LCORE-597: Document auth/authz #603
Conversation
WalkthroughConsolidates authentication content by removing detailed README subsections and linking to a new docs/auth.md. Adds a comprehensive authentication and authorization guide covering modules (noop, noop-with-token, k8s, jwk-token), configuration, token validation flows, role and access rules, and example snippets. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User as Client
participant Svc as Service
participant Auth as Auth Module
participant K8s as Kubernetes API
participant AuthZ as Authorization
Note over Svc,Auth: Kubernetes-based authentication (k8s)
User->>Svc: Request + Bearer token (SA token)
Svc->>Auth: Validate token (k8s)
Auth->>K8s: TokenReview / SubjectAccessReview
K8s-->>Auth: Validation result (+subject)
Auth-->>Svc: Identity (subject), roles (if applicable)
Svc->>AuthZ: Check access (action, roles)
AuthZ-->>Svc: Allow / Deny
Svc-->>User: Response (data or 403)
sequenceDiagram
autonumber
actor User as Client
participant Svc as Service
participant Auth as Auth Module
participant JWK as JWK Provider
participant AuthZ as Authorization
rect rgba(230,240,255,0.5)
Note over Svc,Auth: JWK-based authentication (jwk-token)
User->>Svc: Request + JWT
Svc->>Auth: Validate JWT
Auth->>JWK: Fetch/refresh JWK Set (JWKS)
JWK-->>Auth: Keys
Auth-->>Svc: Claims, derived roles
end
Svc->>AuthZ: Evaluate role rules + access rules
AuthZ-->>Svc: Allow / Deny
Svc-->>User: Response (data or 403)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 markdownlint-cli2 (0.18.1)README.md/usr/bin/env: 'node': Permission denied docs/auth.md/usr/bin/env: 'node': Permission denied Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Move existing docs to docs/auth.md - Expand with more details
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
README.md(1 hunks)docs/auth.md(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-pr
- GitHub Check: e2e_tests
| k8s_ca_cert_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt # optional, will be auto-detected | ||
| skip_tls_verification: false # optional, insecure | ||
| ``` |
There was a problem hiding this comment.
Fix misleading TLS verification note.
The sample sets skip_tls_verification: false but labels that setting “insecure.” false is the safe option (TLS verification on); only true is insecure. Please adjust the comment so readers don’t disable verification by mistake.
- skip_tls_verification: false # optional, insecure
+ skip_tls_verification: false # optional; set to true only if you must skip TLS verification (insecure)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| k8s_ca_cert_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt # optional, will be auto-detected | |
| skip_tls_verification: false # optional, insecure | |
| ``` | |
| k8s_ca_cert_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt # optional, will be auto-detected | |
| skip_tls_verification: false # optional; set to true only if you must skip TLS verification (insecure) |
🤖 Prompt for AI Agents
In docs/auth.md around lines 101 to 103, the inline comment mislabels the TLS
verification setting: it marks `skip_tls_verification: false` as "insecure" even
though `false` is the safe option (verification enabled); update the comment so
it correctly states that `false` is secure (TLS verification on) and that only
`true` is insecure (disables verification), e.g., change the phrase to something
like "optional, secure when false; set to true to disable TLS verification
(insecure)" so readers aren't misled.
2 participants
Description
Type of change
Related Tickets & Documents
Related Issue #
Closes #
LCORE-597
Checklist before requesting a review
Testing
No tests needed
Summary by CodeRabbit