Uploaded image for project: 'OpenShift Container Platform (OCP) Strategy'
  1. OpenShift Container Platform (OCP) Strategy
  2. OCPSTRAT-2510

Feature Parity between kube-rbac-proxy and oauth-proxy

XMLWordPrintable

    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Feature Overview (aka. Goal Summary)  

      As more and more customers use KRP with BYO External Auth, we would like to have parity between KRP and Oauth-proxy. 

      Some of the issues include:

      1. Ability in Kube RBAC proxy to have verb added to resourceAttributes. This enables users to associate verbs with resources easily without the need to hard-code them as static expressions. This also brings parity with Oauth-proxy.  

      2. Configurable timeouts in KRP

      Goals (aka. expected user outcomes)

      Work on feature parity between OAuth-proxy and KRP to enable customers to transition between them without impacting critical functionality. 

      Requirements (aka. Acceptance Criteria):

      1. Users can associate verb at resourceAttribute level like this

      --authorization-k8s-resource-attributes=group=core,resource=pods,verb=list,namespace=default
      --authorization-k8s-resource-attributes=group=apps,resource=deployments,verb=watch,namespace=default

      2. Users can set timeouts 
        

      Anyone reviewing this Feature needs to know which deployment configurations that the Feature will apply to (or not) once it's been completed.  Describe specific needs (or indicate N/A) for each of the following deployment scenarios. For specific configurations that are out-of-scope for a given release, ensure you provide the OCPSTRAT (for the future to be supported configuration) as well.

      Deployment considerations List applicable specific needs (N/A = not applicable)
      Self-managed, managed, or both Y
      Classic (standalone cluster)  
      Hosted control planes TBD
      Multi node, Compact (three node), or Single node (SNO), or all  
      Connected / Restricted Network  
      Architectures, e.g. x86_x64, ARM (aarch64), IBM Power (ppc64le), and IBM Z (s390x)  
      Operator compatibility  
      Backport needed (list applicable versions)  
      UI need (e.g. OpenShift Console, dynamic plugin, OCM)  
      Other (please specify)  

      Use Cases (Optional):

      Include use case diagrams, main success scenarios, alternative flow scenarios.  Initial completion during Refinement status.

      <your text here>

      Questions to Answer (Optional):

      Include a list of refinement / architectural questions that may need to be answered before coding can begin.  Initial completion during Refinement status.

      <your text here>

      Out of Scope

      High-level list of items that are out of scope.  Initial completion during Refinement status.

      <your text here>

      Background

      Parity with OAuth-proxy. 

      Customer Considerations

      Provide any additional customer-specific considerations that must be made when designing and delivering the Feature.  Initial completion during Refinement status.

      <your text here>

      Documentation Considerations

      Provide information that needs to be considered and planned so that documentation will meet customer needs.  If the feature extends existing functionality, provide a link to its current documentation. Initial completion during Refinement status.

      <your text here>

      Interoperability Considerations

      Which other projects, including ROSA/OSD/ARO, and versions in our portfolio does this feature impact?  What interoperability test scenarios should be factored by the layered products?  Initial completion during Refinement status.

      <your text here>

              atelang@redhat.com Anjali Telang
              atelang@redhat.com Anjali Telang
              None
              Krzysztof Ostrowski
              Seth Jennings Seth Jennings
              Xingxing Xia Xingxing Xia
              Andrea Hoffer Andrea Hoffer
              Ashish Humbe Ashish Humbe
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: