Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: move using kuadrant from guides into readme for guides #523

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs: move using kuadrant from guides into readme for guides #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
01f879f
docs: move using kuadrant from guides into readme for guides
KevFan Feb 26, 2025
2145a62
docs: move unavailable authorino features via kuadrant to readme
KevFan Feb 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions docs/user-guides/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# AuthConfig Consumers
Authorino's `AuthConfig` is a custom resource that defines authentication and authorization policies. Many tools and frameworks act
as consumers of `AuthConfig` by automatically generating and managing these resources on behalf of users. Since these consumers
follow the same specification, the general concepts and steps outlined in the user guides are applicable.
However, some details—such as resource names and specific API fields—may differ based on the consuming framework.

This section provides guidance for users working with tools that act as consumers of `AuthConfig`, allowing them to leverage the
same principles outlined in the user guides, regardless of the framework they are using.

## Kuadrant
[Kuadrant](https://kuadrant.io/) provides API security and access control capabilities through its own custom resource: `AuthPolicy`.
`AuthPolicy` is designed specifically for use with the Kubernetes [Gateway API](https://gateway-api.sigs.k8s.io/), allowing users
to define authentication and authorization rules directly in their network policy configurations.

Rather than defining `AuthConfig` resources directly, users can define an `AuthPolicy`, and Kuadrant will automatically
generate the corresponding `AuthConfig` for Authorino to consume.

### Key Details About `AuthPolicy` as an `AuthConfig` Consumer

- **Same Specification**: The spec schema of `AuthPolicy` is effectively the same as `AuthConfig`.
- **Automatic Hostname Handling**: Unlike `AuthConfig`, `AuthPolicy` does not explicitly define `spec.host`. Instead, hostnames are
inferred from the Kubernetes network object in `spec.targetRef` and the route selectors in the policy.
- **Authorino Integration**: Kuadrant translates `AuthPolicy` into an `AuthConfig`, which is then processed by Authorino to enforce
authentication and authorization.

### Authorino Features Not Available via Kuadrant
Some Authorino-specific features may not be available when using Authorino through Kuadrant:

- [Sharding](./sharding.md)
- [Host Override via Context Extension](./host-override.md)

For more details on enforcing authentication and authorization with Kuadrant, see the
[Kuadrant Auth documentation](https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth/).
17 changes: 0 additions & 17 deletions docs/user-guides/anonymous-access.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,23 +29,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/api-key-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,23 +33,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/authenticated-rate-limiting-envoy-dynamic-metadata.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.</p>
<p>At step ❻, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/authzed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,23 +28,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.</p>
<p>At step ❻, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/caching.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,23 +47,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/deny-with-redirect-to-login.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,23 +35,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample web application called **Matrix Quotes** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/edge-authentication-architecture-festival-wristbands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,23 +56,6 @@ The next steps walk you through installing Authorino and configuring 2 environme

The first environment is a facade for handling the first layer of authentication and exchanging any valid presented authentication token for a Festival Wristband token. In the second, we will deploy a sample service called **Talker API** that the authorization service will ensure to receive only authenticated traffic presented with a valid Festival Wristband.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❹.</p>
<p>At steps ❹ and ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/envoy-jwt-authn-and-authorino.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,23 +47,6 @@ kubectl -n keycloak apply -f https://raw.githubusercontent.com/kuadrant/authorin

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❻.</p>
<p>At step ❻, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/external-metadata.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,23 +37,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/hello-world.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a>, you can skip step ❸. You may already have Authorino installed and running as well. In this case, skip also step ❺. If you even have your workload cluster configured, with sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, go straight to step ❼.</p>
<p>At step ❼, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

## ❶ Create the namespace

```sh
Expand Down
11 changes: 0 additions & 11 deletions docs/user-guides/host-override.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,6 @@ By default, Authorino uses the host information of the HTTP request ([`Attribute

Overriding the host attribute of the HTTP request can be useful to support use cases such as of **path prefix-based lookup** and **wildcard subdomains lookup**.

<table>
<tbody>
<tr>
<td>
<b>⚠️ <i>Important:</i></b>
This feature may not be available to users of Authorino via <a href="https://kuadrant.io">Kuadrant</a>.
</td>
</tr>
</tbody>
</table>

<br/>

In this guide:
Expand Down
17 changes: 0 additions & 17 deletions docs/user-guides/http-basic-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,23 +36,6 @@ kind create cluster --name authorino-tutorial

The next steps walk you through installing Authorino, deploying and configuring a sample service called **Talker API** to be protected by the authorization service.

<table>
<thead>
<tr>
<th>Using Kuadrant</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>If you are a user of <a href="https://kuadrant.io">Kuadrant</a> and already have your workload cluster configured and sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, skip straight to step ❺.</p>
<p>At step ❺, instead of creating an <code>AuthConfig</code> custom resource, create a Kuadrant <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/reference/authpolicy"><code>AuthPolicy</code></a> one. The schema of the AuthConfig's <code>spec</code> matches the one of the AuthPolicy's, except <code>spec.host</code>, which is not available in the Kuadrant AuthPolicy. Host names in a Kuadrant AuthPolicy are inferred automatically from the Kubernetes network object referred in <code>spec.targetRef</code> and route selectors declared in the policy.</p>
<p>For more about using Kuadrant to enforce authorization, check out <a href="https://docs.kuadrant.io/latest/kuadrant-operator/doc/overviews/auth">Kuadrant auth</a>.</p>
</td>
</tr>
</tbody>
</table>

<br/>

## ❶ Install the Authorino Operator (cluster admin required)
Expand Down
Loading
Loading