Home 2.14 Shturval Documentation Cluster administrator Services and repositories Services included in the platform Management Cluster Specific Services Authentication module (shturval-auth) Authentication operator (auth-controller) Authentication operator (auth-controller)
Раздел «Cluster administrator»: быстрый переход по подразделам
На этой странице
Expand Collapse About the service # Parameter Description GUI name Authentication Management Module System name chart shturval-authComponent auth-controllerCluster Assignment Coordination of User and AuthOidcClient objects, verification of local users via validating webhook, preparation of data for OIDC clients. Critical Yes Public repository — (component of the Shturval platform) Namespace shturval-backend
auth-controller is included in the Helm chart shturval-auth . This chart also expands authn-server , session-manager and ldap-cache .
Contents # Review Architecture Installation/deployment Diagnostics Lifecycle [Operator parameters](#6-operator parameters) CRD/API reference 1. Review # Purpose: automatic consistency of integration objects with the authorization subsystem: registered client records AuthOidcClientSecretUser
Features # Contour Intended use UserReconcilerPresent in the reconcile assembly; changing User does not lead to automatic editing of spec/status by the operator. AuthOidcClientReconcilerCreation and renegotiation of an OIDC client with a provider, observability through status fields. Validating webhook Checking the correctness of spec.passwordHash from User. Tracking provider changes Resubmitting related CRs to the negotiation queue.
Initiation scripts # What’s going on Who initiates Observed effect Negotiation AuthOidcClient Kubernetes plane or provider event Update status, if necessary Secret. Change User Kubernetes Plane The password is checked by a webhook during create/update. Call validating webhook Kubernetes API Server Reject invalid bcrypt values. Tests of survivability and readiness kubelet HTTP /healthz, /readyz on managed addresses.
Limitations and implications # Limit Consequence for the administrator UserReconciler without modifying logicRely on webhook and related services; don’t expect User autocorrection in reconcile. spec.providerType only accepts the value shturvalThe field specifies the connection between the client and the built-in implementation of the authorization provider. AUTHN_ISSUER must point to a working issuerCheck the value when transferring the stand to production. Webhook depends on TLS stuff and Service After certificate changes, check the availability of admission.
Place in the chain of command # CR AuthOidcClientauthn-serverUser
Key Features # Characteristics Description API group auth.shturval.tech, version v1beta1CR types User, AuthOidcClientCR Area Namespaced Leader election ID 953fa84f.shturval.techOperator tests Health address :8081 on control flags Webhook By default, the port is 9443, the certificate directory is specified by the flags Process isolation Binary /manager in container
2. Architecture # Component Kind Scope Description UserCustomResourceDefinition + instances Namespace bcrypt hash of user and group. AuthOidcClientCustomResourceDefinition + instances Namespace Registered OAuth clients. auth-controllerDeployment Namespace Operator control logic. Secretcore/v1Namespace Confidential information related to the client after approval.
The exact names of worker resources, labels and the number of replicas are determined by the chart templates shturval-auth.
3. Installation / deployment # The operator is supplied as part of the Helm chart shturval-auth. Chart creates Deployment auth-controller, RBAC, webhook Service and related TLS stuff. The namespace is specified by the platform release.
Any parameter changes must be done via ShturvalServicePatch (SSP)
4. Diagnostics # kubectl get deploy,pods -n " ${ NAMESPACE } "
kubectl logs -n " ${ NAMESPACE } " deploy/auth-controller -c manager --tail= 200
kubectl get authoidcclients.auth.shturval.tech -n " ${ NAMESPACE } " -o wide
kubectl get users.auth.shturval.tech -n " ${ NAMESPACE } " -o wide
kubectl get validatingwebhookconfiguration
Event Possible reason Action ConditionCreateClient = False longissuer, TLS or client account with provider unavailable Check AUTHN_ISSUER, network connectivity to authn-server and associated Secret. Webhook not available Certificate, Service or CA bundle error Restore API server connectivity to webhook Service. User rejected on creationbcrypt hash failed validating webhook Use the correct bcrypt hash format.
5. Life cycle # User # Stage Behavior Create/Update Webhook checks bcrypt; the object is saved upon successful validation. Reconcile operator Completes without observable spec/status changes. Delete Standard Kubernetes deletion policies are used.
AuthOidcClient # Stage Behavior Starting approval Until the final state, Ready=false is set, then a reconciliation with the provider manager is performed. Repeat On errors, reconcile returns a controller-runtime error. Link Secret Secret becomes a bound object by CR. Removal Check the remaining resources with the provider after removing the CR.
6. Operator parameters # Process flags # Flag Default Description --metrics-bind-address0Process metrics address. --health-probe-bind-address:8081Vitality tests. --leader-electfalseLeader election. --metrics-securetrueSecure metrics. --enable-http2falseHTTP/2. --root-ca-configmap-volume-path/root-ca/ca-bundle.pemRoot CA mount point for outbound TLS checks. --webhook-port9443webhook port. --webhook-cert-dir/tmp/k8s-webhook-server/serving-certs/Catalog of TLS webhook materials. --debugfalseDetailed log recording via zap.
Environment Variables # Variable Description AUTHN_ISSUERIssuer of the internal authorization provider. ENABLE_WEBHOOKSWhen false blocks webhook registration. LOG_LEVELLog recording level.
7. CRD/API reference # Group: auth.shturval.techv1beta1Namespaced .
User # Field spec Type Required Description passwordHashstring Yes bcrypt hash of the user’s password. groups[]stringNo Local user groups.
AuthOidcClient # Field spec Type Required Description clientSecretRefSecretReferenceNo Secret with client ID and client secret OAuth. providerTypestring enum (shturval) Yes Client management class.
Status field Description clientInfoIssuer URL, CA, claims mapping groups and username. clientHashmd5 of observed client configuration data for change detection. clientSecretRefObserved position of the secretion. conditionsSequence of coordination phases.
Condition True False reasons ConditionInitClientManagerThe provider manager has been successfully built. Configuration error. ConditionCreateClientThe client exists or has been created. Error writing configuration to provider. ConditionValidateClientStatusThe client’s external state is synchronous with the platform’s expectations. Status validation error.
Изменено 2026-06-05 at 14:30