Myasnikov Daniil 9b54e46723 fix(linstor): restrict linstor-gui to cozystack-cluster-admin group ...

Before this change oauth2-proxy fronting linstor-gui only enforced that
the user could authenticate against the `cozy` Keycloak realm
(`--email-domain=*`, no group restriction). Any realm user could reach
the UI and, through it, the LINSTOR controller REST API — which the
gatekeeper proxies with a static mTLS client cert and no per-user RBAC.

Add `--allowed-group=cozystack-cluster-admin` and include `groups` in
the OIDC scope so the claim is present at validation time. The
`cozystack-cluster-admin` KeycloakRealmGroup and the `groups` client
scope are already provisioned by keycloak-configure, so no cluster-wide
changes are needed.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-04-17 11:32:44 +05:00

..

deployment_test.yaml

[linstor-gui] Fix test regex for proxy_ssl_certificate spacing

2026-04-14 12:32:41 +05:00

ingress_auth_test.yaml

fix(linstor): restrict linstor-gui to cozystack-cluster-admin group

2026-04-17 11:32:44 +05:00