From 52fab55f80345bfd35a87eaa30ecbcc3a20ed264 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Thu, 23 Jul 2026 09:41:08 +0530 Subject: [PATCH] fix: repair crash-looping CLI flags, close values.yaml coverage gaps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --enable-totp-login/--enable-mfa/--enable-email-otp/--enable-sms-otp don't exist in the authorizer binary; cobra rejects unknown flags so every release from this chart crash-loops on boot. Renamed to the current --disable-totp-login/--disable-webauthn-mfa/--disable-email-otp/ --disable-sms-otp/--disable-mfa flags. Fixed COUCHBASE_RAM_QUOTA: the env var was defined as COUCHBASE_BUCKET_RAM_QUOTA while args read $COUCHBASE_RAM_QUOTA, so couchbase_bucket_ram_quota silently never reached the flag. Wired --url (CWE-640 host-header-injection mitigation): AUTHORIZER_URL was set as an env var but never passed as a flag, so authorizer_url in values.yaml was a no-op. Added --oauth2-1-strict and --enable-org-discovery. Exposed ~25 toggles in values.yaml that were previously hardcoded into the args template with no values.yaml key at all (enable_signup, enforce_mfa, app_cookie_secure, enable_basic_authentication, disable_admin_header_auth, and friends) — operators had no way to override them. Re-pinned appVersion to 2.4.0-rc.7: 2.3.0 predates the flag rename above, so it doesn't have the --disable-* flags either. Move to the stable 2.4.0 tag once it ships. --- Chart.yaml | 4 +-- templates/deployment.yaml | 69 ++++++++++++++++++++++++++++++++++++--- values.yaml | 53 ++++++++++++++++++++++++++++++ 3 files changed, 119 insertions(+), 7 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index 1e51baf..d54fc37 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -15,12 +15,12 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 2.2.0 +version: 2.3.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "2.3.0" +appVersion: "2.4.0-rc.7" icon: "https://authorizer.dev/images/logo.png" diff --git a/templates/deployment.yaml b/templates/deployment.yaml index b4aba5b..22219bd 100644 --- a/templates/deployment.yaml +++ b/templates/deployment.yaml @@ -69,6 +69,7 @@ spec: --allowed-origins="${ALLOWED_ORIGINS}" \ --default-authorize-response-type="${DEFAULT_AUTHORIZE_RESPONSE_TYPE}" \ --default-authorize-response-mode="${DEFAULT_AUTHORIZE_RESPONSE_MODE}" \ + --oauth2-1-strict="${OAUTH2_1_STRICT:-false}" \ --organization-name="${ORGANIZATION_NAME}" \ --organization-logo="${ORGANIZATION_LOGO}" \ --smtp-host="${SMTP_HOST}" \ @@ -81,6 +82,7 @@ spec: --smtp-skip-tls-verification="${SMTP_SKIP_TLS_VERIFICATION:-false}" \ --reset-password-url="${RESET_PASSWORD_URL}" \ --backchannel-logout-uri="${BACKCHANNEL_LOGOUT_URI}" \ + --url="${AUTHORIZER_URL}" \ --env="${ENV}" \ --host="${HOST:-0.0.0.0}" \ --http-port="${PORT:-8080}" \ @@ -104,6 +106,7 @@ spec: --graphql-max-body-bytes="${GRAPHQL_MAX_BODY_BYTES:-1048576}" \ --log-level="${LOG_LEVEL:-info}" \ --enable-login-page="${ENABLE_LOGIN_PAGE:-true}" \ + --enable-org-discovery="${ENABLE_ORG_DISCOVERY:-false}" \ --enable-playground="${ENABLE_PLAYGROUND:-true}" \ --disable-admin-header-auth="${DISABLE_ADMIN_HEADER_AUTH:-true}" \ --enable-graphql-introspection="${ENABLE_GRAPHQL_INTROSPECTION:-true}" \ @@ -116,11 +119,12 @@ spec: --enable-mobile-basic-authentication="${ENABLE_MOBILE_BASIC_AUTHENTICATION:-true}" \ --enable-phone-verification="${ENABLE_PHONE_VERIFICATION:-false}" \ --enable-magic-link-login="${ENABLE_MAGIC_LINK_LOGIN:-false}" \ - --enable-totp-login="${ENABLE_TOTP_LOGIN:-false}" \ --enforce-mfa="${ENFORCE_MFA:-true}" \ - --enable-mfa="${ENABLE_MFA:-false}" \ - --enable-email-otp="${ENABLE_EMAIL_OTP:-false}" \ - --enable-sms-otp="${ENABLE_SMS_OTP:-false}" \ + --disable-totp-login="${DISABLE_TOTP_LOGIN:-false}" \ + --disable-webauthn-mfa="${DISABLE_WEBAUTHN_MFA:-false}" \ + --disable-email-otp="${DISABLE_EMAIL_OTP:-false}" \ + --disable-sms-otp="${DISABLE_SMS_OTP:-false}" \ + --disable-mfa="${DISABLE_MFA:-false}" \ --enable-signup="${ENABLE_SIGNUP:-true}" \ --twilio-account-sid="${TWILIO_ACCOUNT_SID}" \ --twilio-api-key="${TWILIO_API_KEY}" \ @@ -304,7 +308,7 @@ spec: value: "{{ .Values.authorizer.couchbase_bucket }}" {{- end }} {{- if .Values.authorizer.couchbase_bucket_ram_quota }} - - name: "COUCHBASE_BUCKET_RAM_QUOTA" + - name: "COUCHBASE_RAM_QUOTA" value: "{{ .Values.authorizer.couchbase_bucket_ram_quota }}" {{- end }} {{- if .Values.authorizer.couchbase_scope }} @@ -315,12 +319,20 @@ spec: - name: "AUTHORIZER_URL" value: "{{ .Values.authorizer.authorizer_url }}" {{- end }} + - name: "HOST" + value: {{ .Values.authorizer.host | default "0.0.0.0" | quote }} - name: "PORT" value: "{{ .Values.authorizer.http_port | default 8080 }}" - name: "METRICS_PORT" value: "{{ .Values.authorizer.metrics_port | default 8081 }}" - name: "METRICS_HOST" value: {{ .Values.authorizer.metrics_host | default "0.0.0.0" | quote }} + - name: "LOG_LEVEL" + value: {{ .Values.authorizer.log_level | default "info" | quote }} + {{- if .Values.authorizer.env }} + - name: "ENV" + value: {{ .Values.authorizer.env | quote }} + {{- end }} - name: "RATE_LIMIT_RPS" value: {{ .Values.authorizer.rate_limit_rps | default 30 | toString | quote }} - name: "RATE_LIMIT_BURST" @@ -420,6 +432,53 @@ spec: value: {{ .Values.authorizer.graphql_max_aliases | default 30 | toString | quote }} - name: "GRAPHQL_MAX_BODY_BYTES" value: {{ int64 (default 1048576 .Values.authorizer.graphql_max_body_bytes) | toString | quote }} + - name: "OAUTH2_1_STRICT" + value: {{ .Values.authorizer.oauth2_1_strict | default false | toString | quote }} + + # HTTP routes / cookies / auth feature toggles. See values.yaml + # for the operational notes attached to each one. + - name: "ENABLE_LOGIN_PAGE" + value: {{ .Values.authorizer.enable_login_page | default true | toString | quote }} + - name: "ENABLE_ORG_DISCOVERY" + value: {{ .Values.authorizer.enable_org_discovery | default false | toString | quote }} + - name: "ENABLE_PLAYGROUND" + value: {{ .Values.authorizer.enable_playground | default true | toString | quote }} + - name: "ENABLE_GRAPHQL_INTROSPECTION" + value: {{ .Values.authorizer.enable_graphql_introspection | default true | toString | quote }} + - name: "DISABLE_ADMIN_HEADER_AUTH" + value: {{ .Values.authorizer.disable_admin_header_auth | default true | toString | quote }} + - name: "APP_COOKIE_SECURE" + value: {{ .Values.authorizer.app_cookie_secure | default true | toString | quote }} + - name: "APP_COOKIE_SAME_SITE" + value: {{ .Values.authorizer.app_cookie_same_site | default "none" | quote }} + - name: "ADMIN_COOKIE_SECURE" + value: {{ .Values.authorizer.admin_cookie_secure | default true | toString | quote }} + - name: "ENABLE_STRONG_PASSWORD" + value: {{ .Values.authorizer.enable_strong_password | default true | toString | quote }} + - name: "ENABLE_BASIC_AUTHENTICATION" + value: {{ .Values.authorizer.enable_basic_authentication | default true | toString | quote }} + - name: "ENABLE_EMAIL_VERIFICATION" + value: {{ .Values.authorizer.enable_email_verification | default false | toString | quote }} + - name: "ENABLE_MOBILE_BASIC_AUTHENTICATION" + value: {{ .Values.authorizer.enable_mobile_basic_authentication | default true | toString | quote }} + - name: "ENABLE_PHONE_VERIFICATION" + value: {{ .Values.authorizer.enable_phone_verification | default false | toString | quote }} + - name: "ENABLE_MAGIC_LINK_LOGIN" + value: {{ .Values.authorizer.enable_magic_link_login | default false | toString | quote }} + - name: "ENABLE_SIGNUP" + value: {{ .Values.authorizer.enable_signup | default true | toString | quote }} + - name: "ENFORCE_MFA" + value: {{ .Values.authorizer.enforce_mfa | default true | toString | quote }} + - name: "DISABLE_TOTP_LOGIN" + value: {{ .Values.authorizer.disable_totp_login | default false | toString | quote }} + - name: "DISABLE_WEBAUTHN_MFA" + value: {{ .Values.authorizer.disable_webauthn_mfa | default false | toString | quote }} + - name: "DISABLE_EMAIL_OTP" + value: {{ .Values.authorizer.disable_email_otp | default false | toString | quote }} + - name: "DISABLE_SMS_OTP" + value: {{ .Values.authorizer.disable_sms_otp | default false | toString | quote }} + - name: "DISABLE_MFA" + value: {{ .Values.authorizer.disable_mfa | default false | toString | quote }} # FGA (OpenFGA) integration {{- if .Values.authorizer.fga_store }} diff --git a/values.yaml b/values.yaml index 0cbeb5e..ad13828 100644 --- a/values.yaml +++ b/values.yaml @@ -92,6 +92,9 @@ redis: storage: null authorizer: + # Host address to listen on (--host). + host: "0.0.0.0" + # Main HTTP listen port (--http-port). Must differ from metrics_port. http_port: 8080 @@ -101,6 +104,12 @@ authorizer: # Bind address for /metrics (--metrics-host). Use 0.0.0.0 for in-cluster scraping. metrics_host: "0.0.0.0" + # Log level (--log-level): debug, info, warn, error. + log_level: "info" + + # Environment label for this instance (--env), e.g. "production", "staging". + env: null + # gRPC server (--grpc-port, --enable-grpc-reflection, --grpc-insecure, # --grpc-tls-cert, --grpc-tls-key). The same public API is served over gRPC; # the REST gateway (/v1/*) wraps it in-process. Must differ from http_port @@ -272,6 +281,45 @@ authorizer: graphql_max_aliases: 30 graphql_max_body_bytes: 1048576 + # ---------------------------------------------------------------------- + # HTTP routes / cookies / auth feature toggles + # ---------------------------------------------------------------------- + + enable_login_page: true + # Public organization (home-realm) discovery endpoint + /app email-first + # SSO routing step (--enable-org-discovery). Opt-in; off keeps the login + # page unchanged. + enable_org_discovery: false + enable_playground: true + enable_graphql_introspection: true + + # Disable admin authentication via the X-Authorizer-Admin-Secret header + # (--disable-admin-header-auth). true (default here) requires session/ + # cookie-based admin auth instead of the static header secret. + disable_admin_header_auth: true + + app_cookie_secure: true + # SameSite attribute for session cookies (lax, strict, none). + app_cookie_same_site: "none" + admin_cookie_secure: true + + enable_strong_password: true + enable_basic_authentication: true + enable_email_verification: false + enable_mobile_basic_authentication: true + enable_phone_verification: false + enable_magic_link_login: false + enable_signup: true + + # MFA (--enforce-mfa, --disable-*). MFA methods are enabled by default and + # opted out via disable_*; enforce_mfa forces enrollment for all users. + enforce_mfa: true + disable_totp_login: false + disable_webauthn_mfa: false + disable_email_otp: false + disable_sms_otp: false + disable_mfa: false + # FGA (OpenFGA) integration fga_store: null fga_store_url: null @@ -296,6 +344,11 @@ authorizer: default_authorize_response_type: null default_authorize_response_mode: null + # Enforce OAuth 2.1 restrictions (--oauth2-1-strict): reject the + # implicit/hybrid-with-token response types and PKCE plain (require S256). + # Breaking; opt-in. + oauth2_1_strict: false + # Branding organization_name: null organization_logo: null