feat: Add oidc integration example for nextcloud (#252)

deploy/crd/nextclouds.glasskube.eu-v1.yml

@@ -29,6 +29,23 @@ spec:
                       host:
                         type: string
                     type: object
+                  oidc:
+                    nullable: true
+                    properties:
+                      name:
+                        type: string
+                      oidcSecret:
+                        properties:
+                          name:
+                            type: string
+                        type: object
+                      issuerUrl:
+                        type: string
+                    required:
+                    - name
+                    - oidcSecret
+                    - issuerUrl
+                    type: object
                 type: object
               resources:
                 properties:

docs/docs/03_crd-reference/nextcloud/index.md

@@ -41,6 +41,7 @@ spec:
 | Name   | Type                   |        |
 |--------|------------------------|--------|
 | office | [OfficeSpec](./office) | `null` |
+| oidc   | [OidcSpec](./oidc)     | `null` |
 
 ### StorageSpec {#storage}
 

docs/docs/03_crd-reference/nextcloud/oidc.md

@@ -0,0 +1,28 @@
+# Oidc
+
+The Glasskube operator can configure the [`oidc_login`](https://apps.nextcloud.com/apps/oidc_login) nextcloud app for you. Currently, the operator only passes the most basic configuration options throuh.
+
+## Example
+
+```yaml title=spec.apps.office
+    oidc:
+      name: my-oidc-issuer
+      issuerUrl: https://my-oidc-issuer.org
+      oidcSecret:
+        name: oidc-login
+```
+
+## Spec
+
+| Name       | Type                                                                                                                   |            |
+|------------|------------------------------------------------------------------------------------------------------------------------|------------|
+| name       | String                                                                                                                 | (required) |
+| issuerUrl  | String                                                                                                                 | (required) |
+| oidcSecret | [LocalObjectReference](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/local-object-reference/) | (required) |
+
+### OidcSecret
+
+| Key          | Description                                                |            |
+|--------------|------------------------------------------------------------|------------|
+| clientId     | Id of the client/application in your OIDC provider         | (required) |
+| clientSecret | Secret corresponding to the clientId in your OIDC provider | (required) |

operator/src/main/kotlin/eu/glasskube/operator/apps/nextcloud/NextcloudAppsSpec.kt

@@ -1,12 +1,24 @@
 package eu.glasskube.operator.apps.nextcloud
 
 import io.fabric8.generator.annotation.Nullable
+import io.fabric8.generator.annotation.Required
+import io.fabric8.kubernetes.api.model.LocalObjectReference
 
 data class NextcloudAppsSpec(
     @field:Nullable
-    val office: Office? = null
+    val office: Office? = null,
+    @field:Nullable
+    val oidc: Oidc? = null
 ) {
     data class Office(
         val host: String
     )
+    data class Oidc(
+        @field:Required
+        val name: String,
+        @field:Required
+        val oidcSecret: LocalObjectReference,
+        @field:Required
+        val issuerUrl: String
+    )
 }

operator/src/main/kotlin/eu/glasskube/operator/apps/nextcloud/dependent/NextcloudConfigMap.kt

@@ -56,7 +56,21 @@ class NextcloudConfigMap : CRUDKubernetesDependentResource<ConfigMap, Nextcloud>
                         "192.168.0.0/16"
                     ),
                     "log_type" to "errorlog",
-                    "log_level" to 2
+                    "log_level" to 2,
+                    *spec.apps.oidc?.let {
+                        arrayOf(
+                            "oidc_login_provider_url" to it.issuerUrl,
+                            "oidc_login_logout_url" to spec.host,
+                            "oidc_login_button_text" to "Login with " + it.name,
+                            "oidc_login_disable_registration" to false,
+                            "oidc_login_scope" to "openid profile email",
+                            "oidc_login_attributes" to mapOf(
+                                "id" to "sub",
+                                "name" to "name",
+                                "mail" to "email"
+                            )
+                        )
+                    }.orEmpty()
                 ).toMap(),
                 listOfNotNull(
                     spec.apps.office?.let {

operator/src/main/kotlin/eu/glasskube/operator/apps/nextcloud/dependent/NextcloudDeployment.kt

@@ -108,12 +108,15 @@ class NextcloudDeployment : CRUDKubernetesDependentResource<Deployment, Nextclou
                             command = listOf("sh")
                             args = listOf(
                                 "-c",
-                                """
-                                    php $OCC_PATH app:install richdocuments
-                                    php $OCC_PATH app:install contacts
-                                    php $OCC_PATH app:install calendar
-                                    true
-                                """.trimIndent()
+                                listOf(
+                                    "php $OCC_PATH app:install richdocuments",
+                                    "php $OCC_PATH app:install contacts",
+                                    "php $OCC_PATH app:install calendar",
+                                    primary.spec.apps.oidc.let {
+                                        "php $OCC_PATH app:install oidc_login"
+                                    },
+                                    "true"
+                                ).joinToString("\n") { it }
                             )
                             securityContext {
                                 runAsUser = 33
@@ -175,7 +178,8 @@ class NextcloudDeployment : CRUDKubernetesDependentResource<Deployment, Nextclou
                             name = Nextcloud.APP_NAME
                             image = Nextcloud.APP_IMAGE
                             resources = primary.spec.resources
-                            env = primary.defaultEnv + primary.databaseEnv + primary.smtpEnv + primary.storageEnv
+                            env =
+                                primary.defaultEnv + primary.databaseEnv + primary.smtpEnv + primary.oidcEnv + primary.storageEnv
                             volumeMounts {
                                 volumeMount {
                                     name = DATA_VOLUME
@@ -271,6 +275,19 @@ class NextcloudDeployment : CRUDKubernetesDependentResource<Deployment, Nextclou
             envVar("SMTP_PASSWORD") { secretKeyRef(authSecret.name, "password") }
         }
 
+    private val Nextcloud.oidcEnv
+        get() = createEnv {
+            spec.apps.oidc?.let { envVar("NC_oidc_login_client_id") { secretKeyRef(it.oidcSecret.name, "clientId") } }
+            spec.apps.oidc?.let {
+                envVar("NC_oidc_login_client_secret") {
+                    secretKeyRef(
+                        it.oidcSecret.name,
+                        "clientSecret"
+                    )
+                }
+            }
+        }
+
     private val Nextcloud.storageEnv
         get() = createEnv {
             spec.storage?.s3?.apply {