The preflight is the documented gate before real SSO traffic, but it did
not check two things the dsh-demo install got wrong:
- The gateway Role must grant `patch` on
extensions.agents.x-k8s.io/sandboxclaims. The SSO landing path rotates
the claim's token-hash annotation whenever the browser has no valid
gateway session (first visit, expired or foreign cookie, gateway
restart), so a missing verb makes every such sign-in answer 503.
Verify with `kubectl auth can-i --as`; when a read-only kubeconfig
cannot impersonate, fall back to reading the rules of the Role (or
ClusterRole) the RoleBinding points at.
- The variant's NetworkPolicies must be applied. Without them any Pod in
the cluster can reach dsh-gateway:8080 and spoof X-Forwarded-User, so
the exposure is demo-only. Fail the preflight while either policy from
75-networkpolicies.yaml is missing.
Also fix a false positive in the cookie-secret check: oauth2-proxy accepts
16, 24 or 32 raw bytes, or URL-safe unpadded base64 that decodes to one of
those lengths (pkg/encryption.SecretBytes). The documented
`secrets.token_urlsafe(32)` value is 43 base64 characters that decode to 32
bytes, so it is valid and must not be reported as 43 raw bytes.
The docs that enumerate the preflight checks are updated to match, and
75-networkpolicies.yaml notes that the preflight enforces it.
Verified with shellcheck, yamllint, make check and the gateway test suite
(150 passed); the new checks were exercised read-only against the live
dsh-demo cluster.
Entire-Checkpoint: 01M6FNY2WTC4GMAJ8BAHABN88M
Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.
BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.
Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
