feat: Add stac-auth-proxy. #358
Conversation
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
4 times, most recently
from
f463b6b to
650a01e
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
5 times, most recently
from
10cb103 to
f76cfa7
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
f76cfa7 to
0abcf57
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
0abcf57 to
2a43c59
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
2a43c59 to
f13e4f3
Compare
This could be useful when the auth server is deployed with stac-auth-proxy and we need to wait. At least in eoAPI would be good for testing (developmentseed/eoapi-k8s#358). --------- Co-authored-by: Anthony Lukach <[email protected]>
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
e15f7de to
d82dcfd
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
2 times, most recently
from
38a30e1 to
94ff7d1
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
94ff7d1 to
feb8792
Compare
| - it: should not create stac routes when stac is disabled | ||
| set: | ||
| ingress.enabled: true | ||
| stac.enabled: false |
There was a problem hiding this comment.
Is it ever valid to have stac disabled but stac-auth-proxy enabled? Should that rather be a validation check that stac-auth-proxy cannot be enabled is stac.enabled is set to false ?
There was a problem hiding this comment.
Yes, indeed stac-auth-proxy without stac doesn't make sense. Will adjust in a bit.
On a side note: does anybody deploy eoAPI without the stac service at all?
There was a problem hiding this comment.
On a side note: does anybody deploy eoAPI without the stac service at all?
Not that I know of. But it seems like it makes sense to leave the option in there for consistency? I think it can sometimes be convenient if one wants to temporarily remove a service or so.
batpad
left a comment
batpad
left a comment
There was a problem hiding this comment.
@pantierra this looks really good to me! 👏
Left one minor comment - feel free to ignore if it seems like I misunderstood.
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
5296712 to
bf1c0e1
Compare
pantierra
force-pushed
the
feature/stac-auth-proxy
branch
from
bf1c0e1 to
fab55d0
Compare
Closes #222
Integrates stac-auth-proxy as an optional authentication/authorization layer for the STAC API service. When enabled, all STAC API requests are routed through the auth proxy, which validates tokens against an OIDC provider before forwarding to the upstream STAC service.
ghcr.io/developmentseed/stac-auth-proxy/charts(version 0.1.1)OIDC_DISCOVERY_URLis set whenstac-auth-proxyis enabledstac-auth-proxywhen enabled, falls back to direct STAC service when disabled.DEFAULT_PUBLIC=trueto protect the sensible defaults bystac-auth-proxywhich STAC API endpoints to protect.