feat(multi-url-realm): let gateway realms have multiple urls and issuer urls

Co-authored-by: Björn Kottner <BjoernKarma@users.noreply.github.com>
Co-authored-by: Ismael Garba <iagarba@users.noreply.github.com>
Co-authored-by: Stefan Siber <stefan-ctrl@users.noreply.github.com>
Co-authored-by: Ron Gummich <ron96g@users.noreply.github.com>

Author: 5 people

admin/internal/controller/zone_controller_test.go

@@ -252,8 +252,8 @@ func VerifyZone(ctx context.Context, g Gomega, namespacedName client.ObjectKey,
 
 	gatewayRealmSpec := gatewayapi.RealmSpec{
 		Gateway:          types.ObjectRefFromObject(gateway),
-		Url:              "https://test-stargate.de/",
-		IssuerUrl:        "https://test-iris.de/auth/realms/test",
+		Urls:             []string{"https://test-stargate.de/"},
+		IssuerUrls:       []string{"https://test-iris.de/auth/realms/test"},
 		DefaultConsumers: []string{},
 	}
 	g.Expect(gatewayRealm.Spec).To(Equal(gatewayRealmSpec))
@@ -288,8 +288,8 @@ func VerifyZone(ctx context.Context, g Gomega, namespacedName client.ObjectKey,
 
 	teamApiGatewayRealmSpec := gatewayapi.RealmSpec{
 		Gateway:          types.ObjectRefFromObject(gateway),
-		Url:              "https://test-stargate.de/",
-		IssuerUrl:        "https://test-iris.de/auth/realms/team-test",
+		Urls:             []string{"https://test-stargate.de/"},
+		IssuerUrls:       []string{"https://test-iris.de/auth/realms/team-test"},
 		DefaultConsumers: []string{},
 	}
 	g.Expect(teamApiGatewayRealm.Spec).To(Equal(teamApiGatewayRealmSpec))

admin/internal/handler/zone/handler.go

@@ -143,7 +143,9 @@ func (h *ZoneHandler) CreateOrUpdate(ctx context.Context, obj *adminv1.Zone) err
 			return err
 		}
 		obj.Status.TeamApiGatewayRealm = types.ObjectRefFromObject(teamApisGatewayRealm)
-		obj.Status.Links.TeamIssuer = teamApisGatewayRealm.Spec.IssuerUrl
+		if len(teamApisGatewayRealm.Spec.IssuerUrls) > 0 {
+			obj.Status.Links.TeamIssuer = teamApisGatewayRealm.Spec.IssuerUrls[0]
+		}
 
 		// Team api routes
 		var teamApiRouteRefs []types.ObjectRef
@@ -198,11 +200,15 @@ func createTeamApiRoute(ctx context.Context, handlingContext HandlingContext, te
 		if err != nil {
 			return err
 		}
+		issuerUrl := ""
+		if len(gatewayRealm.Spec.IssuerUrls) > 0 {
+			issuerUrl = gatewayRealm.Spec.IssuerUrls[0]
+		}
 		downstream := gatewayapi.Downstream{
 			Host:      downstreamUrl.Host,
 			Port:      0,
 			Path:      downstreamUrl.Path,
-			IssuerUrl: gatewayRealm.Spec.IssuerUrl,
+			IssuerUrl: issuerUrl,
 		}
 
 		teamRoute.Spec = gatewayapi.RouteSpec{
@@ -272,8 +278,8 @@ func createGatewayRealm(ctx context.Context, handlingContext HandlingContext, ga
 
 		gatewayRealm.Spec = gatewayapi.RealmSpec{
 			Gateway:          types.ObjectRefFromObject(gateway),
-			Url:              handlingContext.Zone.Spec.Gateway.Url,
-			IssuerUrl:        urls.ForGatewayRealm(handlingContext.Zone.Spec.IdentityProvider.Url, realmName),
+			Urls:             []string{handlingContext.Zone.Spec.Gateway.Url},
+			IssuerUrls:       []string{urls.ForGatewayRealm(handlingContext.Zone.Spec.IdentityProvider.Url, realmName)},
 			DefaultConsumers: []string{},
 		}
 		return nil

api/internal/controller/apiexposure_controller_test.go

@@ -82,8 +82,8 @@ func NewRealm(name, zoneName string) *gatewayapi.Realm {
 			},
 		},
 		Spec: gatewayapi.RealmSpec{
-			Url:       fmt.Sprintf("http://my-gateway.%s:8080", zoneName),
-			IssuerUrl: fmt.Sprintf("http://my-issuer.%s:8080/auth/realms/%s", zoneName, testEnvironment),
+			Urls:       []string{fmt.Sprintf("http://my-gateway.%s:8080", zoneName)},
+			IssuerUrls: []string{fmt.Sprintf("http://my-issuer.%s:8080/auth/realms/%s", zoneName, testEnvironment)},
 		},
 		Status: gatewayapi.RealmStatus{},
 	}

api/internal/controller/remoteapisubscription_controller_test.go

@@ -141,7 +141,7 @@ var _ = Describe("RemoteApiSubscription Controller - Provider Scenario", Ordered
 		By("Creating the remote Zone")
 		remoteZone = CreateZone(remoteOrgId + "-" + zoneName)
 		remoteRealm := NewRealm(testEnvironment, remoteZone.Name)
-		remoteRealm.Spec.Url = "https://ger.gateway.es"
+		remoteRealm.Spec.Urls = []string{"https://ger.gateway.es"}
 		err := k8sClient.Create(ctx, remoteRealm)
 		Expect(err).ToNot(HaveOccurred())
 		remoteRealm.SetCondition(condition.NewReadyCondition("Ready", "testing"))

api/internal/handler/util_proxy_route_test.go

@@ -66,8 +66,8 @@ func CreateRealm(name, zoneName string) *gatewayapi.Realm {
 			},
 		},
 		Spec: gatewayapi.RealmSpec{
-			Url:       fmt.Sprintf("http://%s.%s.de:8080", name, zoneName),
-			IssuerUrl: fmt.Sprintf("http://issuer.%s.de:8080/auth/realms/test", zoneName),
+			Urls:       []string{fmt.Sprintf("http://%s.%s.de:8080", name, zoneName)},
+			IssuerUrls: []string{fmt.Sprintf("http://issuer.%s.de:8080/auth/realms/test", zoneName)},
 		},
 		Status: gatewayapi.RealmStatus{},
 	}

event/internal/handler/eventconfig/handler_test.go

@@ -130,8 +130,9 @@ func makeReadyGatewayRealm() *gatewayv1.Realm {
 			Namespace: "default",
 		},
 		Spec: gatewayv1.RealmSpec{
-			Url:       "https://gateway.example.com:443",
-			IssuerUrl: "https://issuer.example.com",
+			Urls:             []string{"https://gateway.example.com:443"},
+			IssuerUrls:       []string{"https://issuer.example.com"},
+			DefaultConsumers: []string{},
 		},
 	}
 	meta.SetStatusCondition(&r.Status.Conditions, metav1.Condition{

event/internal/handler/eventexposure/handler_test.go

@@ -185,8 +185,9 @@ func makeReadyGatewayRealm() *gatewayv1.Realm {
 			Namespace: "default",
 		},
 		Spec: gatewayv1.RealmSpec{
-			Url:       "https://gateway.example.com:443",
-			IssuerUrl: "https://issuer.example.com",
+			Urls:             []string{"https://gateway.example.com:443"},
+			IssuerUrls:       []string{"https://issuer.example.com"},
+			DefaultConsumers: []string{},
 		},
 	}
 	meta.SetStatusCondition(&r.Status.Conditions, metav1.Condition{

event/internal/handler/util/callback_route_test.go

@@ -34,8 +34,9 @@ func makeReadyGatewayRealm(name, ns string) *gatewayapi.Realm {
 	r := &gatewayapi.Realm{
 		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ns},
 		Spec: gatewayapi.RealmSpec{
-			Url:       "https://gateway.example.com:443",
-			IssuerUrl: "https://issuer.example.com",
+			Urls:             []string{"https://gateway.example.com:443"},
+			IssuerUrls:       []string{"https://issuer.example.com"},
+			DefaultConsumers: []string{},
 		},
 	}
 	meta.SetStatusCondition(&r.Status.Conditions, metav1.Condition{
@@ -50,8 +51,9 @@ func makeNotReadyGatewayRealm(name, ns string) *gatewayapi.Realm {
 	return &gatewayapi.Realm{
 		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ns},
 		Spec: gatewayapi.RealmSpec{
-			Url:       "https://gateway.example.com:443",
-			IssuerUrl: "https://issuer.example.com",
+			Urls:             []string{"https://gateway.example.com:443"},
+			IssuerUrls:       []string{"https://issuer.example.com"},
+			DefaultConsumers: []string{},
 		},
 	}
 }

gateway/api/v1/realm_types.go

@@ -5,6 +5,7 @@
 package v1
 
 import (
+	"errors"
 	"net/url"
 	"path"
 
@@ -19,10 +20,16 @@ type RealmSpec struct {
 	// Gateway is the Gateway that is associated with the Realm
 	// If empty, the realm considered a virtual realm
 	Gateway *types.ObjectRef `json:"gateway,omitempty"`
-	// Url is the URL of the Gateway when its used as an upstream
-	Url string `json:"url"`
-	// IssuerUrl is the URL of the issuer of the Token sent by the Gateway when its used as a downstream
-	IssuerUrl string `json:"issuerUrl"`
+	// Urls is the list of Gateway URLs that this realm should accept traffic from
+	// +listType=set
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:items:Format=uri
+	Urls []string `json:"urls"`
+	// IssuerUrls is the list of token issuer URLs that are trusted for this realm
+	// +listType=set
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:items:Format=uri
+	IssuerUrls []string `json:"issuerUrls"`
 	// DefaultConsumers is a list of consumers that are allowed to access the Realm for all Routes
 	// +listType=set
 	// +kubebuilder:default={}
@@ -72,7 +79,11 @@ func (r *Realm) SetCondition(condition metav1.Condition) bool {
 }
 
 func (r *Realm) AsUpstream(apiBasePath string) (ups Upstream, err error) {
-	url, err := url.Parse(r.Spec.Url)
+	// Use the first URL as the upstream URL
+	if len(r.Spec.Urls) == 0 {
+		return ups, errors.New("realm has no URLs configured")
+	}
+	url, err := url.Parse(r.Spec.Urls[0])
 	if err != nil {
 		return ups, err
 	}
@@ -86,15 +97,24 @@ func (r *Realm) AsUpstream(apiBasePath string) (ups Upstream, err error) {
 }
 
 func (r *Realm) AsDownstream(apiBasePath string) (dws Downstream, err error) {
-	url, err := url.Parse(r.Spec.Url)
+	// Use the first URL as the downstream URL
+	if len(r.Spec.Urls) == 0 {
+		return dws, errors.New("realm has no URLs configured")
+	}
+	url, err := url.Parse(r.Spec.Urls[0])
 	if err != nil {
 		return dws, err
 	}
+	// Use the first issuer URL
+	issuerUrl := ""
+	if len(r.Spec.IssuerUrls) > 0 {
+		issuerUrl = r.Spec.IssuerUrls[0]
+	}
 	dws = Downstream{
 		Host:      url.Hostname(),
 		Port:      GetPortOrDefaultFromScheme(url),
 		Path:      path.Join(url.Path, apiBasePath),
-		IssuerUrl: r.Spec.IssuerUrl,
+		IssuerUrl: issuerUrl,
 	}
 	return
 }