https://github.com/pulp/pulp-access-controller
https://github.com/pulp/pulp-access-controller
Last synced: 6 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/pulp/pulp-access-controller
- Owner: pulp
- Created: 2025-05-21T15:11:32.000Z (10 months ago)
- Default Branch: main
- Last Pushed: 2025-10-08T00:20:35.000Z (6 months ago)
- Last Synced: 2025-10-08T02:36:23.819Z (6 months ago)
- Language: Python
- Size: 66.4 KB
- Stars: 0
- Watchers: 7
- Forks: 0
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Pulp Access Controller
A Kubernetes operator that automates the creation of secrets for accessing Red Hat Pulp services. Built using the [Kopf framework](https://github.com/nolar/kopf), this controller watches for `PulpAccessRequest` custom resources and automatically provisions the necessary authentication materials.
## Overview
The Pulp Access Controller simplifies access management for Red Hat Pulp by automatically creating Kubernetes secrets containing:
- `cli.toml` - Configuration file for pulp-cli with mTLS settings (always included)
- `oauth-cli.toml` - Configuration file for pulp-cli with OAuth2 settings (when client credentials provided)
- `tls.crt` - Custom TLS certificate in base64 encoding (when custom certificate provided)
- `tls.key` - Custom TLS private key in base64 encoding (when custom key provided)
- `client_id` - OAuth2 client ID in base64 encoding (when provided)
- `client_secret` - OAuth2 client secret in base64 encoding (when provided)
- `domain` - Pulp domain name in base64 encoding (when provided)
- Optional ImageRepository resources for Quay.io OCI backend integration
## Features
### **Multiple Authentication Methods**
- **mTLS Authentication**: Support for mutual TLS using custom certificates
- **OAuth2 Authentication**: Client credentials flow for API access
- **Flexible Configuration**: Mix and match authentication methods as needed
### **Automated Resource Management**
- **Domain Creation**: Automatically create Pulp domains via API
- **Quay Integration**: Optional OCI storage backend configuration with Quay.io
- **Secret Generation**: Automated Kubernetes secret creation with proper encoding
### **Easy Configuration**
- **Custom Certificates**: Bring your own TLS certificates and keys
- **CLI Ready**: Pre-configured `pulp-cli` configuration files included
- **Kubernetes Native**: Fully integrated with Kubernetes RBAC and lifecycle management
## Usage
### Basic Usage
Create a `PulpAccessRequest` to generate authentication secrets:
```yaml
apiVersion: pulp.konflux-ci.dev/v1alpha1
kind: PulpAccessRequest
metadata:
name: my-pulp-access
namespace: my-namespace
spec:
# OAuth2 credentials (optional)
client_id: "my-client-id"
client_secret: "my-client-secret"
# Domain management (optional)
domain: "my-pulp-domain"
# Custom TLS certificate and key (optional)
cert: |
-----BEGIN CERTIFICATE-----
... your certificate content ...
-----END CERTIFICATE-----
key: |
-----BEGIN PRIVATE KEY-----
... your private key content ...
-----END PRIVATE KEY-----
```
### Pulp with Quay Backend
If you want Pulp to use Quay.io as storage backend:
```yaml
apiVersion: pulp.konflux-ci.dev/v1alpha1
kind: PulpAccessRequest
metadata:
name: pulp-with-quay-backend
namespace: my-namespace
spec:
client_id: "my-oauth-client"
client_secret: "my-oauth-secret"
domain: "production-domain"
use_quay_backend: true
cert: |
-----BEGIN CERTIFICATE-----
... certificate for mTLS ...
-----END CERTIFICATE-----
key: |
-----BEGIN PRIVATE KEY-----
... private key for mTLS ...
-----END PRIVATE KEY-----
```
## Generated Secret Structure
The controller creates a secret named `pulp-access` containing:
| Key | Description | When Included |
|-----|-------------|---------------|
| `cli.toml` | mTLS configuration for pulp-cli | Always |
| `oauth-cli.toml` | OAuth2 configuration for pulp-cli | When client credentials provided |
| `tls.crt` | TLS certificate | When custom certificate provided |
| `tls.key` | TLS private key | When custom key provided |
| `client_id` | OAuth2 client ID | When provided in spec |
| `client_secret` | OAuth2 client secret | When provided in spec |
| `domain` | Pulp domain name | When provided in spec |