Skip to content

Commit 86e94d3

Browse files
ironcommitironcommit
committed
update
Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>
1 parent c29ebc6 commit 86e94d3

42 files changed

Lines changed: 1576 additions & 378 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎contrib/auth/authentik/compose/implementation-details.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -126,11 +126,13 @@ Envoy is the public entrypoint for the Compose example. It routes:
126126

127127
Before authentication, Envoy removes incoming `X-NMP-Principal-*` and
128128
`X-NMP-Scopes` headers so a client cannot spoof identity or scopes. For
129-
protected `/apis/` requests, Envoy calls NeMo Platform's
130-
`/apis/auth/authenticate` endpoint with the presented bearer token. The auth
131-
service validates Authentik OIDC tokens, NeMo Platform workload-exchange access
132-
tokens, and NeMo Platform Scoped Access Keys, then returns trusted
133-
`X-NMP-Principal-*` and `X-NMP-Scopes` headers for Envoy to forward upstream.
129+
protected `/apis/` requests, Envoy calls NeMo Platform's `/apis/auth/ext-authz`
130+
endpoint with the presented bearer token. The auth service validates Authentik
131+
OIDC tokens, NeMo Platform workload-exchange access tokens, and NeMo Platform
132+
Scoped Access Keys, then returns trusted `X-NMP-Principal-*` and `X-NMP-Scopes`
133+
headers for Envoy to forward upstream. The public `/apis/auth/authenticate`
134+
endpoint remains a JSON diagnostic/API endpoint for direct callers and is not
135+
the configured Envoy callout.
134136

135137
The gateway callout is required for dynamic or revocable Scoped Access Keys
136138
because Envoy JWKS validation can only prove token signature, issuer, audience,

‎contrib/auth/authentik/gateway/envoy.yaml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,19 @@ static_resources:
6969
key: x-forwarded-proto
7070
value: https
7171
append_action: OVERWRITE_IF_EXISTS_OR_ADD
72+
- match:
73+
prefix: "/apis/auth/ext-authz"
74+
route:
75+
cluster: nemo
76+
typed_per_filter_config:
77+
envoy.filters.http.ext_authz:
78+
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
79+
disabled: true
80+
request_headers_to_add:
81+
- header:
82+
key: x-forwarded-proto
83+
value: https
84+
append_action: OVERWRITE_IF_EXISTS_OR_ADD
7285
- match:
7386
path: "/apis/auth/jwks"
7487
route:
@@ -235,7 +248,7 @@ static_resources:
235248
uri: "http://nemo:8080"
236249
cluster: nemo
237250
timeout: 5s
238-
path_prefix: "/apis/auth/authenticate"
251+
path_prefix: "/apis/auth/ext-authz"
239252
authorization_response:
240253
allowed_upstream_headers:
241254
patterns:

‎contrib/auth/authentik/helm/templates/_envoy-config.tpl‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,19 @@ static_resources:
8787
key: x-forwarded-proto
8888
value: https
8989
append_action: OVERWRITE_IF_EXISTS_OR_ADD
90+
- match:
91+
prefix: "/apis/auth/ext-authz"
92+
route:
93+
cluster: nemo
94+
typed_per_filter_config:
95+
envoy.filters.http.ext_authz:
96+
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
97+
disabled: true
98+
request_headers_to_add:
99+
- header:
100+
key: x-forwarded-proto
101+
value: https
102+
append_action: OVERWRITE_IF_EXISTS_OR_ADD
90103
- match:
91104
path: "/apis/auth/jwks"
92105
route:
@@ -243,7 +256,7 @@ static_resources:
243256
uri: {{ printf "http://%s:%v" $apiServiceName .Values.api.service.port | quote }}
244257
cluster: nemo
245258
timeout: 5s
246-
path_prefix: "/apis/auth/authenticate"
259+
path_prefix: "/apis/auth/ext-authz"
247260
authorization_response:
248261
allowed_upstream_headers:
249262
patterns:

‎contrib/auth/authentik/kubernetes/implementation-details.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,10 +137,14 @@ configuration is used for workload-exchange access tokens and Scoped Access Key
137137
JWTs. The matching public keys are served from `/apis/auth/jwks`.
138138

139139
The Helm-rendered Envoy config authenticates protected `/apis/` requests by
140-
calling `/apis/auth/authenticate` on the NeMo Platform API service. It does not
141-
use Envoy `claim_to_headers` for Scoped Access Keys. This keeps future
142-
revocation and dynamic-key checks inside the auth service, where access-key records can be
143-
looked up before Envoy forwards trusted principal headers.
140+
calling `/apis/auth/ext-authz` on the NeMo Platform API service. That endpoint
141+
validates the presented bearer token and returns trusted `X-NMP-Principal-*`
142+
response headers for Envoy to copy upstream. The public
143+
`/apis/auth/authenticate` endpoint remains a JSON diagnostic/API endpoint for
144+
direct callers and is not the configured Envoy callout. The gateway does not use
145+
Envoy `claim_to_headers` for Scoped Access Keys, keeping revocation and dynamic
146+
key checks inside the auth service before Envoy forwards trusted principal
147+
headers.
144148

145149
Scoped Access Keys remain disabled in the checked-in chart values by default.
146150
Runtime tests and local experiments can enable them with

‎docs/auth/deployment/gateway.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ http_filters:
8989
uri: "http://nemo:8080"
9090
cluster: nemo
9191
timeout: 5s
92-
path_prefix: "/apis/auth/authenticate"
92+
path_prefix: "/apis/auth/ext-authz"
9393
authorization_response:
9494
allowed_upstream_headers:
9595
patterns:
@@ -102,7 +102,7 @@ http_filters:
102102
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
103103
```
104104
105-
Envoy HTTP `ext_authz` callouts preserve the original request method and build the check URL from `path_prefix` plus the original request path. For example, `DELETE /apis/entities/v2/workspaces/default` is checked as `DELETE /apis/auth/authenticate/apis/entities/v2/workspaces/default`. NeMo accepts that prefixed callout URL, validates only the bearer token, and returns trusted principal headers. The original request path is still authorized later by the service PDP check after Envoy forwards the request.
105+
Envoy HTTP `ext_authz` callouts preserve the original request method and build the check URL from `path_prefix` plus the original request path. For example, `DELETE /apis/entities/v2/workspaces/default` is checked as `DELETE /apis/auth/ext-authz/apis/entities/v2/workspaces/default`. NeMo accepts that prefixed callout URL, validates only the bearer token, and returns trusted principal headers. The original request path is still authorized later by the service PDP check after Envoy forwards the request. `/apis/auth/authenticate` remains the direct JSON token-inspection endpoint and is not the configured Envoy callout.
106106

107107
</Accordion>
108108
### Header Stripping

‎docs/auth/deployment/hardening.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ For the security architecture, see [Security Model](/documentation/access-contro
3030

3131
- [ ] **Strip auth headers from external requests**: Configure your ingress/gateway to remove `X-NMP-Principal-Id`, `X-NMP-Principal-Email`, `X-NMP-Principal-Groups`, `X-NMP-Principal-On-Behalf-Of`, and `X-NMP-Scopes` from all incoming external traffic. See [Gateway Integration](/documentation/access-control/deployment/gateway-integration).
3232
- [ ] **Enable TLS termination**: Terminate TLS at the ingress or load balancer. Tokens in `Authorization` headers are sent in the clear without TLS.
33-
- [ ] **Consider gateway bearer-auth callout**: To enforce bearer-token validation before requests reach platform services, configure Envoy `ext_authz` to call `/apis/auth/authenticate`. See [Gateway Integration](/documentation/access-control/deployment/gateway-integration).
33+
- [ ] **Consider gateway bearer-auth callout**: To enforce bearer-token validation before requests reach platform services, configure Envoy `ext_authz` to call `/apis/auth/ext-authz`. See [Gateway Integration](/documentation/access-control/deployment/gateway-integration).
3434

3535
## Policy Engine
3636

‎docs/cli/reference.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6811,7 +6811,7 @@ nemo intake ingest spans create [OPTIONS]
68116811
**Options:**
68126812

68136813
* `--workspace`
6814-
* `--source`: (required)
6814+
* `--source`: Stable name for the source trace store, such as `langsmith` or `mlflow`.
68156815
* `--spans`: JSON string
68166816

68176817
**Help:**

‎openapi/ga/individual/platform.openapi.yaml‎

Lines changed: 14 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/ga/openapi.yaml‎

Lines changed: 14 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.yaml‎

Lines changed: 14 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)