Pgadmin oauth secrets

[philrhurst]

Checklist:

• Have you added an explanation of what your changes do and why you'd like them to be included?
• Have you updated or added documentation for the change, as applicable?
• Have you tested your changes on all related environments with successful results, as applicable?
  • Have you added automated tests?

Type of Changes:

• New feature
• Bug fix
• Documentation
• Testing enhancement
• Other

What is the current behavior (link to any open issues here)?

The PGAdmin API only allows users to specify OAUTH configuration data via plaintext in the manifest.

What is the new behavior (if this is a feature change)?

Users can now specify their OAUTH configuration via a Secret and pass that to the PGAdmin with an entry containing the secret name in spec.config.oauthConfigurations.

• Breaking change (fix or feature that would cause existing functionality to change)

Other Information:

[dsessler7]

Just need to beef up that one comment for clarity, otherwise, looks good.

[andrewlecuyer]

@philrhurst just a general question here. Could a user effectively put any pgAdmin configuration into the Secret? E.g. even setting that have nothing to do with OAuth? Or are the OAUTH2 settings the only settings that are accepted?

[philrhurst]

@andrewlecuyer - they could but it would not be read correctly and likely would mean pgAdmin wouldn't start. By design, the values encoded within the oauth-config key in the Secret are projected as a JSON file into the pgAdmin container. We parse that JSON file(s) with Python, along with the configuration that may be specified in the ConfigMap and merge them into a single JSON structure to be passed to pgAdmin.

Unfortunately, there is not a lot of validation that can be done here because the data is passed through into pgAdmin. It is similar to how we handle the passing of Postgres parameters to the Patroni section. We could - theoretically - add a validation layer in, but then it becomes a cat-and-mouse game of keeping these components in line.

[cbandy]

Some thoughts and questions. I'm trying out the API locally right now.