Repository navigation
fix(operator): configure web access and deployment defaults - #880
Merged
Merged
Conversation
Use finishWriting before querying or inspecting the index and close stores during cleanup. Assert terminal close behavior and Directory release while preserving the existing tokenization and serialized-document golden data.
Inherit Spring Boot test dependency management, align the engine and Checkstyle versions, remove the unsupported TestNG provider, and complete Kubernetes imports and security-test fixtures. Build on a pinned Java 11 runtime and run the JVM in the foreground so invalid credentials stop the container. Align Helm's local-mode environment with the entrypoint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Require authenticated access to the Kubernetes operator’s management API and separate administrator and read-only permissions.
Anonymous requests receive HTTP 401. Authenticated viewers attempting write operations receive HTTP 403.
Changes
/apiendpoints.Deployment impact
Existing deployments must configure
webSecurity.existingSecretand an explicitimage.tagcontaining this application change.The Secret must contain
admin-token;viewer-tokenis optional. Standalone deployments must configureGEAFLOW_OPERATOR_ADMIN_TOKEN.The default NetworkPolicy blocks inbound pod traffic when enforced by the CNI. Use local port forwarding or configure explicit ingress rules and HTTPS. Recreate deployments entail downtime.
Administrator access remains restricted to trusted operators: submitting jobs authorizes code execution. This change does not provide workload sandboxing or tenant isolation.
Validation
Completed:
Not yet completed:
Full validation was limited by unavailable local build tools and dependencies. The existing Spring Boot dependency baseline is retained and requires review before release.