Authentication needs more details

[hichem-belhocine]

Hello,

I'd like to request the documentation in details how to setup authentication as It's not clear how to setup it in the official page.

As a good example, see https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/microsoft/#entra-id-app-registration-auth-using-oidc

If you could give an example how we could implement the authentication on azure using openidConnect and allow specifc Group to see only x customBoard would be great (Actually I implemented it but I cannot split the boards and implement the authorization)

Another issue that I got is when I add accessControl to customBoards, the customBoard does not appear in the UI?
Thanks

[fjogeleit]

which part do you struggle with? I am not very familiar with azure.

I tried a bit and it worked with this:

ui:
  openIDConnect:
    enabled: true
    discoveryUrl: https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
    callbackUrl: http://localhost:8082/callback
    clientId: 31adb89f-1162-404b-... # clientId
    clientSecret: <generated client secret> # certificate & secrets ->  new client secret key
    groupClaim: "groups"

Steps I did in azure:

• Create an App Policy Reporter
• Configure it as Web App with the callback API of your installation
• Generate a ClientSecret
• Under Token configuration -> Add groups as optional claim

When you configure access control with your Azure groups be aware that azure adds the roles with there IDs

ui:
  customBoards:
    - name: Infrastructure
      namespaces:
        selector:
          team: infra
      accessControl:
        groups: [92ae7bb0-1720-4794-a47d-997bc000460c]

[fjogeleit]

I will try to improve the documentation over time but its a bit much to provide examples for all common OpenIDConnect clients.

[hichem-belhocine]

Thanks a lot for reply.

When you configure access control with your Azure groups be aware that azure adds the roles with there IDs.

Thanks for clarifying, it works now.

The issue now is:

1. based in your example

ui:
  customBoards:
    - name: Infrastructure
      namespaces:
        selector:
          team: infra
      accessControl:
        groups: [92ae7bb0-1720-4794-a47d-997bc000460c]

How can I allow Infrastructure team to see only their reports (authorization)

2. Another question is that I cannot filter based on Pod as shown in the screenshot

3. It does not list all the policies as in V2

V2

V3

[fjogeleit]

1. Currently CustomBoards only allow to filter a subset of namespaces, how would you like to define

only their reports (authorization)

With a list of policy names?

2. Policy Reporter v3 has a new feature called uncontrolledOnly

https://kyverno.github.io/policy-reporter-docs/policy-reporter/report-processing.html#source-filter

It automatically skips all reports for Pod resurces if they are owned by a controller resource. This reduces duplication of information because kyverno generates in most cases duplicated reports for e.g. deployments, replicasets and pods.

If you do not have pods without a controller, it will not show any Pod report or filter.

3. Both lists are from the same cluster? It looks correct to me as the overall result number form the graph hits the sum of the displayed policies.

[hichem-belhocine]

As Admin, I would like to see everything, but for developers, I would like that each team can see only their namespaces

Currently CustomBoards only allow to filter a subset of namespaces, how would you like to define

[fjogeleit]

filter namespaces is possible. As documented you can use a fixed list of namespaces or labels to select them.

In the example namspaces are selected via labels:

      namespaces:
        selector:
          team: infra

[hichem-belhocine]

Yeah, but they will still see everything

Yes, Both lists are from the same cluster

Both lists are from the same cluster?

[fjogeleit]

You can add accessControl to all default boards (currently not per board). This will hide these boards for your e.g. infra team:

ui:
  boards:
    accessControl:
      groups: ['admin']

[hichem-belhocine]

It does not work, and concerning the groups you told me above

When you configure access control with your Azure groups be aware that azure adds the roles with there IDs

Did you test it? a screenshot can perhaps help

Thanks

[fjogeleit]

Sorry, I found an issue in the Helm Chart, which did not map the boards configuration into the UI config.

I tested it in my local setup, which worked.

Preparing a fix for it.

[hichem-belhocine]

Thanks a lot.

My hope is that developers could see only their custom borads and not the icons below

And for your question

Both lists are from the same cluster?

Yes, Both lists are from the same cluster

[fjogeleit]

You can update to helm chart version 3.0.3, this should fix the boards config mapping.

Could you provide a screen of the result of

kubectl get cpol -o wide

[fjogeleit]

Yes, Both lists are from the same cluster

Do the missing policies provide any results?

Could be the case that policies which do not produce any result are not shown in this list. Will see if I can improve this when the kyverno plugin is used.

[hichem-belhocine]

Are you sure that 3.0.3 is published

helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "platform-tooling" chart repository
Update Complete. ⎈Happy Helming!⎈

helm search repo policy-reporter
NAME                            CHART VERSION   APP VERSION     DESCRIPTION
platform-tooling/policy-reporter 3.0.0           3.0.0           Policy Reporter watches for PolicyReport Resour...

[fjogeleit]

Can you please check again? The publish action failed

[hichem-belhocine]

The same thing, there is only version 3.0.0

[fjogeleit]

This is the underlaying chart repo: https://kyverno.github.io/policy-reporter/index.yaml

As you see the latest item is Helm Chart Version 3.0.3 / App Version: 3.0.0

➜  policy-reporter git:(main) helm search repo policy-reporter

NAME                            CHART VERSION   APP VERSION     DESCRIPTION                                       
policy-reporter/policy-reporter 3.0.3           3.0.0           Policy Reporter watches for PolicyReport Resour...

[hichem-belhocine]

It was an issue with cache, now I got chart version 3.0.3

Now looks better with customBoards, so now i can assign customBoards to developers based on groups. Thanks a lot

but Boards does not work as expected, Im not sure about the group name admin, where should I configure the admin group in the App or how?

boards:
    accessControl:
      groups: ['admin']

I got

[fjogeleit]

The admin group is only an example. It should be an azure group you have assigned to your admins. It follows the same logic as customBoard groups

[hichem-belhocine]

I added

sourceFilters:
  - uncontrolledOnly: false

then I could see all my policies

another issue is when I try to use secretRef to authenticate, the secret get not mounted into the deployment and I already opened a PR for it #771

[fjogeleit]

I just released a new Helm Chart version which should display your policies in the list even if they don't produce a result.

This is not how secretRefs working. They don't need to be attached to the deployment. They are fetched at runtime.

See https://github.com/kyverno/policy-reporter-ui/blob/main/backend/pkg/kubernetes/secrets/client.go#L35 for the expected keys of the secret

[fjogeleit]

https://kyverno.github.io/policy-reporter-docs/policy-reporter-ui/authentication.html has examples under "helm + secretRefs".

[hichem-belhocine]

I tested it with secretRef a lot of times but it does not work and also when decode the policy-reporter-ui-config secret, I got

namespace: kyverno

tempDir: /tmp

logging:
  api: false
  server: false
  encoding: console
  logLevel: 0

server:
  port: 8080
  cors: true
  overwriteHost: true

ui:
  displayMode:
  banner:
  logo:
    path:
    disabled: false

clusters:
  - name: Default
    secretRef: policy-reporter-ui-default-cluster

sources:
  - name: kyverno
    type: result
    exceptions: false
    excludes:
      results:
      - warn
      - error
openIDConnect:
    callbackUrl: https://kyverno-policy-reporter-ui/callback
    clientId: ""
    clientSecret: ""
    discoveryUrl: ""
    enabled: true
    groupClaim: groups
    scopes:
    - openid
    secretRef: policy-reporter-ui-sso
oauth:
    callbackUrl: ""
    clientId: ""
    clientSecret: ""
    enabled: false
    provider: ""
    scopes: []
    secretRef: ""

and when I add the secret to values.yaml file, I got

namespace: kyverno

tempDir: /tmp

logging:
  api: false
  server: false
  encoding: console
  logLevel: 0

server:
  port: 8080
  cors: true
  overwriteHost: true

ui:
  displayMode:
  banner:
  logo:
    path:
    disabled: false

clusters:
  - name: Default
    secretRef: policy-reporter-ui-default-cluster

sources:
  - name: kyverno
    type: result
    exceptions: false
    excludes:
      results:
      - warn
      - error
openIDConnect:
    callbackUrl: https://kyverno-policy-reporter-ui/callback
    clientId: "*******************"
    clientSecret: "*********************"
    discoveryUrl: "https://login.microsoftonline.com/****************/v2.0/.well-known/openid-configuration"
    enabled: true
    groupClaim: groups
    scopes:
    - openid
    secretRef: ""
oauth:
    callbackUrl: ""
    clientId: ""
    clientSecret: ""
    enabled: false
    provider: ""
    scopes: []
    secretRef: ""

[hichem-belhocine]

could you reopen it please

[fjogeleit]

will check again but as I already mentioned. Its fetched at runtime, you will not see the values in the other secret / config

[hichem-belhocine]

Thanks a lot for replying.

The authentication works when we set the discoveryUrl in the values and not in the secret with clientId and clientSecret.

we have another issue now, we are using the nginx ingress controller (not the community one) on the clusters, and when we set ui.replicaCount to 3, something goes wrong because the auth requires the sessions if there are multiple replicas, any idea how we can solve it (the ingress)?

[hichem-belhocine]

another issue now we can not see the pod reports with the new version even with

sourceFilters:
  - uncontrolledOnly: false

Thanks

[fjogeleit]

another issue now we can not see the pod reports with the new version even with

sourceFilters:
  - uncontrolledOnly: false

Thanks

doesn not work anyway. You need to set the selector for kyverno

sourceFilters:
- selector:
    source: kyverno
  uncontrolledOnly: false
  disableClusterReports: false
  kinds:
    exclude: [ReplicaSet]

[hichem-belhocine]

it does not show the pods even after restarting pods

[achaikaJH]

which part do you struggle with? I am not very familiar with azure.

I tried a bit and it worked with this:

ui:
openIDConnect:
enabled: true
discoveryUrl: https://login.microsoftonline.com//v2.0/.well-known/openid-configuration
callbackUrl: http://localhost:8082/callback
clientId: 31adb89f-1162-404b-... # clientId
clientSecret: # certificate & secrets -> new client secret key
groupClaim: "groups"
Steps I did in azure:

• Create an App Policy Reporter
• Configure it as Web App with the callback API of your installation
• Generate a ClientSecret
• Under Token configuration -> Add groups as optional claim

When you configure access control with your Azure groups be aware that azure adds the roles with there IDs

ui:
customBoards:
- name: Infrastructure
namespaces:
selector:
team: infra
accessControl:
groups: [92ae7bb0-1720-4794-a47d-997bc000460c]

Hi @fjogeleit
I'm trying to set this up with azure. My config is below. Authentication part is working fine but authorisation doesn't, allowing users which aren't part of specified group to see any board.
I'm using helm chart version 3.0.4. Not sure what am I missing.

ui:
  enabled: true
    openIDConnect:
      # -- Enable openID Connect authentication
      enabled: true
      # -- OpenID Connect Discovery URL
      discoveryUrl: "https://login.microsoftonline.com/tenantId/v2.0"
      # -- OpenID Connect Callback URL
      callbackUrl: "https://reporter-host/callback"
      # -- OpenID Connect ClientID
      clientId: ""
      # -- OpenID Connect ClientSecret
      clientSecret: ""
      # -- Optional Group Claim to map user groups to the profile
      # groups can be used to define access control for clusters, boards and custom boards.
      groupClaim: "groups"
      # -- OpenID Connect allowed Scopes
      scopes: ["openid"]
      boards:
        accessControl:
          groups: ["xxxxxxxx-xxxx-xxxx-xxxx-08bffc32272a"]

[fjogeleit]

I think boards should be under ui and Not openIDConnect. So your indentation Looks wrong

[achaikaJH]

I think boards should be under ui and Not openIDConnect. So your indentation Looks wrong

you are 100% right!
What a silly mistake!
Everything is working now.
Thank you for your help!