feat(multiadmin): add CRD fields for JWT auth config - #571
Open
shedges wants to merge 5 commits into
Open
Conversation
This comment has been minimized.
This comment has been minimized.
Multiadmin's own JWT bearer-token auth (--grpc-auth-mode=jwt and its
--grpc-auth-jwt-* flags) is already implemented and enforced, but
nothing in this operator could actually turn it on for a real
deployment. There was no CRD field for it, and builders_global.go
never passed the flags.
Adds spec.multiadmin.auth.jwt.{issuer,jwksURI,allowedSubjects} to
MultigresCluster, and wires BuildMultiadminDeployment to append the
matching --grpc-auth-jwt-* flags when set, following the same
conditional-args pattern already used for spec.internalTLS.
Ships opt-in: existing clusters and clusters that never set
spec.multiadmin.auth are unaffected. Turning this on for a real
Supabase deployment (wiring the actual AWS STS issuer/JWKS/subject
values) is separate, downstream config work, not part of this change.
Signed-off-by: Sagar Shedge <sagar.shedge92@gmail.com>
shedges
force-pushed
the
sagarshedge/multiadmin-jwt-auth-crd
branch
from
August 12, 2026 16:10
bf29686 to
e20cd0b
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
shedges
marked this pull request as ready for review
August 12, 2026 16:37
Multiadmin's own JWT bearer-token auth (--enable-auth and its
--grpc-auth-jwt-* flags, gating its HTTP/Connect/REST/pprof surface
while leaving gRPC unauthenticated) is already implemented and
enforced, but nothing in this operator could actually turn it on for
a real deployment. There was no CRD field for it, and
builders_global.go never passed the flags.
Adds spec.multiadmin.auth.jwt.{issuer,jwksURI,allowedSubjects} to
MultigresCluster, and wires BuildMultiadminDeployment to append the
matching flags when set, following the same conditional-args pattern
already used for spec.internalTLS.
Ships opt-in: existing clusters and clusters that never set
spec.multiadmin.auth are unaffected. Turning this on for a real
Supabase deployment (wiring the actual AWS STS issuer/JWKS/subject
values) is separate, downstream config work, not part of this change.
Signed-off-by: Sagar Shedge <sagar.shedge92@gmail.com>
Signed-off-by: Sagar Shedge <sagar.shedge92@gmail.com>
shedges
marked this pull request as draft
August 14, 2026 21:00
This comment has been minimized.
This comment has been minimized.
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
shedges
marked this pull request as ready for review
August 17, 2026 07:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Multiadmin's own JWT bearer-token auth (
--grpc-auth-mode=jwtand its--grpc-auth-jwt-*flags, see multigres#1369) is already implemented and enforced, but nothing in this operator could actually turn it on for a real deployment — there was no CRD field for it, andbuilders_global.gonever passed the flags.spec.multiadmin.auth.jwt.{issuer,jwksURI,allowedSubjects}toMultigresCluster, following the existingSpec/TemplateRefpattern onMultiadminConfig.issuer/jwksURIare required oncejwtis set (matching Multiadmin's own runtime validation);allowedSubjectsis optional.BuildMultiadminDeploymentto append the matching--grpc-auth-jwt-*flags when configured, following the same conditional-args pattern already used forspec.internalTLS.spec.multiadmin.auth, are unaffected.Verified end-to-end in a local kind cluster: a
MultigresClusterwithspec.multiadmin.auth.jwtset produces a running Multiadmin pod that correctly enforces JWT auth against a real in-cluster JWKS endpoint (rejects unauthenticated/invalid requests, accepts a valid token).Turning this on for a real Supabase deployment is separate, downstream config work, not part of this change.