mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 03:27:07 +09:00
myasnikovdaniil
cbc79600dd
## What this PR does Stacked on top of #2382. Publishes the linstor-gui UI on `https://linstor-gui.<root-host>` behind the cluster Keycloak realm using the same oauth2-proxy gatekeeper pattern that the dashboard uses, so the LINSTOR REST API is never exposed unauthenticated through Ingress. The Ingress is rendered only when **both** gates are satisfied: - `_cluster.oidc-enabled == "true"` - `linstor-gui` is listed in `_cluster.expose-services` (i.e. in `publishing.exposedServices` in the core cozystack values) If OIDC is disabled cluster-wide we intentionally do **not** ship an unauthenticated ``token-proxy`` fallback — unlike dashboard, there is no reason to front a raw storage-management API with k8s bearer tokens. Operators can still reach the UI via \`kubectl port-forward\` to the ClusterIP service. ## What's new - \`templates/gatekeeper.yaml\` — oauth2-proxy Deployment (OIDC mode), upstream \`linstor-gui.<ns>.svc:80\` - \`templates/gatekeeper-svc.yaml\` — ClusterIP :8000 in front of it - \`templates/gatekeeper-sa.yaml\` — dedicated SA, no auto-token - \`templates/keycloakclient.yaml\` — persistent \`linstor-gui-client\` + \`linstor-gui-auth-config\` Secrets, \`KeycloakClient\` CRD that auto-provisions the OIDC client with \`redirectUris: [/oauth2/callback/*]\` - \`templates/ingress.yaml\` — Ingress to the gatekeeper Service with cert-manager ClusterIssuer, gated on expose-services + oidc-enabled - \`tests/ingress_auth_test.yaml\` — unit tests for each conditional branch, KeycloakClient rendering, oauth2-proxy args README updated with Option 1 (Keycloak-protected Ingress) and Option 2 (port-forward). ### Release note \`\`\`release-note Added an opt-in Keycloak-protected Ingress for the linstor-gui package. Add \`linstor-gui\` to \`publishing.exposedServices\` to publish \`https://linstor-gui.<root-host>\` behind the cluster OIDC realm. \`\`\` ## Test plan - [ ] Deploy to dev10 with \`linstor-gui\` added to \`publishing.exposedServices\` - [ ] Verify cert-manager issues the TLS certificate - [ ] Open \`https://linstor-gui.<root-host>\` in a browser, confirm Keycloak login challenge - [ ] After login, confirm LINSTOR node list loads via the nginx → mTLS proxy - [ ] Verify helm-unittest cases pass in CI - [ ] Sanity-check that when \`oidc-enabled=false\` or the service is not in \`expose-services\`, the Ingress + gatekeeper resources are skipped