Admin Bot
55b32b97e0
PHASE 8 COMPLETE (10/10 tasks): - 8.2: X-Service/X-Resource dispatcher ✅ - 8.10: Phase gate - all 5 services routing ✅ Architecture decisions documented: - Gateway = dumb pipe (Option B) - SQS: gateway validates JWT (code unverified) - MinIO, Temporal: native JWT support - Memory, IAM: service-owned validation - ConfigMap-based config with Stakater Reloader - Real integration tests with cluster services PHASE 3 (Auth) TASKS CREATED (0/3 TODO): - 3.1: SQS JWT validation vs Authentik JWKS - 3.2: MinIO native JWT load-test - 3.3: Temporal JWT jwtKeyProvider configuration Updates: - tasks/8.2-x-service-dispatcher.md: marked GREEN - tasks/8.10-serviceadapter-gate.md: marked GREEN with notes - tasks/3.1-3.3: new Phase 3 auth tasks - tasks/INDEX.md: Phase 8 complete, Phase 3 active
57 lines
1.9 KiB
Markdown
57 lines
1.9 KiB
Markdown
# 3.2 — MinIO: Load-test native JWT/OIDC validation
|
|
|
|
Phase: 3 — Authentication & Authorization
|
|
Stage: TODO
|
|
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)
|
|
|
|
## Context
|
|
|
|
MinIO is configured for OIDC via `MINIO_IDENTITY_OPENID_*` env vars.
|
|
Per homelab/project-usage/jwt-auth-rollout.md: "likely yes, **not yet load-tested**".
|
|
|
|
**Phase 8.2 decision**: Gateway acts as dumb pipe, MinIO validates JWTs itself.
|
|
|
|
## Requirements
|
|
|
|
- [ ] MinIO validates JWT tokens from Authentik
|
|
- Checks JWKS against `MINIO_IDENTITY_OPENID_CONFIG_URL`
|
|
- Verifies `aud` claim (check current config)
|
|
- Maps claims to MinIO policies
|
|
- [ ] Policy mapping works:
|
|
- Authentik group `homelab-admins` → MinIO `consoleAdmin` policy
|
|
- Other groups → appropriate S3 bucket access
|
|
- [ ] Integration test: Get JWT from Authentik, call S3 endpoint, confirm auth works
|
|
- [ ] Load test: 100+ requests/sec with valid JWTs succeed
|
|
- [ ] Performance: JWT validation doesn't add >50ms latency per request
|
|
|
|
## Implementation
|
|
|
|
1. Verify MinIO OIDC config in k8s/infra (not this repo)
|
|
2. Create JWT token with homelab-admins group
|
|
3. Test S3 operations (ListBuckets, GetObject, PutObject)
|
|
4. Add load test to integration suite
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
export JWT=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
|
|
-d "grant_type=client_credentials&client_id=<id>&client_secret=<secret>&scope=openid" \
|
|
| jq -r '.access_token')
|
|
|
|
# List buckets
|
|
aws s3 ls --endpoint-url https://api.riotpiao.com/ \
|
|
--header "Authorization: Bearer $JWT"
|
|
|
|
# Get object
|
|
curl -H "Authorization: Bearer $JWT" \
|
|
https://api.riotpiao.com/ \
|
|
-H 'X-Service: s3' -H 'X-Resource: list-objects'
|
|
```
|
|
|
|
## Notes
|
|
|
|
- **Not Phase 8.2**: Phase 8 was routing, Phase 3 is auth verification
|
|
- **MinIO owner responsibility**: Verify config in k8s/infra cluster
|
|
- **Gateway responsibility**: Pass JWT through unchanged (dumb pipe)
|
|
- **Test coverage**: Real JWT token, real S3 operations
|