mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-01 00:57:17 +00:00
Volodymyr Stoiko
793e5d1efa
An ungated deployment had no authorization at all: every caller was admin, and the only way to restrict anyone was to stand up an identity provider. So a read-only dashboard needed a login it had no use for. defaultRole now answers 'what may an unidentified caller do' as well as 'what may an authenticated caller with no recognized group do'. Setting it to kubeshark-viewer gives a read-only deployment with no login and no auth backend. Its default becomes kubeshark-admin, so an ungated install behaves as it always has, and the hub falls back to admin when the value is unset or unrecognized rather than to strict-deny — nobody configuring a role must not brick an install. Adds install-notes coverage, since the notes are where an operator learns which of the two ungated postures they got, and fills the remaining gaps in the auth suites: dex and descope validation, incomplete settings while auth is off, and worker token projection under licensing and demo mode.
94 lines
2.5 KiB
YAML
94 lines
2.5 KiB
YAML
## An auth type that cannot work should stop the install, not render a Hub
|
|
## that authenticates nobody. The chart previously rewrote such settings into
|
|
## a different auth type instead, which is how an operator could ask for SAML
|
|
## and get something else without being told.
|
|
suite: auth validation
|
|
templates:
|
|
- templates/12-config-map.yaml
|
|
tests:
|
|
- it: rejects SAML without an IdP metadata URL
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: saml
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: tap.auth.saml.idpMetadataUrl is empty
|
|
|
|
- it: accepts SAML with an IdP metadata URL
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: saml
|
|
tap.auth.saml.idpMetadataUrl: https://idp.example.com/metadata
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: saml
|
|
|
|
- it: rejects OIDC without an issuer
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: oidc
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: tap.auth.oidc.issuer is empty
|
|
|
|
- it: accepts OIDC with an issuer
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: oidc
|
|
tap.auth.oidc.issuer: https://issuer.example.com
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: oidc
|
|
|
|
# Descope carries its own configuration, so there is nothing to require.
|
|
- it: accepts descope without extra settings
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: descope
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: descope
|
|
|
|
- it: accepts dex with an issuer
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: dex
|
|
tap.auth.oidc.issuer: https://dex.example.com
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: dex
|
|
|
|
- it: rejects dex without an issuer
|
|
set:
|
|
tap.auth.enabled: true
|
|
tap.auth.type: dex
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: tap.auth.oidc.issuer is empty
|
|
|
|
# Incomplete auth settings are only a problem when auth is on. The default
|
|
# install ships tap.auth.type=saml with no IdP and must still render.
|
|
- it: ignores incomplete auth settings while auth is off
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_ENABLED
|
|
value: "false"
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: saml
|
|
|
|
- it: ignores incomplete oidc settings while auth is off
|
|
set:
|
|
tap.auth.type: oidc
|
|
asserts:
|
|
- equal:
|
|
path: data.AUTH_ENABLED
|
|
value: "false"
|
|
- equal:
|
|
path: data.AUTH_TYPE
|
|
value: oidc
|