mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-01 00:57:17 +00:00
Volodymyr Stoiko
793e5d1efa
An ungated deployment had no authorization at all: every caller was admin, and the only way to restrict anyone was to stand up an identity provider. So a read-only dashboard needed a login it had no use for. defaultRole now answers 'what may an unidentified caller do' as well as 'what may an authenticated caller with no recognized group do'. Setting it to kubeshark-viewer gives a read-only deployment with no login and no auth backend. Its default becomes kubeshark-admin, so an ungated install behaves as it always has, and the hub falls back to admin when the value is unset or unrecognized rather than to strict-deny — nobody configuring a role must not brick an install. Adds install-notes coverage, since the notes are where an operator learns which of the two ungated postures they got, and fills the remaining gaps in the auth suites: dex and descope validation, incomplete settings while auth is off, and worker token projection under licensing and demo mode.
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
## The install notes are where an operator learns what their auth settings
|
|
## actually did. A deployment can now be ungated, or read-only with no login
|
|
## at all, and the difference must be stated rather than inferred.
|
|
suite: auth install notes
|
|
templates:
|
|
- templates/NOTES.txt
|
|
tests:
|
|
- it: warns that a default install is open to anyone who can reach the Hub
|
|
asserts:
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: API AUTHENTICATION IS DISABLED
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: every one of them gets the role\n `kubeshark-admin`
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: Anyone able to reach the Hub can read captured traffic
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: set `tap\.auth\.defaultRole=kubeshark-viewer`
|
|
|
|
# A narrowed default role is enforced, so the notes must not repeat the
|
|
# "anyone can change settings" warning that applies to the admin default.
|
|
- it: reports a narrowed default role as enforced
|
|
set:
|
|
tap.auth.defaultRole: kubeshark-viewer
|
|
asserts:
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: every one of them gets the role\n `kubeshark-viewer`
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: That role is enforced
|
|
- notMatchRegex:
|
|
path: raw
|
|
pattern: Anyone able to reach the Hub can read captured traffic
|
|
|
|
- it: reports the configured backend when authentication is on
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: oidc
|
|
tap.auth.oidc.issuer: https://issuer.example.com
|
|
tap.auth.defaultRole: kubeshark-viewer
|
|
asserts:
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: API authentication is enabled \(tap\.auth\.type=oidc\)
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: resolve to `kubeshark-viewer`
|
|
- notMatchRegex:
|
|
path: raw
|
|
pattern: API AUTHENTICATION IS DISABLED
|
|
|
|
# Empty defaultRole means strict-deny once callers are identified, and the
|
|
# notes should say so rather than naming a role nobody configured.
|
|
- it: reports deny-all when authentication is on with no default role
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: descope
|
|
tap.auth.defaultRole: ""
|
|
asserts:
|
|
- matchRegex:
|
|
path: raw
|
|
pattern: resolve to `no role, deny-all`
|