finleap-connect / monoskope Goto Github PK
View Code? Open in Web Editor NEWAuthN & AuthZ for Kubernetes multi-cluster, multi-cloud environments.
Home Page: https://monoskope.io
License: Apache License 2.0
AuthN & AuthZ for Kubernetes multi-cluster, multi-cloud environments.
Home Page: https://monoskope.io
License: Apache License 2.0
Describe the bug
In one occasion a user had a trailing whitespace in his lastname field in OneLogin. This was apparently synchronized as is and lead to a malformed namespace setting in a generated kubeconfig.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Leading and trailing whitespaces in name fields are trimmed and ignored leading to working kubeconfig generation
Describe the bug
When running monoctl create cubeconfig
command an authentication window inside the browser is open. Once user is successfully authenticated there is a confirmation message. Tab doesn't close and message saying The window will be closed goes to negative seconds.
To Reproduce
Login with monoctl.
Expected behavior
Tab/Window should close after 10 seconds.
Currently the backup is only to be configured via helm chart as cronjob
. Restoring works via helm chart too, but is not very convenient. As a proposal it would be nice if an administrator could trigger a backup job from monoctl
as well as restore a specific backup via monoctl
.
AC:
monoctl backup create
as system admin
monoctl
directly if the backup is finishedmonoctl backup restore
as system admin
monoctl backup list
which shows which backups exist in s3In newer clusters we can leverage VPA and Monoskope’s helm chart should make it possible to activate this to make best use of cloud resources.
AC:
QueryHandler authorization is currently not available, but in the future it should definitely be tied to roles of a user what a user can query. The decision was made to proceed with Open Policy Agent (OPA) to manage command/query authorization.
AC:
After the relation between tenants and clusters has been introduced and authorization on the QueryHandler is present, we need to cut down that everyone gets every cluster configured when using monoctl create kubeconfig
. Instead only those clusters should be written to the users kubeconfig
which they actually have access to with the actual roles only they have within each cluster.
AC:
Describe the bug
Vault Operator (optional) link on the deployment doc does not resolve to a publicly available repository.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
I would expect the link to the repository to work.
Additional context
👋🏻
Describe the bug
The referenced rabbitMQ chart is not available anymore. We need to update the base chart version to at least 9.x.x or already jump to 10.x.x.
Update notes: https://github.com/bitnami/charts/tree/master/bitnami/rabbitmq#to-900
This currently leads to failing builds.
Expected behavior
RabbitMQ chart is available and builds succeed.
Describe the bug
While backups work, the purging of old backups doesn't
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Backups should be purged based on the set retention policy.
Additional context
Looking into it the implementation is generally there, but one piece is missing at here:
monoskope/cmd/eventstore/backup.go
Line 119 in ccf245d
The split repo situation makes development and testing harder than it should be. Even versioning is harder this way. To align versions of server and client matching each other and making development easier I would merge both repos.
AC:
We discovered that for the feature to really work out all RBACs it has to know namespaces that exist in clusters. After a discussion we decided that namespaces should be something managed by m8 too.
AC:
currently, whenever a pull request is opened all CI actions will run regardless if the actual targeted check is relevant.
for example if only go files were changed then no need to run the helm CI and vice verse.
AC:
Describe the bug
One example would be the admin user created manually for the gateway
(see here) and it's "duplicate" created by the commandHandler
for the queryHandler
after defining the SUPER_USERS
environment variable see here
To Reproduce
Steps to reproduce the behavior:
queryHandler
server by its email
and check its ID
against the admin user defined in the gateway
test environment or see here.Expected behavior
to follow the example both IDs
must match but in general, the state should be the same.
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
Add any other context about the problem here.
We propose to change how cluster access works in general:
Currently there is an aggregate TenantClusterBinding which grants access, but that is very specific to the Tenant stuff. I would like it better if we could give a single user access to a cluster too. Like a ClusterAccess which can point to a user or a tenant or all users to give all users access to a cluster.
AC:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.