UNCLASSIFIED - NO CUI

Skip to content

Resolve "Add Missing Auth Policy and Service Entry"

General MR

Summary

  • Added authorization policy to allow communication from Kiali
  • Added service entry to white list domains when bbtests is enabled
  • Updated network policy for helm tests as it had an unnecessary check to make sure artifacts were enabled

**Note: Currently this authorization policy deploys as part of the AuthService package, however, it is too permissive. Additionally, it was added there to solve an issue where SSO authentication was not functioning as expected without it which was caused by a misconfiguration elsewhere in Keycloak. A follow-up issue has been created to remove that authorization policy once this one has been put into place.

**Note: Previously service entries for bbtests were being added in test-values.yaml file and they had additional URL's that were no longer needed. This update removes the need to have those entries in our test-values.yaml file and treats it the same way our network policy for helm-tests is treated.

**Note: Used the following values to validate network policy and service entries work as expected when bbtests is enabled:

  values:
    bbtests:
      enabled: true
      cypress:
        artifacts: false
        envs:
          cypress_url: "https://tracing.dev.bigbang.mil"

Relevant logs/screenshots

Validated Kiali no longer shows 403 RBAC_ACCESS_DENIED errors:

image

Validated Cypress test works as expected (Testing service entries and network policy):

Output from helm test jaeger-jaeger -n bigbang

image

Linked Issue

issue

Upgrade Notices

N/A

Closes #154 (closed)

Edited by Jimmy Bourque

Merge request reports

Loading