Repository navigation
feat(kubernetes): laptop-client docs, security chart settings and the notebook operator - #38
Open
KFilippopolitis wants to merge 12 commits into
Open
KFilippopolitis wants to merge 12 commits into
KFilippopolitis wants to merge 12 commits into
Conversation
…sers' own computers keycloak.cliClientId (empty by default, which keeps the feature off) names the public Keycloak client the mip Python client and the portal's token page use. Wire it through the chart, the dev compose stack, and document the per-federation Keycloak client setup in the README.
jupyterhub.spawner: operator-api renders the same NotebookProfile as operator, but the hub calls the notebook operator's HTTPS spawn API (jupyterhub.operatorApi) instead of the Kubernetes API. The hub pod gets no ServiceAccount token at the standard path, only a projected token bound to audience mip-notebook-operator plus its CA, and the chart renders no Role or RoleBinding whatever rbac.create says. The operator-mode Role drops list and watch on notebooks. Rendering fails on an unknown spawner.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Source is mip-jupyter master at 1665367; its history stays there. The chart already ships the NotebookProfile, so the CRD and the template now change in one PR and share one version. The Go module becomes github.com/Medical-Informatics-Platform/mip/operator. The spawn API RBAC and the token Secret policy move to operator/testdata: they are test fixtures, deployed from mip-infra. The policy fixture now follows the one staging deploys (name binding to the owner's UID, jupyter-* owners only) and still admits the hub while production runs operator mode. Controller tests use federation-* namespaces, as the policy expects.
Ported from mip-jupyter and limited to operator/: envtest and image build, image scan, SCA, SAST, gitleaks, publish on release (Docker Hub and Harbor), and a manual sha-<commit> preview build for staging. The per-federation staging-b and staging-c builds are not ported: there is one operator per cluster.
Replaces the manual preview build. Every operator change on master now publishes dev and sha-<commit> to Docker Hub; a MIP release still publishes the versioned image.
Pass EXAFLOW_API_TOKEN from an optional secret and KEYCLOAK_REQUIRED_AUDIENCE to the backend, and KEYCLOAK_ORIGIN to platform-ui for its CSP. KEYCLOAK_ORIGIN is omitted when keycloak.host is empty, so the image default applies.
… runbook and the turn-on gate - Full scope allowed off, with the platform client's data roles (or one composite role) in the laptop client's dedicated scope, and the rule to add new dataset roles there. - PKCE S256 enforced; implicit flow, direct access grants and service accounts off; Client Offline Session Idle 30 days next to Max 180 days. - Ask EBRAINS for the flow override without the Cookie execution and for Consent required. - New 'Ending a laptop sign-in' runbook: user, admin and lost-laptop revocation steps, with a placeholder for the EBRAINS admin contact. - Turn-on checklist next to cliClientId in the README, and a values.yaml comment pointing at it; step 6 of the rollout order now states that laptop sign-in stays off until requiredAudience is set, with the laptop-token decode checks (azp, aud, typ).
…okens Passes KEYCLOAK_CLI_REQUIRE_DPOP to the backend, defaulting to false, for platform-backend PR #53. Turns on only together with DPoP on the laptop client in Keycloak and a DPoP-capable mip-client.
After revocation an already-issued access token still works for up to 5 minutes, instead of the backwards 'once renewal fails' phrasing.
KEYCLOAK_REQUIRED_AUDIENCE and KEYCLOAK_CLI_REQUIRE_DPOP on the backend and KEYCLOAK_ORIGIN on the UI, matching the chart so local testing of the laptop-sign-in checklist has the same shape as Kubernetes.
KFilippopolitis
force-pushed
the
feat/k8s-security-and-notebook-operator
branch
from
November 9, 2026 17:57
6639f4b to
b88ba92
Compare
… inheriting all secrets
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #36 (closed unmerged; its chart settings are all contained here).
Summary
Kubernetes chart and docs (
deployment/kubernetes)EXAFLOW_API_TOKEN(optional secret),KEYCLOAK_REQUIRED_AUDIENCE,KEYCLOAK_CLI_CLIENT_IDandKEYCLOAK_ORIGINto the backend/UI;keycloak.cliClientIdandkeycloak.requiredAudienceare new values, empty by default.requiredAudiencewith token decode checks; laptop sign-in stays off until the audience is set).S256enforced, implicit/direct-grant/service-accounts off, Full scope allowed off with data roles (or a composite) in the dedicated scope plus the new-dataset-role rule, offline session idle 30 days, EBRAINS flow-override and consent request.cliClientId(README andvalues.yamlcomment) and a new Ending a laptop sign-in runbook section (user/admin/lost-laptop revocation).Notebook operator (
operator/)Tests
helm lint .andhelm templatewithkeycloak.cliClientId/keycloak.requiredAudienceset; template renders with the security settings on and off.Not applied to a real cluster, and nothing has run against the EBRAINS realm. The README leaves two placeholders: the EBRAINS admin contact for the runbook and the minimum platform-ui
prompt=loginversion.Rollback
Revert the PR; all new chart values default to empty/off.