-
Notifications
You must be signed in to change notification settings - Fork 42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add single-user authentication #278
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please delete the versionned documentation, the next version has not yet been decided.
And add the appropriate changes to the "unversioned" documentation to reflect your changes.
CHANGELOG.md
Outdated
## v1.2.0 | ||
|
||
### Added | ||
|
||
- [PR #258](https://github.com/konpyutaika/nifikop/pull/141) - **[Helm Chart]** Upgraded helm-deployed HPA to v2 and added flowPosition to NiFiDataflow. | ||
- [PR #258](https://github.com/konpyutaika/nifikop/pull/141) - **[Operator]** Upgraded helm-deployed HPA to v2 and added flowPosition to NiFiDataflow. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- [PR #258](https://github.com/konpyutaika/nifikop/pull/141) - **[Operator]** Upgraded helm-deployed HPA to v2 and added flowPosition to NiFiDataflow. | |
- [PR #258](https://github.com/konpyutaika/nifikop/pull/141) - **[Helm Chart]** Upgraded helm-deployed HPA to v2 and added flowPosition to NiFiDataflow. |
This change should not have occurred, and it may be necessary to rebase the master.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Modified accordingly
CHANGELOG.md
Outdated
## v1.3.0 | ||
|
||
### Added | ||
|
||
- [PR #278](https://github.com/konpyutaika/nifikop/pull/278) - **[Operator]** Added the single-user-authentication method. | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
## v1.3.0 | |
### Added | |
- [PR #278](https://github.com/konpyutaika/nifikop/pull/278) - **[Operator]** Added the single-user-authentication method. | |
```suggestion | |
## Unreleased | |
### Added | |
- [PR #278](https://github.com/konpyutaika/nifikop/pull/278) - **[Operator]** Added the single-user-authentication method. | |
### Changed | |
### Fixed Bugs | |
### Deprecated | |
### Removed | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Modified accordingly
@mh013370 Should secret keys be supplied in the operator configuration or forced as now? |
Secret keys are supplied if singleUserConfiguration->enabled is true and if singleUserConfiguration->secretRef is not given in the nificluster.yml configuration. If enabled is true and secretRef is declared and exists in the cluster with a username and password, the operator will use these instead as credentials and add it in the login_identity_providers file. |
If |
Why are there a whole new set of |
Thank you for your answer, the modification have been made |
A pointer is added to Secret ref and the empty checks are made with nil as of now. An optional annotation is added and the same is made to a secretKeys struct allowing the final user to change the username and password keys. They will default to "username" and "password" if nil and the according information are added in the documentation and in the helm folder. |
I switched the 1.3 versioned docs to unversioned which was a mistake. Since then I deleted it and moved the modifications in ./site/docs. |
|
GitGuardian id | Secret | Commit | Filename | |
---|---|---|---|---|
- | Generic Password | b2f5f75 | pkg/resources/nifi/pod.go | View secret |
- | Generic Password | 0978cc6 | pkg/resources/nifi/pod.go | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Our GitHub checks need improvements? Share your feedbacks!
What's in this PR?
Our objective is to add the Single-User authentication in addition to the OIDC and LDAP authentication methods.
We added a SingleUserConfiguration object in the NifiCluster ressource.
The options are the following:
We also added the reference to the SingleUserConfiguration in the helm folder.
Why?
If neither OIDC or LDAP are configured, nifi forces a certificate authentication on all HTTP/HTTPS certificates.
We need another option so that we can have functionnal healthchecks on our loadbalancer generated by the ingress-controller.
Additional context
We tested the code with an integration cluster hosted on gcp and telepresence as a proxy for our modified operator.
We also proofed some error cases:
Checklist