mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:44:33 +00:00
4ee2b259c9
- Add build-context helper to copy Docker context safely (ignore runtime data, keep symlinks) - Update UI and core actions to use ~/.prole/build and shared copy helper - Add/adjust tests and scripts; introduce knoe ops helpers and update manifests Co-authored-by: Junie <junie@jetbrains.com>
52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
### Grafana SSO (Kerberos via Prole auth)
|
||
|
||
This repo’s first-pass Grafana SSO is implemented as:
|
||
|
||
1. Users authenticate at `https://api.prole.org/auth/login`.
|
||
- Primary: Kerberos/SPNEGO (`/auth/spnego`)
|
||
- Fallback: form login (`/auth/form`) only when explicitly enabled
|
||
2. On success, `prole-auth` issues a signed session cookie scoped to `Domain=.prole.org`.
|
||
3. Users access Grafana at `https://svc.prole.org/` as usual.
|
||
4. `svc.prole.org` is routed to an internal Nginx `prole-grafana-proxy` service.
|
||
- The proxy calls `prole-auth` (`/auth/verify`) via `auth_request` on every request.
|
||
- On success it injects `X-WEBAUTH-USER` and forwards to Grafana.
|
||
- On failure it redirects to `https://api.prole.org/auth/login?next=...` (fail-closed).
|
||
5. Grafana is configured with `auth.proxy` to trust `X-WEBAUTH-USER`.
|
||
|
||
#### Key configuration knobs
|
||
|
||
- Kong routing + TLS:
|
||
- `SERVICE_HOSTNAME` (default `svc.prole.org`)
|
||
- `AUTH_HOSTNAME` (default `api.prole.org`)
|
||
- `PROLE_GRAFANA_SSO_ENABLED=1` to route `svc.prole.org` → `prole-grafana-proxy` instead of directly to Grafana
|
||
|
||
- Grafana chart values:
|
||
- `PROLE_GRAFANA_SSO_ENABLED=1` enables `grafana.ini.auth.proxy` and disables the Grafana login form / anonymous access
|
||
|
||
- `prole-auth` service (environment variables):
|
||
- `PROLE_AUTH_ENABLED=true`
|
||
- `PROLE_AUTH_SESSION_SECRET` (required; strong random)
|
||
- `PROLE_AUTH_COOKIE_DOMAIN=.prole.org`
|
||
- `PROLE_KERBEROS_SERVICE_PRINCIPAL` (required for SPNEGO)
|
||
- `PROLE_KERBEROS_KEYTAB_PATH` (required for SPNEGO)
|
||
- `PROLE_AUTH_FORM_ENABLED=true` (optional; enables password fallback)
|
||
|
||
#### Kubernetes resources
|
||
|
||
Manifests are under `deploy/opentofu/k3s/manifests/prole/`:
|
||
|
||
- `prole-auth-deployment.yaml` / `prole-auth-service.yaml`
|
||
- `prole-kdc-configmap.yaml` (embedded KDC sidecar configuration)
|
||
- `grafana-proxy-configmap.yaml` / `grafana-proxy-deployment.yaml` / `grafana-proxy-service.yaml`
|
||
|
||
Required (provided externally):
|
||
|
||
- Secret `prole-auth-secrets` with key `sessionSecret`
|
||
- Secret `prole-auth-keytab` containing the HTTP service keytab at `http.keytab`
|
||
- Secret `prole-kdc-secrets` with keys `master_password` and `admin_password` (for the embedded KDC)
|
||
|
||
#### Logout / session invalidation
|
||
|
||
- `GET /auth/logout` clears the Prole session cookie (`Max-Age=0`).
|
||
- Grafana access is effectively revoked on the next request because the proxy calls `/auth/verify` for every request.
|