SREDevOps.org Agent
|
3f46279b39
|
feat(gateway-api): GitHub SSO via oauth2-proxy in front of dsh-gateway (#13)
Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in
front of the dsh-gateway, wired through the Traefik Gateway API. The gateway
inherits the authenticated GitHub username via X-Forwarded-User (SSO).
- gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap
(auto-provision claim + mint/rotate token + session cookie), patch_token()
- 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true
- gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example,
HTTPRoute backend -> oauth2-proxy:4180
- tests: 10 new SSO cases (106 passing)
Placeholders (dsh-demo.example.com, your-github-org) are substituted at
apply time.
Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
|
2026-10-25 03:43:32 -03:00 |
|