Add OIDC auth support and documentation migration notices#244
Merged
Conversation
5 tasks
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
adc5dca to
a8ab8ef
Compare
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
37809c4 to
7d5bb10
Compare
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
a8ab8ef to
5826315
Compare
3 tasks
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
8739e57 to
0560ee9
Compare
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
5826315 to
a8ab8ef
Compare
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
0560ee9 to
5341cd7
Compare
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
a8ab8ef to
0820357
Compare
3 tasks
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
0820357 to
f102b2b
Compare
mhotan
force-pushed
the
mike/selfhosted-auth
branch
2 times, most recently
from
b3c9d83 to
ee5c015
Compare
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
f102b2b to
59e6b8b
Compare
mhotan
changed the title
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
04fb019 to
e454af1
Compare
mhotan
force-pushed
the
mike/selfhosted-controlplane
branch
from
e45fc2e to
e1c98e2
Compare
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
e454af1 to
0265d61
Compare
Contributor
Current Aviator status
This PR was merged manually (without Aviator). Merging manually can negatively impact the performance of the queue. Consider using Aviator next time.
See the real-time status of this PR on the
Aviator webapp.
Use the Aviator Chrome Extension
to see the status of your PR within GitHub.
|
ctxswitch
approved these changes
Mar 3, 2026
Enable full gRPC auth enforcement: - configMap.union.auth.enable: true (service-to-service OAuth2) - flyte.configmap.adminServer.auth.disableForGrpc: false - Scheduler auth secret mount (clientSecret: "placeholder", overwritten by ExternalSecret) - Dataplane operator/propeller/CRS auth enabled - Protected ingress annotations for nginx auth subrequest Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add full OIDC/OAuth2 auth config to GCP controlplane values (globals, flyteadmin OIDC, service-to-service auth, ingress annotations, scheduler secrets, executions auth) - Add OAuth2 auth config to GCP dataplane values (CRS, operator, propeller, secrets, executor) - Add Authentication (OIDC/OAuth2) sections to all 4 SELFHOSTED intra-cluster docs (AWS/GCP x controlplane/dataplane) - Remove disableForGrpc from all values files - Use generic OIDC/OAuth2 language throughout (no provider-specific references) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change protectedIngressAnnotationsGrpc auth-url from https://$host/me to http://flyteadmin.<namespace>.svc.cluster.local/me so the nginx auth subrequest stays within the cluster network. This avoids potential interference from corporate proxies, VPNs, or WAFs that may intercept outbound HTTPS requests to the external hostname. Also enable tpl rendering for protectedIngressAnnotationsGrpc annotations so helm template expressions resolve correctly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add notes to selfhosted-intracluster values overlay files indicating that common (non-cloud-specific) configuration is being migrated to values.yaml over time. Add deprecation notices to SELFHOSTED_INTRA_CLUSTER docs pointing to the new canonical docs on the Union documentation site. Update controlplane README.md to reference the docs site. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mhotan
force-pushed
the
mike/selfhosted-auth
branch
from
0265d61 to
de2e96c
Compare
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds OIDC authentication configuration and documentation updates for self-hosted intra-cluster deployments.
OIDC Auth
sharedService.authDocumentation
values.yamlSELFHOSTED_INTRA_CLUSTER_*.mdfiles pointing to unionai-docscontrolplane/README.mdselfhosted section to reference docs siteRelated PRs
Test plan
helm templatewith auth globals produces correct flyteadmin configprotectedIngressAnnotationsGrpcauth-url points to cluster-internal flyteadmin/login,/callback,/meendpoints workuctl config init+uctl get projectmain