Initial access config support #115

tomasliumparas · 2024-12-05T01:31:48Z

Initial AccessConfig version.
To do:

Use domain from TunnelBinding
Discuss if we should create AccessApplications before DNS records due to security reasons
Implement AccessPolicies calls

Currently tested with the following CRD:

apiVersion: networking.cfargotunnel.com/v1alpha1
kind: TunnelBinding
metadata:
  name: whoami-cluster-tun
subjects:
  - name: whoami
  - name: whoami-2 # Points to the second service
tunnelRef:
  kind: ClusterTunnel
  name: k3s-cluster-tunnel
accessConfig:
  name: whoami
  domain: whoami.domain.com
  type: "self_hosted"

#67

adyanth

Thanks for the PR! Did you have a chance to test this out in your cluster to make sure it works? Had a couple questions/comments.

api/v1alpha1/tunnelbinding_types.go

adyanth · 2024-12-06T03:34:22Z

controllers/cloudflare_api.go

+	return ids, nil
+}
+
+func (c *CloudflareAPI) CreateAccessConfig(name string, config networkingv1alpha1.AccessConfig) error {


Could you remove the dependency of networkingv1alpha1 from this file by calling this function with the newApp already created and accepting an AccessApp instead?

The thing is that I need to call CF api, to have it translated into AccessApp - basically to translate Access Group Names into ids.
That means I would need to include CloudflareAPI from cloudflare_api.go into tunnelbinding_types.go

Or I could move (c *AccessConfig) NewAccessApplication() into controllers package as a function.
I did this, since I originally wanted to have it as a method of AccessConfig. That way it is near the definition of the CRD and it makes a bit easier to map the fields.

Which way you would prefer more?

Feel free to include/import the CloudflareAPI in the tunnelbinding_types.go, or write a simple translation layer if we do not need all the fields. The cloudflare_api.go should not include any k8s CRDs to prevent circular deps.

controllers/cloudflare_api.go

adyanth · 2024-12-06T03:50:29Z

controllers/cloudflare_api.go

+		c.Log.Error(err, "failed retrieving existing access policies for application", "applicationId", applicationId)
+	}
+
+	if len(existingPolicies) > 0 {


This if condition is not necessary.

adyanth · 2024-12-06T05:31:30Z

controllers/cloudflare_api.go

+			}
+
+			// Check if the policy is still required
+			required := false


This function seems convoluted. Let me phrase what I understand this function should be doing and you can correct me.

Given the set of existing access policies on the application, and the set of access policies defined in the CRD, you are trying to reconcile them. But there are a couple of problems. Does having the same name of the policy guarantee that the policy wasn't changed? Do we also create access groups here or just refer to them by name?

If possible, I'd like to see this split up into smaller functions and sync all the rules regardless of what was present, unless there was a way you could verify what is set online matches the local config.

This one was a bit tricky.
What I am doing here is checking by name if there are any policies in the application, which are not defined in crd.
If yes, we delete them.

Later on we loop trough policies defined in crd and update them.

Cases I tested:

Policy by same name is changed manually, it should be updated to be matching crd configuration - works

Policy manually added to the ui, should be deleted - works

Policy should be deleted once gone from crd - works

does this makes sense?

Policy manually added to the ui, should be deleted - works

This is approaching the terraform provider territory. All the operator needs to do is create what was defined in config, and clean it up when removed. If config is updated, create/update all of the configured ones. Looking for others might not be in the scope of this operator.

tomasliumparas · 2024-12-06T10:04:53Z

Thanks for the PR! Did you have a chance to test this out in your cluster to make sure it works? Had a couple questions/comments.

Yes, seem to work fine.
What I managed to test:

Creation/deletion of Access Applications with/without the policies
Changing order of access policies
Manually updating the policies via Cloudflare
Removing the policies via CRD
Renaming the policies via CRD

tomasliumparas · 2024-12-16T22:08:16Z

@adyanth can we resolve some of the comments?

dvcrn · 2025-01-30T07:15:09Z

Thanks for taking the time of implementing this!

I tried testing this on my cluster but I couldn't get it to create access applications, is anything else missing?

apiVersion: networking.cfargotunnel.com/v1alpha1
kind: TunnelBinding
metadata:
  name: foo-bar
subjects:
  - name: svc-01
    spec:
      fqdn: foo-bar.mydomain.com
      protocol: http
tunnelRef:
  kind: ClusterTunnel
  name: my-tunnel
accessConfig:
  enabled: true
  type: "self_hosted"

I don't see any errors in the log. I also added access permission for applications to the token

tomasliumparas · 2025-02-11T23:54:15Z

Thanks for taking the time of implementing this!

I tried testing this on my cluster but I couldn't get it to create access applications, is anything else missing?
apiVersion: networking.cfargotunnel.com/v1alpha1
kind: TunnelBinding
metadata:
  name: foo-bar
subjects:
  - name: svc-01
    spec:
      fqdn: foo-bar.mydomain.com
      protocol: http
tunnelRef:
  kind: ClusterTunnel
  name: my-tunnel
accessConfig:
  enabled: true
  type: "self_hosted"
I don't see any errors in the log. I also added access permission for applications to the token

Have you installed the updated CRDs inside your cluster? Could you provide operator log?

adyanth

Please rebase to latest main as well. Any further logic changes can be done iteratively once this is merged!

adyanth · 2025-04-28T10:27:33Z

api/v1alpha1/tunnelbinding_types.go

+type AccessConfig struct {
+	// Enable handling of access configuration
+	//+kubebuilder:validation:Optional
+	//+kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Application type self_hosted,saas
+	//+kubebuilder:validation:Optional
+	//+kubebuilder:validation:Enum:="";"self_hosted";"saas"
+	//+kubebuilder:default:="self_hosted"
+	Type string `json:"type"`
+	// List of access policies
+	//+kubebuilder:validation:Optional
+	AccessPolicies []AccessPolicy `json:"accessPolicies"`
+	// Application settings
+	//+kubebuilder:validation:Optional
+	Settings AccessConfigSettings `json:"settings"`
+}


Since this is being used as part of the tunnelBinding, can we use only the configs that makes sense?

For example, the type would always need to be self_hosted, saas would never work. Do we need the enabled flag? If the config isn't specified, it is disabled.

adyanth · 2025-04-28T10:28:33Z

api/v1alpha1/tunnelbinding_types.go

+type AccessConfigAdditional struct {
+	// Cloudflare will render an SSH terminal or VNC session for this application in a web browser. [ssh,vnc]
+	//+kubebuilder:validation:Optional
+	//+kubebuilder:validation:Enum:="";"vnc";"ssh"
+	BrowserRendering string `json:"browserRendering"`
+}


This might need to be validated against the tunnelBinding subject's protocol, or rather use that to determine instead of being a config.

tomasliumparas · 2025-09-24T20:15:40Z

Will come back to it soon

Initial access config support

859add3

tomasliumparas changed the title ~~#67 Initial access config support~~ Initial access config support Dec 5, 2024

tomasliumparas added 7 commits December 5, 2024 15:52

Add deletion logic

9348830

Reconcile AccessConfig before DNS, add events

1935b12

Use service fqdn

621aec7

Remove uuid logic

5f79d6d

Add access policy handling

0367005

Handle deletion of access policies

ebdc1de

Fix access policy precedence

04423e4

adyanth reviewed Dec 6, 2024

View reviewed changes

Cleanup unused comments

7bde824

tomasliumparas mentioned this pull request Feb 11, 2025

Zero Trust Applications support #67

Open

adyanth requested changes Apr 28, 2025

View reviewed changes

Uh oh!

Initial access config support #115

Are you sure you want to change the base?

Initial access config support #115

Uh oh!

Conversation

tomasliumparas commented Dec 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adyanth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasliumparas Dec 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasliumparas commented Dec 6, 2024

Uh oh!

tomasliumparas commented Dec 16, 2024

Uh oh!

dvcrn commented Jan 30, 2025

Uh oh!

tomasliumparas commented Feb 11, 2025

Uh oh!

adyanth left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasliumparas commented Sep 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tomasliumparas commented Dec 5, 2024 •

edited

Loading

tomasliumparas Dec 6, 2024 •

edited

Loading