjRJoYCnJRz9LYZcmAUC2Uh1rwmjRluWiki+/5XaMf
18+
tuZcbN8ccTr1fwjq3ClWwPeRUtB4WEc7hvwnqifVGFmPEZ3/qkWC+OijZtmWNDmb
19+
Lh3Rz5cdImS6oIqhXDhiTE6/o6XvdtbBtCsqlxCqfFX6qWhXywl2KGL//qa2IB1d
20+
4Fst62fvGCtIOSf2DWuRfXSoKpvZpzJsy3yw
2121
-----END CERTIFICATE-----

‎test/kind/testdata/observatorium-api.yaml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,15 @@ data:
1515
redirectURL: http://localhost:8080/oidc/auth-tenant/callback
1616
usernameClaim: email
1717
paths:
18-
- "!^/api/(logs|metrics)/v1/auth-tenant/(loki/api/v1/push|api/v1/receive)"
18+
- operator: "!~"
19+
pattern: ".*(loki/api/v1/push|api/v1/receive).*"
1920
mTLS:
2021
caPath: /etc/certs/ca.crt
2122
paths:
22-
- "^/api/metrics/v1/auth-tenant/api/v1/receive.*"
23-
- "^/api/logs/v1/auth-tenant/loki/api/v1/push.*"
23+
- operator: "=~"
24+
pattern: ".*(api/v1/receive).*"
25+
- operator: "=~"
26+
pattern: ".*(loki/api/v1/push).*"
2427
---
2528
# CA Certificate ConfigMap
2629
apiVersion: v1
@@ -31,25 +34,25 @@ metadata:
3134
data:
3235
ca.crt: |
3336
-----BEGIN CERTIFICATE-----
34-
MIIDdzCCAl+gAwIBAgIQeKbBOk1XnoyvsmTA2VZvWDANBgkqhkiG9w0BAQsFADBH
37+
MIIDdzCCAl+gAwIBAgIQBLSr/dkALdFTTl/S72cxRDANBgkqhkiG9w0BAQsFADBH
3538
MSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0b3JpdW0xGTAX
36-
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTUwNjQyWhcNMjcwNDA5
37-
MTUwNjQyWjBHMSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0
39+
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTYxNzE2WhcNMjcwNDA5
40+
MTYxNzE2WjBHMSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0
3841
b3JpdW0xGTAXBgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwggEiMA0GCSqGSIb3DQEB
39-
AQUAA4IBDwAwggEKAoIBAQC218YfiRVaJsFgLsR/QWpWy7LLmWYY7u6lhr7Jy5ez
40-
5H4ZC484TDC+YyeNm9sHufuPaoAuS0r3JaYqmjvXdVEXbXajibkjvzL7152M/aov
41-
yUoQ9fd5H4yHrBeFCPzcoc1wi9bUvRDlEVcDpjHDoER6DAx6vTeElYwsO8TfuRZ+
42-
fcd/Lbnz7hKr3y3m132OvBNCMOwDiVNFg3+Wawu6jsRux8N6XnBbe0XIpdPkIxhD
43-
RPYdRRNgi44VOyytV6/Diklr8I+b6fWuItIB1pMCf4RhpX0cLEXQxhxLhEhatIlP
44-
UW7ks94vQwApzI2OdcVkWnMNQNPVxLrvxCLuNlGN82r7AgMBAAGjXzBdMA4GA1Ud
45-
DwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBThTzLB13O9Jr8M
46-
l3I5sK75BfCKnjAbBgNVHREEFDASghBvYnNlcnZhdG9yaXVtLWNhMA0GCSqGSIb3
47-
DQEBCwUAA4IBAQB/McIv7+RPRDLPq2X5PYiQ4OdbLx5ciPcF3WfAcbRUMjBT9Azv
48-
2MYNZDYkA91YY1V/719+7xoWXTpudg5N45KKBObPJtDs7oQdaKFJ7itH38JHvowf
49-
C6TCGIU4oI7q/GVhUSCPTlW6z7np/8jeQDH3mlXit7V3LvsHt0T5BExifln1MbXp
50-
O1cnekN4mwog9FX4ooCZek5UtcXC8TBkmGdIUWI86caSNemWqDLInbDWwzi+YhGz
51-
2S2A5GUzCxTkkk3cLWU4PbOvBmY9s5ZgHMBCBkD3Z2+KUYzsuPry9JZc1Pjik/fK
52-
/VU2/JK1jb6IRWsJCW8qS17X3Bo0WXAep/ve
42+
AQUAA4IBDwAwggEKAoIBAQCeSLo0uKPeaUZLkqn5uPxLpTYqK/ZEWHnXFEpO7v5i
43+
jH3B98sn/N8tZA1uF0KZAHRaP1XHPKtD7ywOxgq2dKXc+vT0Pq/HTGGAlzjnf/hi
44+
0ZmyxL7pnOoZWkGuiwBQ8QNLxHc8hkvVghGpmX9+LbaYGd11QBfAAATia8PVWBQD
45+
/Y5qW9f8cQJ69kIpYpem1HKm+QHkR65nc+szjGrtkS3FNIMohc7ti0dqMu/PDlky
46+
wR1JbsWeob9E/txlwAtpmG1LvNzrPNKYCtyamO8kL286kM9WsOQr/pu3YMGWoWv4
47+
sQlDZrYjX/jn7l1Bn1w+e0EQs5+7mV0L+BuNarlQdB15AgMBAAGjXzBdMA4GA1Ud
48+
DwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSjPtDbEg0Q2YYj
49+
LOVma0C5NgC65jAbBgNVHREEFDASghBvYnNlcnZhdG9yaXVtLWNhMA0GCSqGSIb3
50+
DQEBCwUAA4IBAQBfZTvAnkq5BDoKIXuQlVLjPHHf/ie+WlNXUm22bUWn4SBn9Kvv
51+
3zHHEJOOj+KjVrJYde2bQfK+jU8g4nLQOundCETIGuomv4XzgaSrAW99CqdzDS4v
52+
XRRK9D8cxpAf45AW4riRg4tjRJoYCnJRz9LYZcmAUC2Uh1rwmjRluWiki+/5XaMf
53+
tuZcbN8ccTr1fwjq3ClWwPeRUtB4WEc7hvwnqifVGFmPEZ3/qkWC+OijZtmWNDmb
54+
Lh3Rz5cdImS6oIqhXDhiTE6/o6XvdtbBtCsqlxCqfFX6qWhXywl2KGL//qa2IB1d
55+
4Fst62fvGCtIOSf2DWuRfXSoKpvZpzJsy3yw
5356
-----END CERTIFICATE-----
5457
---
5558
# RBAC Configuration

‎test/kind/testdata/tenants.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,12 @@ tenants:
88
redirectURL: http://localhost:8080/oidc/auth-tenant/callback
99
usernameClaim: email
1010
paths:
11-
- "!^/api/(logs|metrics)/v1/auth-tenant/(loki/api/v1/push|api/v1/receive)"
11+
- operator: "!~"
12+
pattern: ".*(loki/api/v1/push|api/v1/receive).*"
1213
mTLS:
1314
caPath: /etc/certs/ca.crt
1415
paths:
15-
- "^/api/metrics/v1/auth-tenant/api/v1/receive.*"
16-
- "^/api/logs/v1/auth-tenant/loki/api/v1/push.*"
16+
- operator: "=~"
17+
pattern: ".*(api/v1/receive).*"
18+
- operator: "=~"
19+
pattern: ".*(loki/api/v1/push).*"

‎test/kind/testdata/test-client.crt‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIDcjCCAlqgAwIBAgIRAJKxqNaVNXazsC2fAVY9tBMwDQYJKoZIhvcNAQELBQAw
3-
RzEqMBIGA1UECxMLRGV2ZWxvcG1lbnQwFAYDVQQLEw1PYnNlcnZhdG9yaXVtMRkw
4-
FwYDVQQDExBPYnNlcnZhdG9yaXVtIENBMB4XDTI2MDQwOTE1MDY0N1oXDTI2MDcw
5-
ODE1MDY0N1owQjEqMBIGA1UECxMLVGVzdCBDbGllbnQwFAYDVQQLEw1PYnNlcnZh
6-
dG9yaXVtMRQwEgYDVQQDEwt0ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQAD
7-
ggEPADCCAQoCggEBAN+0fnV58kobNeddarnEg9W2+40YpZGIvcHwlP367T8g6ISq
8-
197BkeBuq4po04u7z2zdJrEYYmVJ/Zm3cyVXsySanVgZS9bDvlv4net9N8T9M0lL
9-
jozAOnD8O4qwXZR1pwQiSqFVGCmGiiUtbSboNTapDmyF7zB/i5P3Lioj8ouv2jYc
10-
cgpvUcSl2qe4oTv8QKzvWy0poBl9CvZP1/wEu5qvPv2BtCMjfzMhqERqYaNiulp6
11-
Y3b4vQI9+0201T9dHccNcx52qLDXRviTfSseQ7A1YuMwTZC+mP5XNtVj24I09iVs
12-
PFGTsIHN0yE0EPHVGZnjMgZSkhqpZG6c++h64xsCAwEAAaNeMFwwEwYDVR0lBAww
13-
CgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBThTzLB13O9Jr8M
14-
l3I5sK75BfCKnjAWBgNVHREEDzANggt0ZXN0LWNsaWVudDANBgkqhkiG9w0BAQsF
15-
AAOCAQEAOtRZ+igQ0Jm5w9vvJldU2q/uGSuznz9HfhtLTMlFvmNcoWUcdk7xtX99
16-
uwLzyFxH/rNdmXLNoqPcypBoAONMvq+3Egqy6fUth3P2NTtR+ofSDnz8Rbeek+uA
17-
KE9vD0gcybzNWNIwVqDlBCYL5B2wVY9CyWHdNOiGmbPPYI/zuotsYy2PqtER/H4T
18-
aIF0teorkyz5uzyNQmA5HZc8KLiDB5ngisLkvAEWHBfWz0fTdxJsZ2mqGYF3TeIF
19-
GwVNNR7E95etbm7UKSP431OdJm77vvSpr6HZZYx0709053GzfGbg1yOeq2LQU1UF
20-
2Hdis00oLyWmcehRoylE0xx6TmLrMg==
2+
MIIDcTCCAlmgAwIBAgIQJFBcceRaZW45e9UrLXkE5DANBgkqhkiG9w0BAQsFADBH
3+
MSowEgYDVQQLEwtEZXZlbG9wbWVudDAUBgNVBAsTDU9ic2VydmF0b3JpdW0xGTAX
4+
BgNVBAMTEE9ic2VydmF0b3JpdW0gQ0EwHhcNMjYwNDA5MTYxNzIwWhcNMjYwNzA4
5+
MTYxNzIwWjBCMSowEgYDVQQLEwtUZXN0IENsaWVudDAUBgNVBAsTDU9ic2VydmF0
6+
b3JpdW0xFDASBgNVBAMTC3Rlc3QtY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOC
7+
AQ8AMIIBCgKCAQEAx8HSzr+sIGGz+/17uq8sAORubGG8R80Jng/Jcx1UvrEnPyb4
8+
fN+DNprdtfMDjZ6LljGhRDIpF6o7jgeBI40bgG54fytZWDPq6KTox6rEiRsrH7/D
9+
A61M6OeULq1VAo4nT+cmonVXHs60gRL45DFdQVZX8tenFkqlOtP2BYTQYzeG9NVh
10+
Bliz7V7BfyktkyF5iE+guXJCri6NgG73vYM1cnKeWOS0/qP0uruG8KceKzpB96SP
11+
XNFbUZjlR6auQTjr4XXntOLusFd8opv+VN7c4AlXxLvYgj4/VG+1aMiS34PKpcg+
12+
w4qmJLH5Q5PJX/bstNdcLzHzcYVcUWc7DfY3sQIDAQABo14wXDATBgNVHSUEDDAK
13+
BggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKM+0NsSDRDZhiMs
14+
5WZrQLk2ALrmMBYGA1UdEQQPMA2CC3Rlc3QtY2xpZW50MA0GCSqGSIb3DQEBCwUA
15+
A4IBAQArIqGmXMuD5mS7agc0/684/S6z1yvfpaAOVBMT1JobqEMX6t/HWM2fQOiu
16+
fc0uyDD4GJtTTk20HBqyLkhEynRuHz9fJVHen482/VP9Z1RXP44vsZcqHIHPzhZj
17+
M7rTNA2nmTQk9QqsKL1/rRVHDdiHRV13ab/vuX34DUwXN9LOhCNhrFr1KgjCSD87
18+
cgHrRBtDdYiQZ89KwD04ozGPUAMsNeErxPuqgEH3fDZukCpZKVsOxcgX2e1M9lbI
19+
Od1MjN/vnxu5VrBvw1026gkicLSrqGQOv4reZ+/DH6dFNYdL35LdiqqGlYHYyBxs
20+
aHLbrSP8Atuq/V0ZHUnWiQLXrajs
2121
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)