radar-hub: turn on OIDC refresh tokens by default (1.10.0-rc.1)

charts/radar-hub/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: radar-hub
 description: Radar Cloud control plane for self-hosted deployments — Go API + React web app + Postgres (bundled eval DB or bring-your-own).
 type: application
-version: 1.9.1
+version: 1.10.0-rc.1
 # The Hub release this chart installs. image.hub.tag and image.web.tag both
 # default to it when unset. Deliberately independent of `version` above — see
 # README.md. Rewritten by the release job in skyhook-dev/radar-hub; do not carry

charts/radar-hub/templates/NOTES.txt

@@ -62,6 +62,15 @@ Auth:
 {{- if .Values.auth.oidc.issuer }}
   - OIDC enabled: issuer={{ .Values.auth.oidc.issuer }} client_id={{ .Values.auth.oidc.clientID }}
   - OIDC callback: {{ default (printf "%s/api/auth/oidc/callback" $publicURL) .Values.auth.oidc.callbackURL }}
+  {{- if .Values.auth.oidc.useRefreshToken }}
+  - Refresh tokens: ON. The IdP client needs the Refresh Token grant (Okta and
+    Entra: add offline_access to auth.oidc.scopes). A refused refresh signs the
+    user out. Set auth.oidc.useRefreshToken=false to turn it off.
+  {{- else }}
+  - Refresh tokens: off. On Hub 1.10.0 and newer, a session carrying IdP
+    groups ends when its ID token expires; older Hubs keep the session and
+    stop forwarding its groups.
+  {{- end }}
 {{- else if not .Values.auth.breakGlass.email }}
   WARNING: no auth method configured. Set auth.breakGlass.* and/or auth.oidc.*
 {{- end }}

charts/radar-hub/tests/deployment_hub_sessions_test.yaml

@@ -14,9 +14,9 @@ templates:
   - templates/deployment-hub.yaml
   - templates/secret.yaml
 tests:
-  # Upgrade safety: an install that sets nothing renders no new env, so the
-  # Hub keeps its own defaults (168h / 24h / refresh off).
-  - it: emits no session or refresh env when untouched
+  # Upgrade safety: an install that sets nothing renders no session env, so the
+  # Hub keeps its own defaults (168h / 24h). Refresh is on by default (below).
+  - it: emits no session env when untouched
     template: templates/deployment-hub.yaml
     values:
       - values/oidc-base.yaml
@@ -31,11 +31,6 @@ tests:
           content:
             name: RADAR_HUB_SESSION_MAX_INACTIVE
           any: true
-      - notContains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: RADAR_HUB_OIDC_USE_REFRESH_TOKEN
-          any: true
 
   # Break-glass sessions obey the same limits, so the session env must not be
   # gated on auth.oidc.issuer.
@@ -58,19 +53,30 @@ tests:
             name: RADAR_HUB_SESSION_MAX_INACTIVE
             value: "2h"
 
-  - it: emits the refresh flag when useRefreshToken is true
+  - it: emits the refresh flag by default
     template: templates/deployment-hub.yaml
     values:
       - values/oidc-base.yaml
-    set:
-      auth.oidc.useRefreshToken: true
     asserts:
       - contains:
           path: spec.template.spec.containers[0].env
           content:
             name: RADAR_HUB_OIDC_USE_REFRESH_TOKEN
             value: "true"
 
+  - it: omits the refresh flag when useRefreshToken is false
+    template: templates/deployment-hub.yaml
+    values:
+      - values/oidc-base.yaml
+    set:
+      auth.oidc.useRefreshToken: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: RADAR_HUB_OIDC_USE_REFRESH_TOKEN
+          any: true
+
   # The flag means nothing without OIDC; it stays inside the issuer gate.
   - it: ignores useRefreshToken when OIDC is off
     template: templates/deployment-hub.yaml

charts/radar-hub/values.yaml

@@ -508,19 +508,24 @@ auth:
     # doubt leave this empty and check whether groups arrive before adding one.
     scopes: []
     # Keep the IdP refresh token on the session and refresh the ID token before
-    # it expires. IdP groups then stay current for the whole session instead of
-    # being dropped when the first ID token expires (typically an hour), and a
-    # user the IdP rejects on refresh is signed out.
+    # it expires. IdP groups then stay current for the whole session, and a
+    # user the IdP rejects on refresh is signed out. Without a refresh token, a
+    # session carrying IdP groups ends when its ID token expires (Keycloak's
+    # default is 5 minutes, Okta and Entra an hour) and the user signs in
+    # again, as Grafana and oauth2-proxy do; Hubs before 1.10.0 instead kept
+    # the session and stopped forwarding the groups. On by default so sessions
+    # last session.maxLifetime; set false to always re-sign-in at token expiry.
     #
     # Does NOT change the scopes requested. Okta and Entra return a refresh
     # token only when "offline_access" is in `scopes` above; Keycloak returns
-    # one by default. The IdP client needs the Refresh Token grant.
+    # one by default. The IdP client needs the Refresh Token grant. An IdP that
+    # returns no refresh token behaves as if this were false.
     #
     # An unreachable IdP (or 429/5xx) fails the request with 503 and keeps the
     # session; an IdP that rejects the refresh token ends the session (401).
     #
     # Requires Hub 1.6.0 or newer; an older Hub ignores it.
-    useRefreshToken: false
+    useRefreshToken: true
 
   # Server-side session limits for OIDC and break-glass sign-ins. Sessions live
   # in Postgres; the cookie carries only a random session id, so signing out,