UNCLASSIFIED - NO CUI

Expose additional fields for Neuvector SSO

To enable mapping roles/groups from Keycloak for Neuvector we need to expose additional fields from the oidcinitcfg.yaml.

Currently it is necessary to pass through additional values for group_mapped_roles and group_claim as follows:

neuvector:
  enabled: true

  sso:
    enabled: true
    client_id: neuvector
    client_secret: <client secret>
    default_role: null
    issuer: https://keycloak.bigbang.dev/auth/realms/baby-yoda

  # additional mapping required to map Keycloak roles/groups to Neuvector groups 
  values:
    controller:
      secret:
        data:
          oidcinitcfg.yaml:
            group_claim: roles # claim in token to pull groups from
            # list of groups to map to Neuvector global roles 
            group_mapped_roles:
              - group: admin 
                global_role: admin 
              - group: reader
                global_role: reader

It would be good to expose group_mapped_roles and group_claim as part of the BigBang umbrella values so that the config could be expressed as (or an abstraction around these values):

neuvector:
  enabled: true

  sso:
    enabled: true
    client_id: neuvector
    client_secret: <client secret>
    default_role: null
    issuer: https://keycloak.bigbang.dev/auth/realms/baby-yoda
    group_claim: roles
    group_mapped_roles:
      - group: admin 
        global_role: admin 
      - group: reader
        global_role: reader

See Neuvector configmap/secret init config documentation - https://open-docs.neuvector.com/deploying/production/configmap

Relavent documentation being added to Neuvector - big-bang/product/packages/neuvector!30 (diffs)

Edited by Rob Ferguson