Skip to content

docs: move using kuadrant from guides into readme for guides #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KevFan wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs: move using kuadrant from guides into readme for guides #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e17ce6c
docs: move using kuadrant from guides into readme for guides
KevFan Feb 26, 2025
fe33766
docs: move unavailable authorino features via kuadrant to readme
KevFan Feb 27, 2025
a808346
fixup: remove kuadrant user reminder
KevFan Mar 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions docs/user-guides/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# AuthConfig Consumers
Authorino's `AuthConfig` is a custom resource that defines authentication and authorization policies. Many tools and frameworks act
as consumers of `AuthConfig` by automatically generating and managing these resources on behalf of users. Since these consumers
follow the same specification, the general concepts and steps outlined in the user guides are applicable.
However, some details—such as resource names and specific API fields—may differ based on the consuming framework.

This section provides guidance for users working with tools that act as consumers of `AuthConfig`, allowing them to leverage the
same principles outlined in the user guides, regardless of the framework they are using.

## Kuadrant
[Kuadrant](https://kuadrant.io/) provides API security and access control capabilities through its own custom resource: `AuthPolicy`.
`AuthPolicy` is designed specifically for use with the Kubernetes [Gateway API](https://gateway-api.sigs.k8s.io/), allowing users
to define authentication and authorization rules directly in their network policy configurations.

Rather than defining `AuthConfig` resources directly, users can define an `AuthPolicy`, and Kuadrant will automatically
generate the corresponding `AuthConfig` for Authorino to consume.

### Key Details About `AuthPolicy` as an `AuthConfig` Consumer

- **Same Specification**: The spec schema of `AuthPolicy` is effectively the same as `AuthConfig`.
- **Automatic Hostname Handling**: Unlike `AuthConfig`, `AuthPolicy` does not explicitly define `spec.host`. Instead, hostnames are
inferred from the Kubernetes network object in `spec.targetRef` and the route selectors in the policy.
- **Authorino Integration**: Kuadrant translates `AuthPolicy` into an `AuthConfig`, which is then processed by Authorino to enforce
authentication and authorization.

### Authorino Features Not Available via Kuadrant
Some Authorino-specific features may not be available when using Authorino through Kuadrant:

- [Sharding](./sharding.md)
- [Host Override via Context Extension](./host-override.md)

For more details on enforcing authentication and authorization with Kuadrant, see the
[Kuadrant Auth documentation](https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth/).
29 changes: 0 additions & 29 deletions docs/user-guides/anonymous-access.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,23 +29,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -108,18 +91,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null &

Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced:

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
29 changes: 0 additions & 29 deletions docs/user-guides/api-key-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,23 +33,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -112,18 +95,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null &

Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced:

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
29 changes: 0 additions & 29 deletions docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.</p>
<p>At step ❻, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -126,18 +109,6 @@ Create an Authorino `AuthConfig` custom resource declaring the auth rules to be

An annotation `auth-data/username` will be read from the Kubernetes API Key secret and passed as dynamic metadata `{ "ext_auth_data": { "username": «annotations.auth-data/username» } }`.

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
29 changes: 0 additions & 29 deletions docs/user-guides/authzed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,23 +28,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.</p>
<p>At step ❻, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -232,18 +215,6 @@ EOF

Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced.

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

Store the shared token for Authorino to authenticate with the SpiceDB instance in a Service:

```sh
Expand Down
29 changes: 0 additions & 29 deletions docs/user-guides/caching.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,23 +47,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -134,18 +117,6 @@ In both cases, the path of the HTTP request is used as cache key. I.e., whenever

The cached values will be visible in the response returned by the Talker API in `x-authz-data` header injected by Authorino. This way, we can tell when an existing value in the cache was used and when a new one was generated and stored.

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
29 changes: 0 additions & 29 deletions docs/user-guides/deny-with-redirect-to-login.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample web application called **Matrix Quotes** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -114,18 +97,6 @@ kubectl port-forward deployment/envoy 8000:8000 2>&1 >/dev/null &

Create an Authorino `AuthConfig` custom resource declaring the auth rules to be enforced:

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
41 changes: 0 additions & 41 deletions docs/user-guides/edge-authentication-architecture-festival-wristbands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,23 +56,6 @@ The next steps walk you through installing Authorino and configuring 2 environme

The first environment is a facade for handling the first layer of authentication and exchanging any valid presented authentication token for a Festival Wristband token. In the second, we will deploy a sample service called **Talker API** that the authorization service will ensure to receive only authenticated traffic presented with a valid Festival Wristband.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❹.</p>
<p>At steps ❹ and ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down Expand Up @@ -159,18 +142,6 @@ EOF

Create the config:

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl -n edge apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down Expand Up @@ -241,18 +212,6 @@ kubectl -n internal port-forward deployment/envoy 8000:8000 2>&1 >/dev/null &

### Create the `AuthConfig`

<table>
<tbody>
<tr>
<td>
<b><i>Kuadrant users –</i></b>
Remember to create an <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> instead of an AuthConfig.
For more, see <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.
</td>
</tr>
</tbody>
</table>

```sh
kubectl -n internal apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta3
Expand Down
Loading
Loading