ft(rbac): Cyclops login page for authentication & Integration of Cerbos for Authorization

[siddhantprateek]

closes #48

Preview

cyclops-login.mp4

📑 Description

• Added Login Page
• Added authentication context provider, for auth state management

✅ Checks

• I have updated the documentation as required
• I have performed a self-review of my code

ℹ Additional context

• Integrated Cerbos for authorization.
• Added a login controller and handler for username and password based login:
  • Returns a JWT access token, which the auth middleware uses to verify each endpoint.
• Created Cerbos policies for each resource.
• Added a Cerbos service to Docker Compose for local development.
• For user and password verification it uses kubernetes secrets

currently the way of creating a user is

apiVersion: v1
kind: Secret
metadata:
  name: cyclops-user-1
  namespace: cyclops
  labels:
    app.kubernetes.io/part-of: cyclops
    app.kubernetes.io/type: user
    app.kubernetes.io/name: siddhant
data:
  password: c2lkZGhhbnQ=
  roles: dXNlcg==
  username: c2lkZGhhbnQ=
type: Opaque

the query will be based on the labels

  labels:
    app.kubernetes.io/part-of: cyclops
    app.kubernetes.io/type: user
    app.kubernetes.io/name: siddhant

• app.kubernetes.io/name: siddhant same as the username

Further required enhancement

• need to refer sample k8s cerbos setup https://github.com/cerbos/demo-rest/blob/main/deploy/k8s.yaml and add this to part of cyclops installation

[petar-cvit]

This looks awesome. Is there a reason you separated this PR from the other?

[siddhantprateek]

I believe, I should close the other PR because I require rbac changes for the UI changes, and I also need to work on the latest branch instead of the rbac branch due to updates in the controller.

[petar-cvit]

Got it. Could you then close the other PR? Is this one ready for review

[siddhantprateek]

You can review this i'll close that one, and update the Additional Context for this

[petar-cvit]

Thanks, will do!

[siddhantprateek]

Also before merging the changes, we need to have Further required enhancement part too, and a way to generate admin user

[petar-cvit]

Hey @siddhantprateek, I started reviewing the PR, but could you separate it into smaller PRs? It's going to be easier to review it and discuss the solution. Especially if we still have some parts of the solution we need to discuss

[siddhantprateek]

Could we also have a logout button in the sidebar? Make sure to resolve conflicts and pick up the latest main branch

Thanks for the clarification! I often forget to ask where exactly to place the logout button. I’ll also make sure to resolve any conflicts.

Logout Button Preview:

[petar-cvit]

@siddhantprateek can we put the logout button in the top right on the navbar? Also, we could add the username and role currently used

[petar-cvit]

@siddhantprateek I noticed that I have to relogin on page refresh. Can we fix that also?

[petar-cvit]

I would prefer to have a struct UserDB that would be initialized when the service starts and then create the clientset instead of constructing it each time we load a user config. You can also offload that to the K8s client since it already has a k8s clientset that can be queried for user secrets.

[siddhantprateek]

user with role and logout dropdown preview