User guide

Gafaelfawr was written to run within the Vera C. Rubin Science Platform. While there is nothing intrinsic in Gafaelfawr that would prevent it from working in some other environment, only installation via Phalanx is supported or has been tested.

Also see the Phalanx Gafaelfawr application documentation for more operational documentation and procedures.

Configuration

• Prerequisites
• Authentication provider
  • GitHub
  • CILogon
  • Other OpenID Connect provider
• Vault secrets
• Helm configuration
  • Subdomains
  • Environent URLs and storage
    • Base internal URL
    • Database URL
    • Cloud SQL
    • Redis storage
  • Token lifetime
  • Authentication provider
    • GitHub
    • CILogon
    • Generic OpenID Connect
  • Error pages
  • Administrators
  • LDAP
    • LDAP authentication
    • LDAP groups
    • LDAP user information
    • Firestore UID/GID assignment
  • Scopes
  • Quotas
    • Default quota
    • Group quota
    • Bypass groups
  • Scaling
    • Resource requests and limits
  • Logging and proxies
  • Alerts, metrics, and tracing
    • Metrics
    • Slack alerts
    • Sentry
  • Maintenance
    • Timing
    • Time limits
  • OpenID Connect server
• Administrators
  • Bootstrapping

Protecting services

• How Gafaelfawr-protected ingresses work
  • Header filtering
  • Error handling
• Configuring ingress with GafaelfawrIngress
  • Basic configuration
    • config section
    • template section
  • Redirecting users to log in
  • Disallowing cookie authentication
  • Changing the challenge type
  • Allowing non-CORS OPTIONS requests
  • Requesting delegated tokens
    • Internal tokens
    • Notebook tokens
    • Minimum token lifetime
    • Delegate token in Authorization header
  • Caching
  • Service-only ingresses
  • Per-user ingresses
    • List of allowed users
    • Per-user hostnames
  • Anonymous ingresses
  • Locating Gafaelfawr-managed ingresses
  • Request headers
• Cross-origin requests
  • CORS preflight policy
  • Other OPTIONS requests
• Quota management
  • Types of quota
    • API quotas
      • Blocking a service
    • Notebook quotas
  • Overriding quotas
• Service tokens
• Configuring OpenID Connect
  • Configure Gafaelfawr
  • Configure the OpenID client
    • OpenID scopes
  • Examples
    • Chronograf

Reference

• Response headers
  • Rate limit headers
• Logging
  • Log attributes
• Command-line interface
  • gafaelfawr
    • audit
    • delete-all-data
    • generate-key
    • generate-schema
    • generate-session-secret
    • generate-token
    • help
    • init
    • maintenance
    • openapi-schema
    • run
    • update-schema
    • validate-schema
  • Kubernetes operator
• Metrics
  • Frontend metrics
  • State metrics