Add Identity-Aware Proxy in front of Jenkins web UI

falldamagestudio / UE-Jenkins-BuildSystem

Build Unreal Engine & games with Jenkins on GKE/GCE

MIT License

46 stars 11 forks source link

Add Identity-Aware Proxy in front of Jenkins web UI #19

Closed Kalmalyzer closed 3 years ago

Kalmalyzer commented 3 years ago

The Jenkins web UI is currently exposed to the world over plain HTTP. There are regular vulnerabilities that involve working around the application-level permissions checks in the service.

It should be possible to use IAP as a proxy that enforces authentication (using people's Google accounts). Can we use that, and also avoid dual authentication?

Kalmalyzer commented 3 years ago

https://www.opcito.com/blogs/securing-jenkins-on-gke-with-iap looks like a useful reference.

Kalmalyzer commented 3 years ago

Done!