Repository navigation
feat!: drop per-user App access (access.users) - #158
Merged
Merged
Conversation
Apps now restrict who may open them by Keycloak group only. Remove
spec.access.users and everything that served it:
- operator: drop AppAccess.Users from the CRD (regenerated deepcopy, CRD
and ui/src/lib/crd.gen.ts); an App is restricted, and gets an enforcing
authz sidecar, only when it is private and lists groups. The sidecar no
longer gets AUTHZ_USERS.
- authz: drop Users/UsersClaim, AUTHZ_USERS and AUTHZ_USERS_CLAIM and the
username match; enforcing mode now requires AUTHZ_GROUPS, and the 403
names the allowed groups.
- api: drop users from the access model and the CR mapping. Create and
patch bodies refuse unknown access keys (422), so a client still
sending users is not given an App open to more people than it asked
for; reads ignore a users list still stored on an old CR. The upload
route now returns 422, not 500, for an invalid manifest.
- mcp: drop the users argument of launch_app and the users wording in
its resources and prompts.
- ui: drop the "Allowed users" field, its form state and the users part
of the access line.
- docs, README, AGENTS.md, chart values/README, skill and examples:
describe group-only access.
spec.access.managers.users (who may manage an App) is unchanged.
BREAKING CHANGE: the new CRD's structural schema prunes access.users from
existing Apps. An App that restricted access only by users (no groups)
becomes open to every signed-in realm user after the upgrade, and users
let in only by name lose access to Apps that also list groups. Before
upgrading, list the affected Apps with
kubectl get apps.apps.nebari.dev -A -o json | jq -r '.items[] |
select(.spec.access.users // [] | length > 0) |
"\(.metadata.namespace)/\(.metadata.name)"'
and move those users into a Keycloak group listed in access.groups. See
docs/src/content/docs/upgrading.md, "Upgrading to group-only access".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016pvMUQJoLkBDk6B94TTm45
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016pvMUQJoLkBDk6B94TTm45
|
📄 Docs preview for |
jbouder
added a commit
that referenced
this pull request
Oct 21, 2026
The switch was read-only because the landing page could hide a tile only by group, not by username. Apps now restrict by group only (#158), so the form offers it again. A launch sends exactly what the switch shows, even when the cluster default is on; an edit sends landingPage only when the switch is flipped, so an App on the cluster default keeps it. Claude-Session: https://claude.ai/code/session_016pvMUQJoLkBDk6B94TTm45 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apps now restrict who may open them by Keycloak group only. This removes
spec.access.usersand everything that served it.spec.access.managers.users(who may manage an App) is unchanged.AppAccess.Usersis removed from the CRD; the deepcopy file, the CRD andcrd.gen.tsare regenerated. The enforcing authz sidecar is added only for private Apps that list groups, and it no longer getsAUTHZ_USERS.AUTHZ_USERSandAUTHZ_USERS_CLAIMare removed, along with the username match. Enforcing mode now requiresAUTHZ_GROUPS.usersis removed from the access model and from the mapping to the CR. Create and patch now refuse unknownaccesskeys with a 422, so an old client that still sendsusersgets an error instead of an App open to more people than it asked for. Reads ignore a staleuserslist on an old CR. Also fixes/apps/uploadreturning 500 instead of 422 for an invalid manifest.usersargument fromlaunch_appand the users wording from its resources and prompts.check_crd_compat.pyallows just this one removal and reports it as a warning. The exception is recorded in the CRD reference.Breaking change / upgrade
The new CRD's structural schema prunes
access.usersfrom existing Apps:upgrading.mdhas akubectl+jqcheck that lists the affected Apps before an upgrade, so admins can move those users into a Keycloak group first.Related: #153 (updated to drop the
access.userswork).Testing
All of these were run locally and pass:
go test -race, golangci-lint, plus the operator envtests.check:ci, build,npm test(251), Playwright e2e (143).bun test, build.helm lint.Not yet verified on a cluster.
🤖 Generated with Claude Code
https://claude.ai/code/session_016pvMUQJoLkBDk6B94TTm45