Home 2.14 Shturval Documentation Cluster administrator Services and repositories Services included in the platform Management Cluster Specific Services Authentication module (shturval-auth) Authentication server (authn-server) Authentication server (authn-server)
Раздел «Cluster administrator»: быстрый переход по подразделам
На этой странице
Expand Collapse About the service # Parameter Description System name chart shturval-authComponent sh-authnCluster Assignment OIDC/OAuth2, interactive login, logout, issuing and revoking tokens, JWKS, working with session cookies. Critical Yes Namespace shturval-backend
authn-server is included in the Helm chart shturval-auth . auth-controller , session-manager and ldap-cache are deployed in the same chart.
Contents # Review Architecture Installation/deployment Diagnostics Lifecycle Service parameters 1. Review # Purpose: to serve browser and software platform authentication scenarios: discovery OIDC (/.well-known/openid-configuration), login/logout, issuance and revocation of codes and tokens, JWKS, user cookie sh_session_id, as well as monitoring the configuration of OAuth clients and identity providers.
Features # Contour Purpose Login/logout Browser scripts and redirect login. OAuth2 endpoint authorize, token, introspect, revoke, user info.Session store Server state of user sessions. Client watcher Maintaining an up-to-date catalog of OIDC clients from AuthOidcClient. LDAP/external IdP Updating the configuration from the Secret platform.
Initiation scripts # Event Initiator Effect The user logs in Browser or client Cookies and tokens are issued according to the release policy. Modified by AuthOidcClient Kubernetes watcher The set of OAuth clients in the service memory is updated. Changed Secret LDAP / IdP configuration Platform Administrator Authorization parameters are updated. Readiness test kubelet /readyz checks the availability of associated stores.
Limitations and implications # Limit Consequence The JWT file key is looked for in the working directory The container should receive the private.pem file via volume mount. Cookie name sh_session_id is fixed by product version code It cannot be renamed through the normal configuration. Endpoint corp root CA requires /shturval/corp-root-ca.crt When using the script, provide a certificate mount. Without TOKEN_STORE_ADDR and SESSION_STORE_ADDR memory mode is possible For multiple pods, use external Redis storage.
Place in the chain of command # authn-server receives OAuth clients from AuthOidcClient, which are negotiated by auth-controller . User sessions are created by authn-server and are then viewable and deleted via session-manager . For LDAP scenarios, the directory configuration is also used ldap-cache .
Key Features # Characteristics Description Binar sh-authnProcess port PORT, default 8081Accommodation Template helm/auth/templates/dep-authn.yaml, shared pod with sh-session-manager Storage Redis or in-memory mode if store addresses are not specified
2. Architecture # Component Role sh-authnHTTP endpoint routing OIDC/OAuth2. Token store backend Storing OAuth codes, access token and refresh token. Session store backend Server state of user sessions. Kubernetes watchers Monitoring client CR and Secret LDAP/IdP. sh-session-managerAPI for lists and session clearing, called by backend.
3. Installation / deployment # The service is managed by Helm chart shturval-auth. For multi-pod operation, enable remote Redis stores for tokens and sessions; otherwise the entries in the memory of different pods will not be consistent.
Parameters are changed via ShturvalServicePatch (SSP) shturval-auth.
4. Diagnosisteak # kubectl get pods -n " ${ NAMESPACE } " -o wide
kubectl logs -n " ${ NAMESPACE } " " ${ POD } " -c sh-authn --tail= 300
kubectl logs -n " ${ NAMESPACE } " " ${ POD } " -c sh-session-manager --tail= 150
Substitute POD for actual installation.
Symptom Possible reason Action Login breaks in multi-pod mode Redis unavailable Check SESSION_STORE_ADDR and TOKEN_STORE_ADDR. Readiness always false One of the storages is unavailable Check log errors and credentials in Secret. OAuth clients do not authorize requests AuthOidcClient not consistentCheck the status of auth-operator resources.
5. Life cycle # Step Member Result 1 Ingress/LB Login to pod. 2 Process Router Selecting the desired OAuth/OIDC handler. 3 Store/watchers Reading validated authorization objects from memory and storage. 4 Response to client Redirect, JSON JWKS or token payload.
Stateful reconcile is not used: the service processes HTTP requests and watchers events.
6. Service parameters # Variable Purpose PORTProcess port, default 8081. KEY_ID, ISSUER, TOKEN_URL, AUTH_URLOIDC metadata of the signing process. AT_EXP, RT_EXP, GEN_RTToken and refresh token expiration policies. SESSION_STORE_ADDR, TOKEN_STORE_ADDRSwitch memory mode to Redis at a given address. COOKIE_DOMAINBrowser cookie area. USE_BOOTSTRAP_HOST_AS_ISSUERBootstrap HTTP behavior. POD_NAMESPACENamespace Observations Secret and CR.
For a production environment, check mount private.pem, CA bundle and Redis availability.
Изменено 2026-05-28 at 14:11