Closed O-Bezimo closed 1 year ago
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
Secret keys are supplied if singleUserConfiguration->enabled is true and if singleUserConfiguration->secretRef is not given in the nificluster.yml configuration. If enabled is true and secretRef is declared and exists in the cluster with a username and password, the operator will use these instead as credentials and add it in the login_identity_providers file.
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
Secret keys are supplied if singleUserConfiguration->enabled is true and if singleUserConfiguration->secretRef is not given in the nificluster.yml configuration. If enabled is true and secretRef is declared and exists in the cluster with a username and password, the operator will use these instead as credentials and add it in the login_identity_providers file.
If SingleUserConfiguration.SecretRef
is optional, then it should be expressed as such in the spec by using a pointer (allowing you to check for nil
) and adding the // +optional
kubebuilder annotation.
Why are there a whole new set of unversioned
docs?
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
Secret keys are supplied if singleUserConfiguration->enabled is true and if singleUserConfiguration->secretRef is not given in the nificluster.yml configuration. If enabled is true and secretRef is declared and exists in the cluster with a username and password, the operator will use these instead as credentials and add it in the login_identity_providers file.
If
SingleUserConfiguration.SecretRef
is optional, then it should be expressed as such in the spec by using a pointer (allowing you to check fornil
) and adding the// +optional
kubebuilder annotation.
Thank you for your answer, the modification have been made
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
@mh013370 Should secret keys be supplied in the operator configuration or forced as now?
Secret keys are supplied if singleUserConfiguration->enabled is true and if singleUserConfiguration->secretRef is not given in the nificluster.yml configuration. If enabled is true and secretRef is declared and exists in the cluster with a username and password, the operator will use these instead as credentials and add it in the login_identity_providers file.
If
SingleUserConfiguration.SecretRef
is optional, then it should be expressed as such in the spec by using a pointer (allowing you to check fornil
) and adding the// +optional
kubebuilder annotation.
A pointer is added to Secret ref and the empty checks are made with nil as of now. An optional annotation is added and the same is made to a secretKeys struct allowing the final user to change the username and password keys. They will default to "username" and "password" if nil and the according information are added in the documentation and in the helm folder.
Why are there a whole new set of
unversioned
docs?
I switched the 1.3 versioned docs to unversioned which was a mistake. Since then I deleted it and moved the modifications in ./site/docs.
Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Our GitHub checks need improvements? Share your feedbacks!
What's in this PR?
Our objective is to add the Single-User authentication in addition to the OIDC and LDAP authentication methods.
We added a SingleUserConfiguration object in the NifiCluster ressource. The options are the following:
We also added the reference to the SingleUserConfiguration in the helm folder.
Why?
If neither OIDC or LDAP are configured, nifi forces a certificate authentication on all HTTP/HTTPS certificates. We need another option so that we can have functionnal healthchecks on our loadbalancer generated by the ingress-controller.
Additional context
We tested the code with an integration cluster hosted on gcp and telepresence as a proxy for our modified operator.
We also proofed some error cases:
Checklist