Trigger reconcile webhook once build is done

.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+RUSTC_BOOTSTRAP = "1"

.dockerignore

@@ -0,0 +1,4 @@
+*
+!src
+!Cargo.*
+!.cargo/config.toml

.gitea/workflows/build.yaml

@@ -0,0 +1,16 @@
+name: Build and deploy
+on:
+  push:
+    branches:
+      - master
+      - feature/**
+    tags:
+      - v*.*.*
+
+jobs:
+  build:
+    uses: dreaded_x/workflows/.gitea/workflows/rust-kubernetes.yaml@66ab50c3ac239dbdd1e42e6276ec2e65b6a79379
+    secrets: inherit
+    with:
+      generate_crds: true
+      webhook_url: ${{ secrets.WEBHOOK_URL }}

.pre-commit-config.yaml

@@ -54,7 +54,7 @@ repos:
       - id: udeps
         name: unused
         description: Check for unused crates
-        entry: cargo udeps
+        entry: cargo +nightly udeps
         args: ["--workspace"]
         language: system
         types: [file]

Cargo.lock

@@ -97,6 +97,7 @@ dependencies = [
  "color-eyre",
  "dotenvy",
  "futures-util",
+ "git-version",
  "k8s-openapi",
  "kube",
  "schemars",
@@ -555,6 +556,26 @@ version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
+[[package]]
+name = "git-version"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad568aa3db0fcbc81f2f116137f263d7304f512a1209b35b85150d3ef88ad19"
+dependencies = [
+ "git-version-macro",
+]
+
+[[package]]
+name = "git-version-macro"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53010ccb100b96a67bc32c0175f0ed1426b31b655d562898e57325f81c023ac0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "gloo-timers"
 version = "0.3.0"

Cargo.toml

@@ -8,6 +8,7 @@ default-run = "authelia-controller"
 color-eyre = "0.6.3"
 dotenvy = "0.15.7"
 futures-util = "0.3.31"
+git-version = "0.3.9"
 k8s-openapi = { version = "0.24.0", features = ["v1_31"] }
 kube = { version = "0.99.0", features = ["derive", "runtime"] }
 schemars = "0.8.22"

Dockerfile

@@ -0,0 +1,23 @@
+FROM rust:1.86 AS base
+ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
+RUN cargo install cargo-chef --locked --version 0.1.71 && \
+    cargo install cargo-auditable --locked --version 0.6.6
+WORKDIR /app
+
+FROM base AS planner
+COPY . .
+RUN cargo chef prepare --recipe-path recipe.json
+
+FROM base AS builder
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+
+COPY . .
+ARG RELEASE_VERSION
+ENV RELEASE_VERSION=${RELEASE_VERSION}
+RUN cargo auditable build --release
+
+FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
+COPY --from=builder /app/target/release/authelia-controller /authelia-controller
+COPY --from=builder /app/target/release/crdgen /crdgen
+CMD ["/authelia-controller"]

manifests/cluster-role-binding.yaml

@@ -0,0 +1,11 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: authelia-controller
+subjects:
+  - kind: ServiceAccount
+    name: authelia-controller
+roleRef:
+  kind: ClusterRole
+  name: authelia-controller
+  apiGroup: rbac.authorization.k8s.io

manifests/cluster-role.yaml

@@ -0,0 +1,25 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: authelia-controller
+rules:
+  - apiGroups:
+      - authelia.huizinga.dev
+    resources:
+      - accesscontrolrules
+      - accesscontrolrules/status
+      - accesscontrolrules/finalizers
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - "*"
+  - apiGroups:
+      - "apps"
+    resources:
+      - deployments
+    verbs:
+      - "*"

manifests/deployment.yaml

@@ -0,0 +1,36 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authelia-controller
+  labels:
+    app: authelia-controller
+    app.kubernetes.io/name: authelia-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authelia-controller
+  template:
+    metadata:
+      labels:
+        app: authelia-controller
+      annotations:
+        kubectl.kubernetes.io/default-container: authelia-controller
+    spec:
+      serviceAccountName: authelia-controller
+      securityContext: {}
+      containers:
+        - name: authelia-controller
+          image: git.huizinga.dev/dreaded_x/authelia-controller@${DIGEST}
+          imagePullPolicy: IfNotPresent
+          securityContext: {}
+          resources:
+            limits:
+              cpu: 200m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 100Mi
+          env:
+            - name: RUST_LOG
+              value: info,authelia_controller=debug

manifests/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: authelia
+resources:
+  - ./crds.yaml
+  - ./service-account.yaml
+  - ./cluster-role.yaml
+  - ./cluster-role-binding.yaml
+  - ./deployment.yaml

manifests/service-account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authelia-controller
+  labels:
+    app: authelia-controller
+    app.kubernetes.io/name: authelia-controller
+automountServiceAccountToken: true

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.86"
+profile = "default"
+components = ["rust-analyzer"]

src/lib.rs

@@ -1,2 +1,6 @@
+#![feature(let_chains)]
 pub mod context;
 pub mod resources;
+mod version;
+
+pub use version::VERSION;

src/main.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 use std::time::Duration;
 
+use authelia_controller::VERSION;
 use authelia_controller::context::Context;
 use authelia_controller::resources::AccessControlRule;
 use color_eyre::eyre::Context as _;
@@ -39,7 +40,7 @@ async fn main() -> color_eyre::Result<()> {
         })
         .unwrap_or(Ok(15))?;
 
-    info!("Starting");
+    info!(version = VERSION, "Starting");
 
     let client = Client::try_default().await?;
     let access_control_rules = Api::<AccessControlRule>::all(client.clone());

src/resources/access_control_rule.rs

@@ -29,12 +29,17 @@ enum AccessPolicy {
 )]
 #[kube(
     shortname = "acl",
-    doc = "Custom resource for managing authelia access rules"
+    doc = "Custom resource for managing authelia access rules",
+    printcolumn = r#"{"name":"Domain", "type":"string", "jsonPath":".spec.domain"}"#,
+    printcolumn = r#"{"name":"Policy", "type":"string", "jsonPath":".spec.policy"}"#,
+    printcolumn = r#"{"name":"Subject", "type":"string", "jsonPath":".spec.subject"}"#,
+    printcolumn = r#"{"name":"Age", "type":"date", "jsonPath":".metadata.creationTimestamp"}"#
 )]
 #[serde(rename_all = "camelCase")]
 pub struct AccessControlRuleSpec {
     domain: String,
     policy: AccessPolicy,
+    subject: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, Hash)]
@@ -72,6 +77,7 @@ impl AccessControlRule {
 
         let secret = Secret {
             metadata: ObjectMeta {
+                name: Some(ctx.secret_name.clone()),
                 ..Default::default()
             },
             string_data: Some(contents),

src/version.rs

@@ -0,0 +1,11 @@
+pub const VERSION: &str = get_version();
+
+const fn get_version() -> &'static str {
+    if let Some(version) = std::option_env!("RELEASE_VERSION")
+        && !version.is_empty()
+    {
+        version
+    } else {
+        git_version::git_version!(fallback = "unknown")
+    }
+}

yaml/rule-test-2.yaml

@@ -5,3 +5,4 @@ metadata:
 spec:
   domain: "test-2.domain"
   policy: one_factor
+  subject: group:lldap_admin