Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Secure the map creation #16

Closed
dlebrero opened this issue Oct 26, 2017 · 0 comments
Closed

Secure the map creation #16

dlebrero opened this issue Oct 26, 2017 · 0 comments
Labels
mvp

Comments

@dlebrero
Copy link
Contributor

dlebrero commented Oct 26, 2017 •
edited
Loading

Only Flow should be able to create new maps.

Secure the create map endpoint by doing some Authz on the Windshaft proxy, maybe by using Keycloak service accounts.

Windshaft tiles endpoint should still be available to external clients. Probably we will need some Nginx proxy to disallow any POST request to Windshaft
@dlebrero dlebrero added the mvp label Oct 26, 2017
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Initial implementation using Keycloak service accounts
693ed06 
* Added Keycloak container (configured by hand right now)
* Using part of the Keycloak adapter for the public key refresh and token verification
* Using Clojure Buddy for logic (hardcoded urls, roles)
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Removing hardcoded KeyCloak deployment object and cleaning up i…
c1492d9 
…ts http client when resetting the app
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Expected role changed to akvo_flow_maps_client
54df306
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] "/" does not require auth as we are using it right now as healt…
952e754 
…h check in k8s
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Updating Keycloak seed file with expected user (akvo-flow), sec…
af011bd 
…ret and role
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Replacing IP for DNS
380d1c7
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] Using env var for the keycloak url
ca66d9c
dlebrero added a commit that referenced this issue Nov 29, 2017
@dlebrero
[#16] random char
721790c
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Moving all k8s objects to the default namespace
99d9fff
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Enabling TLS
5377aa2
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Using HTTPS on the k8s end to end tests
0a8c200
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Adding nginx to disallow POST requests to Windshaft
991894b
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Not logging the layergroup
220843d
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] removing incorrect namespace in k8s config for flow-maps-consumer
e790041
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Not creating the "flow-maps" namespace in k8s
129ab58
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] k8s does not allow to change the labels of a deployment: removi…
1f5e992 
…ng the label with the tag version
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Pushing nginx docker image
5090b0b
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] We are using the tag label to check that the deployment has hap…
319e37b 
…pen and that all is up and running.

Trying suggestion at kubernetes/kubernetes#26202 (comment)
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] end to end test was looking at the flow-maps namespace instead …
4625822 
…of the default one
dlebrero added a commit that referenced this issue Nov 30, 2017
@dlebrero
[#16] Checking also the nginx status
b154df7
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] Log nginx status if not working
f231993
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] Viewer for testing also generates a Bearer token
aeea429 
[skip ci]
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] Removing dev specific paths from nginx config
8ce0263
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] wrong file name in docker-compose logs command
fe8c691
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] fixing again "docker-compose logs" command
0a02807
dlebrero added a commit that referenced this issue Dec 5, 2017
@dlebrero
[#16] Making the Nginx dev config optional
cb87496
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
mvp
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@dlebrero