mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-01 00:57:17 +00:00
Volodymyr Stoiko
12a8993752
The chart answered three unrelated questions with one switch: whether the Hub gates its API, whether the dashboard must log in to fetch a licence key, and which product features exist. So a default install rendered AUTH_ENABLED=true purely to make the cloud login reachable, and tap.auth.enabled=true with type=saml rendered AUTH_ENABLED=false, shipping an unauthenticated Hub to an operator who had asked for SSO. kubeshark.authEnabled is now tap.auth.enabled verbatim. AUTH_TYPE is the configured type verbatim, instead of being rewritten to 'default' whenever cloud licensing or demo mode was on. Settings that cannot work now fail the render rather than being quietly rewritten into something that does. The dashboard's REACT_APP_AUTH_ENABLED was a second, hand-maintained copy of the old expression with an extra internetConnectivity term, so air-gapped installs rendered a gated Hub against a dashboard that never mounted a login. It uses the same helper now. The worker hub token is projected unconditionally. Gating it on the auth decision coupled a DaemonSet rollout to that decision, so anything enabling auth without re-rendering workers left them holding no token against a Hub that required one. The CLI no longer writes AUTH_ENABLED, AUTH_TYPE or AUTH_SAML_IDP_METADATA_URL. Those come from the values the release was installed with; writing them from the CLI's own config meant a plain 'kubeshark tap' against an SSO release could silently reconfigure or disable its authentication.
109 lines
3.7 KiB
YAML
109 lines
3.7 KiB
YAML
## The dashboard needs two independent answers, and they are not the same one.
|
|
##
|
|
## REACT_APP_AUTH_ENABLED -> is the Hub API gated? Must agree with the
|
|
## Hub's own AUTH_ENABLED, or the dashboard
|
|
## and the Hub disagree about whether a
|
|
## login is needed.
|
|
## REACT_APP_CLOUD_LICENSE_ENABLED -> must the dashboard log in to fetch a
|
|
## licence key? True only when cloud
|
|
## licensing is on, no key was supplied,
|
|
## and there is internet to reach the cloud.
|
|
suite: front auth env
|
|
templates:
|
|
- templates/06-front-deployment.yaml
|
|
tests:
|
|
- it: reports auth off by default
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_AUTH_ENABLED
|
|
value: "false"
|
|
|
|
- it: reports auth on when the Hub gates the API
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: oidc
|
|
tap.auth.oidc.issuer: https://issuer.example.com
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_AUTH_ENABLED
|
|
value: "true"
|
|
|
|
# The dashboard's value used to be computed by a second, hand-maintained
|
|
# copy of the Hub's expression, with an extra internetConnectivity term. An
|
|
# air-gapped install therefore rendered a gated Hub against a dashboard that
|
|
# never mounted a login, locking everyone out.
|
|
- it: agrees with the Hub when there is no internet connectivity
|
|
set:
|
|
internetConnectivity: false
|
|
tap.auth.enabled: true
|
|
tap.auth.type: oidc
|
|
tap.auth.oidc.issuer: https://issuer.example.com
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_AUTH_ENABLED
|
|
value: "true"
|
|
|
|
- it: passes the auth type through unchanged
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: saml
|
|
tap.auth.saml.idpMetadataUrl: https://idp.example.com/metadata
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_AUTH_TYPE
|
|
value: saml
|
|
|
|
## Cloud licensing. This flag is what tells the dashboard to run a login for
|
|
## licence acquisition, independently of whether the API is gated.
|
|
|
|
- it: asks for a cloud licence on a default install
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_CLOUD_LICENSE_ENABLED
|
|
value: "true"
|
|
|
|
- it: does not ask for a cloud licence when a key was supplied
|
|
set:
|
|
license: ABC
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_CLOUD_LICENSE_ENABLED
|
|
value: "false"
|
|
|
|
- it: does not ask for a cloud licence without internet connectivity
|
|
set:
|
|
internetConnectivity: false
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_CLOUD_LICENSE_ENABLED
|
|
value: "false"
|
|
|
|
# Fetching a licence from the cloud does not gate the API. These two are
|
|
# rendered from different inputs and are expected to disagree here.
|
|
- it: asks for a cloud licence while leaving the API ungated
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_CLOUD_LICENSE_ENABLED
|
|
value: "true"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: REACT_APP_AUTH_ENABLED
|
|
value: "false"
|