Restoring access when an external service fails

Let’s say that in the Shturval platform you have connected an external service for authentication, for example, Keycloak or Blitz (see connection instructions). There are situations when a failure may occur on the side of the external authentication service. In this case, it is possible to disable the external authentication service and restore access to the platform for all users.

To ensure that work in the platform is not interrupted if an external service fails, run:

  1. Connect to the management cluster using kubeconfig received during platform installation. Kubeconfig can also be taken from the Control Plane of the platform node /etc/kubernetes/admin.conf.
Perform further steps depending on how the OIDC provider was connected in the platform.
    1. In Secret auth-provider, change the value of the active parameter to false.
    Team — illustration
    kubectl patch secret auth-provider -n shturval-backend --type=merge -p '{"stringData":{"active":"false"}}'

    The command uses stringData, so the value of false does not need to be base64 encoded. The command will only change the active parameter; the external_idp and skip_internal_auth parameters do not need to be redefined.

    1. Check that Secret is set to false.
    Team — illustration
    kubectl get secret auth-provider -n shturval-backend -o jsonpath='{.data.active}' | base64 --decode

    The command should return the value false.

    1. Prepare a YAML file, for example, named shturval-auth.yaml with an object manifest ShturvalServicePatch (ShturvalServicePatch) to apply to the specification (ssc) shturval-auth. In ShturvalServicePatch, specify false in the AUTH_IDP_ACTIVE parameter and set the application priority in the order parameter, as in the example below.
    Example ShturvalServicePatch
    apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-auth-disable
spec:
  shturvalServiceConfigName: shturval-auth
  patchOrder: 1
  custom values:
    AUTH_IDP_ACTIVE: false
    Please note! The value of the patchOrder parameter in ShturvalServicePatch to disable the external provider must be less than in the applied ShturvalServicePatch with the connection configuration for the external authentication provider (keycloak, blitz).
    1. Apply the changes.
    Team — illustration
    kubectl apply -f SPECIFY-MANIFEST-FILE-ShturvalServicePatch

    An example manifest file name is shturval-auth-disable.yaml.

    1. Once the changes are applied, authentication should work correctly.
    ← Connect an external OIDC provider
    How access rights are assigned →