[CORE] Auth for policy-reporter API

[yuriydzobak]

Hi,
I'm using policy reporter in centralisation entry point. This feature
Would be nice if policy-reporter has auth method, for example, i configure simple HTTP auth and provide secret to auth another policy reporter via API, because at the moment API is opened for everyone in internal network, filtering by IP doesn't help in my case
Thanks

[fjogeleit]

Hey, thanks for your request, I will have a look on it when I find some time but it can take a bit.

[fjogeleit]

@yuriydzobak I opened a PR for the core app, can you check if the feature set is fine for your use case?

[fjogeleit]

Summary:

• You can configure global HTTP BasicAuthentication via Helm:
  • Username/Password can configured directly or as existing secret with username / password keys
  • The Authentication is applied to REST APIs and metrics of the Core App and KyvernoPlugin (if enabled)
  • The Authorization header will be set in the Policy Reporter UI automatically
    • External Cluster configuration also supports secretRef where you can set username / password as well as the API endpoints (api, kyvernoApi) and ssl configuration (skipTLS, certificate)
  • If monitoring enabled the basicAuth configuration will also configured on the ServiceMonitor
    • direct configuration will create a dedicated auth secret for ServiceMonitors
    • secretRef will reuse the existing secret for the ServiceMonitor

global:
  basicAuth:
    #username: "username"
    #password: "password"
    secretRef: auth-secret

Example external cluster:

ui:
  ...
  clusters:
  - name: Minikube
    api: http:https://policy-reporter:8080
    kyvernoApi: http:https://policy-reporter-kyverno-plugin:8080
    basicAuth:
      username: user
      password: password
  - name: Secret
    api: http:https://policy-reporter:8080
    kyvernoApi: http:https://policy-reporter-kyverno-plugin:8080
    secretRef: auth-secret
  - name: Unauthorized
    api: http:https://policy-reporter:8080
    kyvernoApi: http:https://policy-reporter-kyverno-plugin:8080

[fjogeleit]

Hey @yuriydzobak, just want to ask if you already had a chance to test the new version and if everything is working as expected.