Integration of Adgangskomponent - #34
Conversation
cableman
left a comment
cableman
left a comment
There was a problem hiding this comment.
You also need to update https://os2ai.github.io/documentation/technical/installation/deployment.html with information about installation and what placeholder should be replaces and with what.
| project: searxng | ||
| namespace: searxng | ||
| automated: false | ||
| automated: true |
There was a problem hiding this comment.
The changes here with automated is not related to adgangskomponent. If it is changed, https://os2ai.github.io/documentation/technical/installation/deployment.html, needs to be updated as well.
There was a problem hiding this comment.
Right - will revert.
Let's talk about what the default policy should be at the next core meeting. I know the deployments running in Computerome all use automated: true for these settings, hence the suggested change.
There was a problem hiding this comment.
Not to begin with @hypesystem. When bootstrapping a new setup automated is "false" to make room for creating the required sealed-secrets, before we set everything to automated: true and start rolling out the rest of the infra.
This uses the https://github.com/os2ai/adgangskomponent chart to run an OS2ai Adgangskomponent deployment in the cluster, providing a connection to Fælleskommunal Adgangsstyring.
d798448 to
71ff269
Compare
Instead use automated: false for workloads that may require evaluation before update
| - name: OAUTH_CLIENT_ID | ||
| value: os2ai | ||
| - name: OAUTH_CLIENT_SECRET | ||
| value: en3tKNYg1yKKAwfve9gtFG6DtsjKqq #Adgangskomponent TODO: regen secret on startup, place in secret, make available here. |
There was a problem hiding this comment.
This still feels weird to include?
3 participants
This PR integrates the OS2ai Adgangskomponent chart to provide authentication via Fælleskommunal Adgangsstyring (FKA).
The chart relies on the presence of a keycloak-operator already installed to manage the component.
The component itself is a configured Keycloak instance that on first setup (if configured correctly) creates a realm that integrates the openwebui instance to FKA.
Once the integration is set up, the Adgangskomponent must be registered as an IT-system in FKA for the connection to work.