search

dragonflydb / dragonfly-operator

A Kubernetes operator to install and manage Dragonfly instances.
https://www.dragonflydb.io/docs/managing-dragonfly/operator/installation
Apache License 2.0
144 stars 34 forks source link

feat(auth): Support operator management of instances with password protected admin ports #136

Closed diffuse closed 9 months ago

diffuse commented 1 year ago

This PR allows the operator to manage instances of dragonfly that have the argument --admin_nopass=false and authentication enabled.

There are updates to the README included, but in short: a secret in the namespace dragonfly-operator-system must be created in the form:

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: dragonfly-admin-secret
  namespace: dragonfly-operator-system
data:
  password: c29tZS1wYXNzd29yZA==

Which the operator will use to open authenticated admin connections and to set masterauth on replicas.

I'm having a bit of trouble running all of the tests on minikube (some appear to hang, etc). I'd like to add some new tests for this feature, but since I can't run all of the originals successfully, I'm opening this PR and asking for advisement.

Let me know what you think/if you see any issues. Thanks for this project!

(this addresses https://github.com/dragonflydb/dragonfly-operator/issues/133)

diffuse commented 11 months ago

Hello, I don't mean to be a bother, but is there any news/discussion on this PR? Thanks! :smile:

Pothulapati commented 9 months ago

@diffuse First of all really sorry for the all the waiting. This is especially hard for issues like this as its hard to have a balance!

While we agree reading the secret is the answer to this, We aren't sure if this would be the right for everyone! I'm sure some users would not like giving the Operator access to all the secrets in the cluster and would not deploy the Operator in this case. We can add a toggle but we aren't yet sure how many users actually want this as most users trust applications in their cluster and many others who have issues like this probably already have network RBAC around which services can access what. Until we have more requests from others users, We are not sure if its the right thing to go ahead on this. :/ Closing this hence.