[CORE] Auth for policy-reporter API

[yuriydzobak]

[CORE] Auth for policy-reporter API

[fjogeleit]

Hey, thanks for your request, I will have a look on it when I find some time but it can take a bit.

[fjogeleit]

@yuriydzobak I opened a PR for the core app, can you check if the feature set is fine for your use case?

[fjogeleit]

Summary:

• You can configure global HTTP BasicAuthentication via Helm:
  • Username/Password can configured directly or as existing secret with username / password keys
  • The Authentication is applied to REST APIs and metrics of the Core App and KyvernoPlugin (if enabled)
  • The Authorization header will be set in the Policy Reporter UI automatically
    • External Cluster configuration also supports secretRef where you can set username / password as well as the API endpoints (api, kyvernoApi) and ssl configuration (skipTLS, certificate)
  • If monitoring enabled the basicAuth configuration will also configured on the ServiceMonitor
    • direct configuration will create a dedicated auth secret for ServiceMonitors
    • secretRef will reuse the existing secret for the ServiceMonitor

global:
  basicAuth:
    #username: "username"
    #password: "password"
    secretRef: auth-secret

Example external cluster:

ui:
  ...
  clusters:
  - name: Minikube
    api: http://policy-reporter:8080
    kyvernoApi: http://policy-reporter-kyverno-plugin:8080
    basicAuth:
      username: user
      password: password
  - name: Secret
    api: http://policy-reporter:8080
    kyvernoApi: http://policy-reporter-kyverno-plugin:8080
    secretRef: auth-secret
  - name: Unauthorized
    api: http://policy-reporter:8080
    kyvernoApi: http://policy-reporter-kyverno-plugin:8080

[fjogeleit]

Hey @yuriydzobak, just want to ask if you already had a chance to test the new version and if everything is working as expected.