diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index af626d3f..93b58b0b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,7 +5,7 @@ Thank you for your interest in contributing. ## Getting started ```sh -git clone https://github.com/Gkrumbach07/openshell-dashboard.git && cd openshell-dashboard +git clone https://github.com/ai-openshell/console.git && cd console ``` Then follow [Run it locally](docs/development.md#run-it-locally): `make setup`, `make gateway` and `make dev`. diff --git a/README.md b/README.md index 69bf1e93..c969f032 100644 --- a/README.md +++ b/README.md @@ -56,11 +56,11 @@ Install the chart: ```sh helm upgrade --install openshell-dashboard \ - oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \ + oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \ --version --namespace openshell -f values.yaml ``` -`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)). +`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](#compatibility), [releases](https://github.com/ai-openshell/console/releases)). Then open `https://dashboard.example.com` and sign in. The [install guide](docs/install.md) has every step: Keycloak, the gateway's settings, OpenShift, sign-out and workspace membership. @@ -71,7 +71,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever | Your gateway | Dashboard | Container image | |---|---|---| | `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` | -| `0.0.116` | the [`gateway-0.0.116`](https://github.com/Gkrumbach07/openshell-dashboard/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` | +| `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` | `gateway-0.0.116` is a one-off build for gateway `0.0.116` only. It sits outside the version numbering, and no further release is planned for it. diff --git a/deploy/helm/openshell-dashboard/README.md b/deploy/helm/openshell-dashboard/README.md index 21c1e4e8..43ba0f03 100644 --- a/deploy/helm/openshell-dashboard/README.md +++ b/deploy/helm/openshell-dashboard/README.md @@ -49,13 +49,13 @@ Install the published chart: ```sh helm upgrade --install openshell-dashboard \ - oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \ + oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \ --version --namespace openshell -f values.yaml ``` -`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/Gkrumbach07/openshell-dashboard#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)). +`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/ai-openshell/console#compatibility), [releases](https://github.com/ai-openshell/console/releases)). -The [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership. +The [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership. ## Example values @@ -63,21 +63,21 @@ These files are in the repository, not in the packaged chart. CI renders each on | File | When it applies | |---|---| -| [`values-keycloak.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session | -| [`values-gateway-api.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway | -| [`values-port-forward.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress | -| [`values-route-edge.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router | -| [`values-route-reencrypt.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS | -| [`values-openshift-scc.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group | -| [`values-mtls-client-cert.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC | -| [`values-tls-disabled.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network | +| [`values-keycloak.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session | +| [`values-gateway-api.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway | +| [`values-port-forward.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress | +| [`values-route-edge.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router | +| [`values-route-reencrypt.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS | +| [`values-openshift-scc.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group | +| [`values-mtls-client-cert.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC | +| [`values-tls-disabled.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network | ## Configuration notes - **Identity provider** - `oidc.provider` is `oidc` for any OIDC issuer and `keycloak-oidc` for Keycloak. Limit who reaches the UI with `oidc.allowedRoles`, which needs `keycloak-oidc`, or with `oidc.allowedGroups`. - `oidc.clientIdSecretKey` takes the client ID from the Secret and wins over `oidc.clientId`. `oidc.caConfigMapName` trusts an issuer certificate from a private CA. - - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has the gateway's key names. + - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has the gateway's key names. - `oidc.audience` and `oidc.rolesClaim` are informational: they change no token, and the chart only prints the audience in its post-install notes. - **Gateway connection** - The chart mounts the gateway's CA from the Secret `gateway.caSecretName`, key `gateway.caKey`, in the release namespace. diff --git a/deploy/helm/openshell-dashboard/README.md.gotmpl b/deploy/helm/openshell-dashboard/README.md.gotmpl index 51610c7d..8ea2b941 100644 --- a/deploy/helm/openshell-dashboard/README.md.gotmpl +++ b/deploy/helm/openshell-dashboard/README.md.gotmpl @@ -49,13 +49,13 @@ Install the published chart: ```sh helm upgrade --install openshell-dashboard \ - oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \ + oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \ --version --namespace openshell -f values.yaml ``` -`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/Gkrumbach07/openshell-dashboard#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)). +`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/ai-openshell/console#compatibility), [releases](https://github.com/ai-openshell/console/releases)). -The [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership. +The [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership. ## Example values @@ -63,21 +63,21 @@ These files are in the repository, not in the packaged chart. CI renders each on | File | When it applies | |---|---| -| [`values-keycloak.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session | -| [`values-gateway-api.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway | -| [`values-port-forward.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress | -| [`values-route-edge.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router | -| [`values-route-reencrypt.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS | -| [`values-openshift-scc.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group | -| [`values-mtls-client-cert.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC | -| [`values-tls-disabled.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network | +| [`values-keycloak.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session | +| [`values-gateway-api.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway | +| [`values-port-forward.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress | +| [`values-route-edge.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router | +| [`values-route-reencrypt.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS | +| [`values-openshift-scc.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group | +| [`values-mtls-client-cert.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC | +| [`values-tls-disabled.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network | ## Configuration notes - **Identity provider** - `oidc.provider` is `oidc` for any OIDC issuer and `keycloak-oidc` for Keycloak. Limit who reaches the UI with `oidc.allowedRoles`, which needs `keycloak-oidc`, or with `oidc.allowedGroups`. - `oidc.clientIdSecretKey` takes the client ID from the Secret and wins over `oidc.clientId`. `oidc.caConfigMapName` trusts an issuer certificate from a private CA. - - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has the gateway's key names. + - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has the gateway's key names. - `oidc.audience` and `oidc.rolesClaim` are informational: they change no token, and the chart only prints the audience in its post-install notes. - **Gateway connection** - The chart mounts the gateway's CA from the Secret `gateway.caSecretName`, key `gateway.caKey`, in the release namespace. diff --git a/docs/adrs/0001-standalone-application.md b/docs/adrs/0001-standalone-application.md index fbec1c31..eec1b68a 100644 --- a/docs/adrs/0001-standalone-application.md +++ b/docs/adrs/0001-standalone-application.md @@ -11,7 +11,7 @@ OpenShell Dashboard is a web UI for one OpenShell gateway. The BFF is given one 1. **Standalone is the only mode.** The dashboard is an application of its own, with its own address, navigation and sign-in. It is not embedded in another application's UI, not loaded as a remote module and not published as a library. 2. **One container image holds the whole application.** The Go BFF serves the REST API under `/api/v1` and the built React UI from the same process. The image is `quay.io/gkrumbach07/openshell-dashboard`. -3. **It is installed with the Helm chart in `deploy/helm/openshell-dashboard`,** published as an OCI chart at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard`. The chart runs the BFF with oauth2-proxy beside it in one pod ([ADR 0002](0002-auth-relay-only-bff.md)) and exposes the proxy through a Gateway API HTTPRoute or an OpenShift Route. +3. **It is installed with the Helm chart in `deploy/helm/openshell-dashboard`,** published as an OCI chart at `oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard`. The chart runs the BFF with oauth2-proxy beside it in one pod ([ADR 0002](0002-auth-relay-only-bff.md)) and exposes the proxy through a Gateway API HTTPRoute or an OpenShift Route. 4. **The BFF never does the following.** It does not terminate authentication, validate tokens or authorize (ADR 0002). It does not call the Kubernetes API. It does not fetch, store or inject provider credentials: they pass through to the gateway and only their names come back. It does not rate-limit. It holds no state: no session store, no database, nothing that ties a request to a replica. 5. **Nothing is published to npm.** `frontend/package.json` is `private`, and the UI is built only as part of the image. diff --git a/docs/compatibility.md b/docs/compatibility.md index fad64726..f4859e43 100644 --- a/docs/compatibility.md +++ b/docs/compatibility.md @@ -7,7 +7,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever | Your gateway | Dashboard | Container image | |---|---|---| | `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` | -| `0.0.116` | the [`gateway-0.0.116`](https://github.com/Gkrumbach07/openshell-dashboard/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` | +| `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` | `gateway-0.0.116` is a one-off build outside the version numbering, because gateway `0.0.x` releases were not compatible with each other. It has no Templates support (gateway `0.0.116` has no sandbox-template RPCs), and no further release is planned for it. diff --git a/docs/install.md b/docs/install.md index 110f21ff..c01fec54 100644 --- a/docs/install.md +++ b/docs/install.md @@ -115,11 +115,11 @@ networkPolicy: ```sh helm upgrade --install openshell-dashboard \ - oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \ + oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \ --version --namespace openshell -f values.yaml ``` -`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](../README.md#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)). Then check: +`` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](../README.md#compatibility), [releases](https://github.com/ai-openshell/console/releases)). Releases up to `0.1.2` were also published at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard`, the chart's home before the repository moved; that path receives no newer release. Then check: ```sh kubectl -n openshell rollout status deploy/openshell-dashboard diff --git a/docs/releasing.md b/docs/releasing.md index 8f73ab39..118c9ef5 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -10,7 +10,9 @@ A release `vX.Y.Z` is three things, all made by `publish.yml`: |---|---|---| | GitHub release `vX.Y.Z`, and the git tag with it | this repository | `scripts/release/cut-release.mjs` | | Container image tags `X.Y.Z` and `X.Y` | `quay.io/gkrumbach07/openshell-dashboard` | retagging the image CI already built | -| Helm chart `openshell-dashboard`, version `X.Y.Z` | `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart` | packaging the chart at the released commit | +| Helm chart `openshell-dashboard`, version `X.Y.Z` | `oci://ghcr.io/ai-openshell/console/helm-chart` | packaging the chart at the released commit | + +The chart's registry path follows the repository's name (`publish.yml` pushes to `oci://ghcr.io///helm-chart`), so a package created under a new name starts out private: make it public in the organization's package settings before announcing the release. Releases up to `0.1.2` are at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart`, the path before the repository moved to `ai-openshell/console`; nothing is published there any more. The BFF and the UI ship together and share the version.