[Request] Opt out from auth proxies

[fernandezcuesta]

Describe the feature

As a user, I might have other mechanisms to authenticate an application, such as request OIDC in the Load Balancer directly.
In such cases, I don't want to deploy a sidecar container which will have no purpose.

Anything other information?

No response

[andrewazores]

The oauth2-proxy also has a secondary role beyond authentication, which is that it allows us to place both Cryostat and its Grafana dashboard behind the proxy, so that both parts of Cryostat look like one host and the Grafana UI is simply placed at the /grafana path. That isn't strictly required of course, and in the past Cryostat wasn't organized in this way, but it's not as simple as removing the auth proxy Deployment - other things will also need to be reconfigured for this setup to work (again).

It's also used for auth on the cryostat-reports sidecar, but this is probably another easy one to replace.

[fernandezcuesta]

ok closing this one :(

[andrewazores]

I'm not saying it's not worth doing or that I wouldn't accept this change! In fact, I think it's a good goal to have, because keeping a small overall deployment footprint is quite valuable for Cryostat (obviously). I think it's just a little bit more complex than it might appear to be.

[andrewazores]

If you (or any future reader) wants to do some code archaeology, #124 would be a good starting point. Prior to Cryostat 3.0 there were no auth proxies and the Grafana container was deployed separately and interacted with via its own separate host address, so seeing what changed around that timeframe could be a good way to get a perspective on how to make it a configuration option to go back to that kind of setup.