Add ability to use secret for oidc secret

Makefile

@@ -36,7 +36,7 @@ GOLANGCI_LINT_VERSION := 2.1.6
 GORELEASER_VERSION := 2.13.0
 GOTESTSUM_VERSION := 1.8.1
 HELM_VERSION := 3.18.6
-KCP_VERSION := 0.28.3
+KCP_VERSION := 0.29.0
 KUBE_APPLYCONFIGURATION_GEN_VERSION := v0.32.0
 KUBE_CLIENT_GEN_VERSION := v0.32.0
 KUBE_INFORMER_GEN_VERSION := v0.32.0

backend/options/oidc.go

@@ -20,6 +20,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net"
+	"os"
 
 	"github.com/spf13/pflag"
 
@@ -79,6 +80,7 @@ func (options *OIDC) Complete(listener net.Listener) error {
 		if err != nil {
 			return err
 		}
+
 		options.TLSConfig = oidcServer.TLSConfig()
 		options.IssuerURL = cfg.Issuer
 		options.IssuerClientID = cfg.ClientID
@@ -89,6 +91,10 @@ func (options *OIDC) Complete(listener net.Listener) error {
 		options.AllowedGroups = append(options.AllowedGroups, "system:authenticated")
 	}
 
+	if os.Getenv("OIDC_CLIENT_SECRET") != "" {
+		options.IssuerClientSecret = os.Getenv("OIDC_CLIENT_SECRET")
+	}
+
 	if options.CAFile != "" {
 		tlsConfig, err := oidc.LoadTLSConfig(options.CAFile)
 		if err != nil {
@@ -104,9 +110,12 @@ func (options *OIDC) Validate() error {
 	if options.IssuerClientID == "" {
 		return fmt.Errorf("OIDC issuer client ID cannot be empty")
 	}
-	if options.IssuerClientSecret == "" {
+	if options.IssuerClientSecret == "" && os.Getenv("OIDC_CLIENT_SECRET") == "" {
 		return fmt.Errorf("OIDC issuer client secret cannot be empty")
 	}
+	if os.Getenv("OIDC_CLIENT_SECRET") != "" && options.Type == string(kubebindv1alpha2.OIDCProviderTypeEmbedded) {
+		return fmt.Errorf("OIDC issuer client secret cannot be provided via environment variable when using embedded OIDC provider")
+	}
 	if options.IssuerURL == "" {
 		return fmt.Errorf("OIDC issuer URL cannot be empty")
 	}

deploy/charts/backend/templates/deployment.yaml

@@ -44,6 +44,14 @@ spec:
           {{- end }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.backend.oidc.clientSecretName }}
+          env:
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.backend.oidc.clientSecretName }}
+                  key: {{ .Values.backend.oidc.clientSecretKey }}
+          {{- end }}
           args:
             - --listen-address={{ .Values.backend.listenAddress }}
             {{- if .Values.backend.logLevel }}

deploy/charts/backend/values.yaml

@@ -21,6 +21,10 @@ backend:
     issuerUrl: ""
     clientId: ""
     clientSecret: ""
+    # Alternative: reference a secret for client secret (more secure than plaintext)
+    # If clientSecretName is set, the secret will be mounted as OIDC_CLIENT_SECRET env var
+    clientSecretName: ""  # Name of the Kubernetes secret containing the client secret
+    clientSecretKey: ""   # Key within the secret (e.g., "client-secret")
     callbackUrl: ""
     type: "embedded"  # Options: "embedded" or "external"
     # List of groups allowed to access bindings inside the cluster

hack/tools.checksums

@@ -5,7 +5,7 @@ goreleaser|ARCH=x86_64;OS=Linux|8de4a7d97d9b2b62e8186bcd28f7a203ba55ecfaaa4329e1
 gotestsum|GOARCH=amd64;GOOS=linux|ee25248e6f5073cad0b7a712c97ed473adb7420f7eefad534177de0113a8a505
 gotestsum|GOARCH=arm64;GOOS=linux|7a5e7f8cb5e2126be563b7c7182cc4522fbc65408a99df82d156d30e997b8705
 helm|GOARCH=amd64;GOOS=linux|c153fd9c1173f39aefe8e9aa9f00fd3daf6b40c8ea01e94a0d2f2c1787fc60e0
-kcp|GOARCH=amd64;GOOS=linux|41149ef78d2092243b14164a363dfdacc3e0f2bece8c00b715457c21c423a80b
-kcp|GOARCH=arm64;GOOS=darwin|3ce40db499e2bc06eb383cde94be553c0b587b1c99997663bf31877be3fd45d0
-kcp|GOARCH=arm64;GOOS=linux|bd2412179c1e3294dc81641630e0a2184892d4b45c6ef5bed7dc15fbd2c333fe
+kcp|GOARCH=amd64;GOOS=linux|367525b4334e30f598054a62c8f10f04c21afa480c1700d0a9dbb8c905c931a5
+kcp|GOARCH=arm64;GOOS=darwin|463dd70f665baac198f2c6b979bd9dc5e4349636711509dd83fd96b05d1d0bb5
+kcp|GOARCH=arm64;GOOS=linux|44e5ac1c58642b7cffa88796adf9478a9b4110e61876e83237e419fb244216c7
 verify_boilerplate.py||6928a807e2ffc2e6902de705ce7a7cddbbbf5ef61a43901432c4f4551b4e9a7b