feat: allow specifying disable-auth when creating the server #1251
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
whynowy
reviewed
Oct 23, 2023
server/routes/routes.go
Outdated
| @@ -30,6 +30,8 @@ type SystemInfo struct { | |||
| ManagedNamespace string `json:"managedNamespace"` | |||
| Namespaced bool `json:"namespaced"` | |||
| Version string `json:"version"` | |||
| DisableAuth bool `json:"disableAuth"` | |||
There was a problem hiding this comment.
This SystemInfo is exposed to the client, do not add those information to this struct.
There was a problem hiding this comment.
+1. I am going to create a separate struct AuthInfo to hold the DisableAuth and DexServerAddr, hence the /systemInfo API call won't expose auth configurations.
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
Signed-off-by: Keran Yang <[email protected]>
|
isn't it better to disable auth by default, and enable only on-demand. which experience will be better for users testing it out? |
KeranYang
commented
Oct 23, 2023
| @@ -38,6 +38,8 @@ spec: | |||
| image: quay.io/numaproj/numaflow:latest | |||
| args: | |||
| - "server" | |||
| # By default, turn off authentication and authorization. | |||
There was a problem hiding this comment.
cc: @vigith This also replies to your comment above. :)
Signed-off-by: Keran Yang <[email protected]>
whynowy
reviewed
Oct 23, 2023
cmd/commands/server.go
Outdated
| @@ -64,7 +64,7 @@ func NewServerCommand() *cobra.Command { | |||
| command.Flags().BoolVar(&namespaced, "namespaced", false, "Whether to run in namespaced scope, defaults to false.") | |||
| command.Flags().StringVar(&managedNamespace, "managed-namespace", sharedutil.LookupEnvStringOr("NAMESPACE", "numaflow-system"), "The namespace that the server watches when \"--namespaced\" is \"true\".") | |||
| command.Flags().StringVar(&baseHref, "base-href", "/", "Base href for Numaflow server, defaults to '/'.") | |||
| command.Flags().BoolVar(&disableAuth, "disable-auth", false, "Whether to disable authentication, defaults to false.") | |||
| command.Flags().BoolVar(&disableAuth, "disable-auth", true, "Whether to disable authentication and authorization, defaults to true for easy on-boarding.") | |||
There was a problem hiding this comment.
It would be better to set the default to false here, but add the arg true in the manifests.
Signed-off-by: Keran Yang <[email protected]>
whynowy
approved these changes
Oct 23, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
User can update the numaflow deployment to turn on and off AuthN/AuthZ by passing in an argument.
Tested by turning on and off the auth and verifying that after turning it off, my read-only role can perform write operations like CreatePipeline.