Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make clear in the docs how to customize authentication #77

Open
colearendt opened this issue May 25, 2022 · 0 comments
Open

Make clear in the docs how to customize authentication #77

colearendt opened this issue May 25, 2022 · 0 comments

Comments

@colearendt
Copy link
Contributor

colearendt commented May 25, 2022

Describe the bug

When configuring couchdb inside of the helm chart, one class of configuration involves hardening / tweaking the authentication configuration. It is possible to change this in such a way that the chart readiness probes are not able to reconcile, the cluster is not able to talk to each other, etc.

Version of Helm and Kubernetes:

K8s 1.21, Helm 3.8.2

What happened:

Set require_valid_user: true and couchdbConfig.chttpd.authentication_handlers to a non-default value. Connections within the cluster replication started failing, and health checks / readiness probes were returning unhealthy

What you expected to happen:

Change configuration and things continue working.

How to reproduce it (as minimally and precisely as possible):

Set require_valid_user: true and couchdbConfig.chttpd.authentication_handlers to not include: "{chttpd_auth, default_authentication_handler}" (the readinessProbe uses basic auth)

Anything else we need to know:

Some possible solutions:

  • add to documentation a note about configuring authentication and what the effects can be. Not 100% sure I would have caught this there, but it would have been helpful in hindsight at least.
  • warn in NOTES.txt if these values are changed in such a way that successful auth is unlikely
  • add more escape hatches on the readinessProbe so that someone can override the defaults if they would like
  • Am I right that require_valid_user: true essentially makes Fauxton not functional unless you already have auth taken care of on your network traffic (basic, JWT, etc.)? If so, some docs on that inside of the couchdb docs could be helpful too.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant