Fix Console GitHub authentication for large memberships and team access

Merged
GJ
14d ago
+248-33

What type of PR is this?

/kind bug

What this PR does / why we need it:

GitHub users with hundreds of organization and team memberships could sign in successfully but receive 401 from the Console because their forwarded groups exceeded its identity limits. Raise the shared proxy authentication limits to 1,024 groups and a 64 KiB group header, retaining every group for Kubernetes RBAC and continuing to reject oversized identities.

Add consoleServer.auth.github.team to restrict sign-in to a single team slug within the configured org. Enforce the organization dependency in both JSON Schema and chart rendering, and pass the setting to OAuth2 Proxy's GitHub provider. Organization-only configurations retain their existing sign-in behavior.

Document ingress header requirements for large sessions in both the OIDC and GitHub setup guides. Cover large paginated memberships, team admission, group preservation, boundary validation, and schema-only validation with unit and real-proxy integration tests.

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Validation passed:

  • Focused unit and chart tests through make test, covering TestProxyLargeMemberships, TestProxyGroupLimits, TestOIDCIdentityValidation, TestConsoleGitHubTeamSchema, and TestRenderConsole*.
  • make test-integration TEST_FLAGS='-run TestConsole -count=1', including 208 organizations plus 205 teams through the pinned OAuth2 Proxy, organization-only and team-restricted admission, RBAC, and spoofed-header rejection.
  • make verify.

The group limits apply to both GitHub and OIDC authentication. Sign-in restrictions do not filter RBAC groups or grant permissions. Tightening org or team restrictions for existing sessions requires rotating the cookie secret and restarting Console Pods. Large proxy session cookies may also require higher ingress header limits.

Does this PR introduce a user-facing change?

Console proxy authentication now supports up to 1,024 groups and a 64 KiB group header, allowing GitHub users with hundreds of organization and team memberships to sign in. GitHub authentication also supports consoleServer.auth.github.team to restrict sign-in to a single team within the configured organization.

Summary by cubic

Fixes 401s for GitHub users with hundreds of organization and team memberships by raising the proxy authentication limits, and adds an optional consoleServer.auth.github.team setting to restrict sign-in to a single team.

  • Raises the accepted groups from 128 to 1,024 and the group header limit from 8 KiB to 64 KiB; the limits apply to both GitHub and OIDC, and oversized identities are still rejected with 401 rather than truncated.
  • Adds consoleServer.auth.github.team, which requires org and accepts a single team slug; organization-only configurations keep their existing behavior.
  • Updates the setup guide and reference and adds unit and integration tests for large paginated memberships, team admission, group preservation, and boundary validation.

Notes for reviewers

  • Sign-in restrictions do not filter RBAC groups or grant permissions.
  • Tightening org or team for existing sessions requires rotating the cookie secret and restarting Console Pods.
  • Large proxy session cookies may require higher ingress header limits.