hyperadev / kani Goto Github PK

When using Kani v1.1.0, Kani unexpectedly returns Unauthorized for all requests.
This is because of the error: failed to verify signature: fetching keys oidc: get keys failed Get "https://[team].cloudflareaccess.com/cdn-cgi/access/certs": x509: certificate signed by unknown authority

This error is caused by the use of the 'scratch' base image, which does not have /etc/ssl/certs/ca-certificates.crt which Go uses when making http requests.

Hi.

Thanks for creating this project. While it was intended to be used for Traefik, this project seems to work well when using ingress-nginx (and presumably other ingress controllers) aswell. I think it would be beneficial to provide an example for other reverse proxies, or at least ingress-nginx as it tends to be a pretty popular ingress controller.

For ingress-nginx, an ingress can be annotated with

nginx.ingress.kubernetes.io/auth-url: "http://kani.kube-system.svc.cluster.local:3000/<AUD>"

With an invalid AUD set, it will 401 as expected. Headers can probably be forwarded aswell with an auth-snippet of some sort, but haven't looked into it yet as I don't have a usecase for it.

Welcome!

• I have checked for similar issues on GitHub.

Problem

There are currently no Helm charts that can be used to deploy Kani in a Kubernetes cluster.

Suggested solution

I think it could be useful if we provided an "official" Kani helm chart which could be used to easily deploy Kani.

Additional information

No response

As we only use one HTTP route, we don't need to use a library like gofiber.
Instead, we can directly use net/http or fasthttp.

This is a to-do list for kani v2.0.0.
Development on kani v2.0.0 will be conducted on the v2 branch until we are ready to release it.

kani v2.0.0:

• hypera.dev/kani/v2
• Rewrite following best practices
• Better logging
• Config
• TLS configuration
• Configurable HTTP responses
• Prometheus support
• Retrieve user identity information from Cloudflare (configurable)
• Testing
• Godoc
• Installation and usage documentation

If you have any ideas you would like to suggest, feel free to below!

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): Pin image docker/dockerfile to 865e5dd
• chore(deps): update image alpine to v3.20.3
• chore(deps): update go to v1.23.1
• chore(deps): update image golang to v1.23.1
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository