From e17ce6c34ce58b472a0773384b083b07caa5f36a Mon Sep 17 00:00:00 2001 From: KevFan Date: Wed, 26 Feb 2025 12:18:02 +0000 Subject: [PATCH 1/3] docs: move using kuadrant from guides into readme for guides Signed-off-by: KevFan --- docs/user-guides/README.md | 27 +++++++++++++++++++ docs/user-guides/anonymous-access.md | 17 ------------ docs/user-guides/api-key-authentication.md | 17 ------------ ...ed-rate-limiting-envoy-dynamic-metadata.md | 17 ------------ docs/user-guides/authzed.md | 17 ------------ docs/user-guides/caching.md | 17 ------------ .../deny-with-redirect-to-login.md | 17 ------------ ...cation-architecture-festival-wristbands.md | 17 ------------ .../envoy-jwt-authn-and-authorino.md | 17 ------------ docs/user-guides/external-metadata.md | 17 ------------ docs/user-guides/hello-world.md | 17 ------------ docs/user-guides/http-basic-authentication.md | 17 ------------ docs/user-guides/injecting-data.md | 17 ------------ .../json-pattern-matching-authorization.md | 17 ------------ .../keycloak-authorization-services.md | 17 ------------ .../kubernetes-subjectaccessreview.md | 17 ------------ docs/user-guides/kubernetes-tokenreview.md | 17 ------------ docs/user-guides/mtls-authentication.md | 17 ------------ .../user-guides/oauth2-token-introspection.md | 17 ------------ docs/user-guides/oidc-jwt-authentication.md | 17 ------------ docs/user-guides/oidc-rbac.md | 17 ------------ docs/user-guides/oidc-user-info.md | 17 ------------ docs/user-guides/opa-authorization.md | 17 ------------ docs/user-guides/passing-credentials.md | 17 ------------ .../resource-level-authorization-uma.md | 17 ------------ docs/user-guides/token-normalization.md | 17 ------------ docs/user-guides/validating-webhook.md | 17 ------------ 27 files changed, 27 insertions(+), 442 deletions(-) create mode 100644 docs/user-guides/README.md diff --git a/docs/user-guides/README.md b/docs/user-guides/README.md new file mode 100644 index 00000000..595a4460 --- /dev/null +++ b/docs/user-guides/README.md @@ -0,0 +1,27 @@ +# AuthConfig Consumers +Authorino's `AuthConfig` is a custom resource that defines authentication and authorization policies. Many tools and frameworks act +as consumers of `AuthConfig` by automatically generating and managing these resources on behalf of users. Since these consumers +follow the same specification, the general concepts and steps outlined in the user guides are applicable. +However, some details—such as resource names and specific API fields—may differ based on the consuming framework. + +This section provides guidance for users working with tools that act as consumers of `AuthConfig`, allowing them to leverage the +same principles outlined in the user guides, regardless of the framework they are using. + +## Kuadrant +[Kuadrant](https://kuadrant.io/) provides API security and access control capabilities through its own custom resource: `AuthPolicy`. +`AuthPolicy` is designed specifically for use with the Kubernetes [Gateway API](https://gateway-api.sigs.k8s.io/), allowing users +to define authentication and authorization rules directly in their network policy configurations. + +Rather than defining `AuthConfig` resources directly, users can define an `AuthPolicy`, and Kuadrant will automatically +generate the corresponding `AuthConfig` for Authorino to consume. + +Key details about `AuthPolicy` as an `AuthConfig` Consumer: + +- **Same Specification**: The spec schema of `AuthPolicy` is effectively the same as `AuthConfig`. +- **Automatic Hostname Handling**: Unlike `AuthConfig`, `AuthPolicy` does not explicitly define `spec.host`. Instead, hostnames are +inferred from the Kubernetes network object in `spec.targetRef` and the route selectors in the policy. +- **Authorino Integration**: Kuadrant translates `AuthPolicy` into an `AuthConfig`, which is then processed by Authorino to enforce +authentication and authorization. + +For more details on enforcing authentication and authorization with Kuadrant, see the +[Kuadrant Auth documentation](https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth/). diff --git a/docs/user-guides/anonymous-access.md b/docs/user-guides/anonymous-access.md index a0667e6d..f4a24e52 100644 --- a/docs/user-guides/anonymous-access.md +++ b/docs/user-guides/anonymous-access.md @@ -29,23 +29,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/api-key-authentication.md b/docs/user-guides/api-key-authentication.md index bf0e0014..6093eb44 100644 --- a/docs/user-guides/api-key-authentication.md +++ b/docs/user-guides/api-key-authentication.md @@ -33,23 +33,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md b/docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md index 3bb3f3bc..56c819db 100644 --- a/docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md +++ b/docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/authzed.md b/docs/user-guides/authzed.md index 9fe59ec7..0e5f6caf 100644 --- a/docs/user-guides/authzed.md +++ b/docs/user-guides/authzed.md @@ -28,23 +28,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/caching.md b/docs/user-guides/caching.md index a7f74900..197d60fd 100644 --- a/docs/user-guides/caching.md +++ b/docs/user-guides/caching.md @@ -47,23 +47,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/deny-with-redirect-to-login.md b/docs/user-guides/deny-with-redirect-to-login.md index c1382467..807bdb2e 100644 --- a/docs/user-guides/deny-with-redirect-to-login.md +++ b/docs/user-guides/deny-with-redirect-to-login.md @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample web application called **Matrix Quotes** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/edge-authentication-architecture-festival-wristbands.md b/docs/user-guides/edge-authentication-architecture-festival-wristbands.md index 9fb5037d..01ffd379 100644 --- a/docs/user-guides/edge-authentication-architecture-festival-wristbands.md +++ b/docs/user-guides/edge-authentication-architecture-festival-wristbands.md @@ -56,23 +56,6 @@ The next steps walk you through installing Authorino and configuring 2 environme The first environment is a facade for handling the first layer of authentication and exchanging any valid presented authentication token for a Festival Wristband token. In the second, we will deploy a sample service called **Talker API** that the authorization service will ensure to receive only authenticated traffic presented with a valid Festival Wristband. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❹.

-

At steps ❹ and ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/envoy-jwt-authn-and-authorino.md b/docs/user-guides/envoy-jwt-authn-and-authorino.md index 741d8277..1c714836 100644 --- a/docs/user-guides/envoy-jwt-authn-and-authorino.md +++ b/docs/user-guides/envoy-jwt-authn-and-authorino.md @@ -47,23 +47,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/external-metadata.md b/docs/user-guides/external-metadata.md index 89a4af76..1b888f0f 100644 --- a/docs/user-guides/external-metadata.md +++ b/docs/user-guides/external-metadata.md @@ -37,23 +37,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/hello-world.md b/docs/user-guides/hello-world.md index 0be0bd90..110beccd 100644 --- a/docs/user-guides/hello-world.md +++ b/docs/user-guides/hello-world.md @@ -12,23 +12,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant, you can skip step ❸. You may already have Authorino installed and running as well. In this case, skip also step ❺. If you even have your workload cluster configured, with sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, go straight to step ❼.

-

At step ❼, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
- ## ❶ Create the namespace ```sh diff --git a/docs/user-guides/http-basic-authentication.md b/docs/user-guides/http-basic-authentication.md index 1d312cf4..6ec5a347 100644 --- a/docs/user-guides/http-basic-authentication.md +++ b/docs/user-guides/http-basic-authentication.md @@ -36,23 +36,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/injecting-data.md b/docs/user-guides/injecting-data.md index 58b61e6d..82bc29ab 100644 --- a/docs/user-guides/injecting-data.md +++ b/docs/user-guides/injecting-data.md @@ -34,23 +34,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/json-pattern-matching-authorization.md b/docs/user-guides/json-pattern-matching-authorization.md index 6fcaffc4..c1aed9dc 100644 --- a/docs/user-guides/json-pattern-matching-authorization.md +++ b/docs/user-guides/json-pattern-matching-authorization.md @@ -43,23 +43,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/keycloak-authorization-services.md b/docs/user-guides/keycloak-authorization-services.md index 78457cad..2a483a89 100644 --- a/docs/user-guides/keycloak-authorization-services.md +++ b/docs/user-guides/keycloak-authorization-services.md @@ -47,23 +47,6 @@ kubectl -n keycloak port-forward deployment/keycloak 8080:8080 2>&1 >/dev/null & The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/kubernetes-subjectaccessreview.md b/docs/user-guides/kubernetes-subjectaccessreview.md index e3a2df78..a757a176 100644 --- a/docs/user-guides/kubernetes-subjectaccessreview.md +++ b/docs/user-guides/kubernetes-subjectaccessreview.md @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/kubernetes-tokenreview.md b/docs/user-guides/kubernetes-tokenreview.md index 97c86551..2a760635 100644 --- a/docs/user-guides/kubernetes-tokenreview.md +++ b/docs/user-guides/kubernetes-tokenreview.md @@ -36,23 +36,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/mtls-authentication.md b/docs/user-guides/mtls-authentication.md index 4fc5f0c9..22a683eb 100644 --- a/docs/user-guides/mtls-authentication.md +++ b/docs/user-guides/mtls-authentication.md @@ -34,23 +34,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.

-

At step ❻, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/oauth2-token-introspection.md b/docs/user-guides/oauth2-token-introspection.md index ea575b31..f6c66d16 100644 --- a/docs/user-guides/oauth2-token-introspection.md +++ b/docs/user-guides/oauth2-token-introspection.md @@ -52,23 +52,6 @@ kubectl -n a12n-server apply -f https://raw.githubusercontent.com/kuadrant/autho The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/oidc-jwt-authentication.md b/docs/user-guides/oidc-jwt-authentication.md index 7fd48e2e..341f5ba9 100644 --- a/docs/user-guides/oidc-jwt-authentication.md +++ b/docs/user-guides/oidc-jwt-authentication.md @@ -42,23 +42,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/oidc-rbac.md b/docs/user-guides/oidc-rbac.md index f3d3a377..ced73ce8 100644 --- a/docs/user-guides/oidc-rbac.md +++ b/docs/user-guides/oidc-rbac.md @@ -43,23 +43,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/oidc-user-info.md b/docs/user-guides/oidc-user-info.md index 475fcf52..2ae276cf 100644 --- a/docs/user-guides/oidc-user-info.md +++ b/docs/user-guides/oidc-user-info.md @@ -44,23 +44,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/opa-authorization.md b/docs/user-guides/opa-authorization.md index e5d24a8a..9f317157 100644 --- a/docs/user-guides/opa-authorization.md +++ b/docs/user-guides/opa-authorization.md @@ -36,23 +36,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/passing-credentials.md b/docs/user-guides/passing-credentials.md index cd78b85f..f03b2e7c 100644 --- a/docs/user-guides/passing-credentials.md +++ b/docs/user-guides/passing-credentials.md @@ -34,23 +34,6 @@ kind create cluster --name authorino-tutorial The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/resource-level-authorization-uma.md b/docs/user-guides/resource-level-authorization-uma.md index ea50f626..651757cd 100644 --- a/docs/user-guides/resource-level-authorization-uma.md +++ b/docs/user-guides/resource-level-authorization-uma.md @@ -42,23 +42,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/token-normalization.md b/docs/user-guides/token-normalization.md index b79ea9ef..5b558094 100644 --- a/docs/user-guides/token-normalization.md +++ b/docs/user-guides/token-normalization.md @@ -49,23 +49,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.

-

At step ❺, instead of creating an AuthConfig custom resource, create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) diff --git a/docs/user-guides/validating-webhook.md b/docs/user-guides/validating-webhook.md index 4fb7198b..278b255e 100644 --- a/docs/user-guides/validating-webhook.md +++ b/docs/user-guides/validating-webhook.md @@ -51,23 +51,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service. - - - - - - - - - - - -
Using Kuadrant
-

If you are a user of Kuadrant you may already have Authorino installed and running. In this case, skip straight to step ❸.

-

At step ❺, alternatively to creating an AuthConfig custom resource, you may create a Kuadrant AuthPolicy one. The schema of the AuthConfig's spec matches the one of the AuthPolicy's, except spec.host, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in spec.targetRef and route selectors declared in the policy.

-

For more about using Kuadrant to enforce authorization, check out Kuadrant auth.

-
-
## ❶ Install the Authorino Operator (cluster admin required) From fe3376642dc76a127f2b1aad8f83cc359442e84d Mon Sep 17 00:00:00 2001 From: KevFan Date: Thu, 27 Feb 2025 11:25:03 +0000 Subject: [PATCH 2/3] docs: move unavailable authorino features via kuadrant to readme Signed-off-by: KevFan --- docs/user-guides/README.md | 8 +++++++- docs/user-guides/host-override.md | 11 ----------- docs/user-guides/sharding.md | 11 ----------- 3 files changed, 7 insertions(+), 23 deletions(-) diff --git a/docs/user-guides/README.md b/docs/user-guides/README.md index 595a4460..c59d7fff 100644 --- a/docs/user-guides/README.md +++ b/docs/user-guides/README.md @@ -15,7 +15,7 @@ to define authentication and authorization rules directly in their network polic Rather than defining `AuthConfig` resources directly, users can define an `AuthPolicy`, and Kuadrant will automatically generate the corresponding `AuthConfig` for Authorino to consume. -Key details about `AuthPolicy` as an `AuthConfig` Consumer: +### Key Details About `AuthPolicy` as an `AuthConfig` Consumer - **Same Specification**: The spec schema of `AuthPolicy` is effectively the same as `AuthConfig`. - **Automatic Hostname Handling**: Unlike `AuthConfig`, `AuthPolicy` does not explicitly define `spec.host`. Instead, hostnames are @@ -23,5 +23,11 @@ inferred from the Kubernetes network object in `spec.targetRef` and the route se - **Authorino Integration**: Kuadrant translates `AuthPolicy` into an `AuthConfig`, which is then processed by Authorino to enforce authentication and authorization. +### Authorino Features Not Available via Kuadrant +Some Authorino-specific features may not be available when using Authorino through Kuadrant: + +- [Sharding](./sharding.md) +- [Host Override via Context Extension](./host-override.md) + For more details on enforcing authentication and authorization with Kuadrant, see the [Kuadrant Auth documentation](https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth/). diff --git a/docs/user-guides/host-override.md b/docs/user-guides/host-override.md index e285f311..2d92c02a 100644 --- a/docs/user-guides/host-override.md +++ b/docs/user-guides/host-override.md @@ -4,17 +4,6 @@ By default, Authorino uses the host information of the HTTP request ([`Attribute Overriding the host attribute of the HTTP request can be useful to support use cases such as of **path prefix-based lookup** and **wildcard subdomains lookup**. - - - - - - -
- ⚠️ Important: - This feature may not be available to users of Authorino via Kuadrant. -
-
In this guide: diff --git a/docs/user-guides/sharding.md b/docs/user-guides/sharding.md index 7b30e1ae..a130feae 100644 --- a/docs/user-guides/sharding.md +++ b/docs/user-guides/sharding.md @@ -7,17 +7,6 @@ By default, Authorino will watch events related to all `AuthConfig` custom resou - multiple environments (e.g. staging, production) inside of a same cluster/namespace; - providing managed instances of Authorino that all watch CRs cluster-wide, yet dedicated to organizations allowed to create and operate their own `AuthConfig`s across multiple namespaces. - - - - - - -
- ⚠️ Important: - This feature may not be available to users of Authorino via Kuadrant. -
-
Authorino capabilities featured in this guide: From a8083468d35357dc66005cf141206585cf11b393 Mon Sep 17 00:00:00 2001 From: KevFan Date: Tue, 4 Mar 2025 15:06:27 +0000 Subject: [PATCH 3/3] fixup: remove kuadrant user reminder Signed-off-by: KevFan --- docs/user-guides/anonymous-access.md | 12 ---------- docs/user-guides/api-key-authentication.md | 12 ---------- ...ed-rate-limiting-envoy-dynamic-metadata.md | 12 ---------- docs/user-guides/authzed.md | 12 ---------- docs/user-guides/caching.md | 12 ---------- .../deny-with-redirect-to-login.md | 12 ---------- ...cation-architecture-festival-wristbands.md | 24 ------------------- .../envoy-jwt-authn-and-authorino.md | 12 ---------- docs/user-guides/external-metadata.md | 12 ---------- docs/user-guides/hello-world.md | 12 ---------- docs/user-guides/http-basic-authentication.md | 12 ---------- docs/user-guides/injecting-data.md | 12 ---------- .../json-pattern-matching-authorization.md | 12 ---------- .../keycloak-authorization-services.md | 12 ---------- .../kubernetes-subjectaccessreview.md | 12 ---------- docs/user-guides/kubernetes-tokenreview.md | 12 ---------- docs/user-guides/mtls-authentication.md | 12 ---------- .../user-guides/oauth2-token-introspection.md | 12 ---------- docs/user-guides/oidc-jwt-authentication.md | 12 ---------- docs/user-guides/oidc-rbac.md | 12 ---------- docs/user-guides/oidc-user-info.md | 12 ---------- docs/user-guides/opa-authorization.md | 12 ---------- docs/user-guides/passing-credentials.md | 12 ---------- .../resource-level-authorization-uma.md | 12 ---------- docs/user-guides/token-normalization.md | 12 ---------- docs/user-guides/validating-webhook.md | 12 ---------- 26 files changed, 324 deletions(-) diff --git a/docs/user-guides/anonymous-access.md b/docs/user-guides/anonymous-access.md index f4a24e52..dae63e2a 100644 --- a/docs/user-guides/anonymous-access.md +++ b/docs/user-guides/anonymous-access.md @@ -91,18 +91,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -<&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - Store the shared token for Authorino to authenticate with the SpiceDB instance in a Service: ```sh diff --git a/docs/user-guides/caching.md b/docs/user-guides/caching.md index 197d60fd..61ebaed0 100644 --- a/docs/user-guides/caching.md +++ b/docs/user-guides/caching.md @@ -117,18 +117,6 @@ In both cases, the path of the HTTP request is used as cache key. I.e., whenever The cached values will be visible in the response returned by the Talker API in `x-authz-data` header injected by Authorino. This way, we can tell when an existing value in the cache was used and when a new one was generated and stored. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -<&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl -n edge apply -f -<&1 >/dev/null & ### Create the `AuthConfig` - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl -n internal apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl -n hello-world apply -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/hello-world/authconfig.yaml # authconfig.authorino.kuadrant.io/talker-api-protection created diff --git a/docs/user-guides/http-basic-authentication.md b/docs/user-guides/http-basic-authentication.md index 6ec5a347..00c244ce 100644 --- a/docs/user-guides/http-basic-authentication.md +++ b/docs/user-guides/http-basic-authentication.md @@ -100,18 +100,6 @@ Create an Authorino `AuthConfig` custom resource declaring the auth rules to be The config uses API Key secrets to store base64-encoded `username:password` HTTP "Basic" authentication credentials. The config also specifies an Access Control List (ACL) by which only user `john` is authorized to consume the `/bye` endpoint of the API. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -<&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -<&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -<&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - Apply the AuthConfig: ```sh diff --git a/docs/user-guides/oidc-user-info.md b/docs/user-guides/oidc-user-info.md index 2ae276cf..1ab88070 100644 --- a/docs/user-guides/oidc-user-info.md +++ b/docs/user-guides/oidc-user-info.md @@ -106,18 +106,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null & Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced: - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - ```sh kubectl apply -f -<`. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. - - - - - Create a required secret that will be used by Authorino to initiate the authentication with the UMA registry. ```sh diff --git a/docs/user-guides/token-normalization.md b/docs/user-guides/token-normalization.md index 5b558094..ad7bf267 100644 --- a/docs/user-guides/token-normalization.md +++ b/docs/user-guides/token-normalization.md @@ -117,18 +117,6 @@ The config trusts access tokens issued by a Keycloak realm as well as API keys l Without normalizing identity claims from these two different sources, the policy would have to handle the differences of data formats with additional ifs-and-elses. Instead, the config here uses the `identity.extendedProperties` option to ensure a custom `roles` (Array) claim is always present in the identity object. In the case of Keycloak ID tokens, the value is extracted from the `realm_access.roles` claim; for API key-resolved objects, the custom claim is set to the static value `["admin"]`. - - - - - - -
- Kuadrant users – - Remember to create an AuthPolicy instead of an AuthConfig. - For more, see Kuadrant auth. -
- ```sh kubectl apply -f -< - - - - Kuadrant users – - For this and other example AuthConfigs below, if you create a Kuadrant AuthPolicy instead, the output of the commands shall differ. The requested AuthPolicy may be initially accepted, but its state will turn ready or not ready depending on whether the corresponding AuthConfig requested by Kuadrant is accepted or rejected, according to the validating webhook rules. Check the state of the resources to confirm. - For more, see Kuadrant auth. - - - - - ```sh kubectl -n myapp apply -f -<