Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OLM Subscription does not honor Subscription Configs / Allow disabling v1 APIs #196

Open
dlydiard opened this issue Mar 10, 2023 · 0 comments

Comments

@dlydiard
Copy link

dlydiard commented Mar 10, 2023

To workaround an issue with ApiCurio v1 APIs circumventing auth, I attempted to add the suggested environment variable to the OLM Subscription to disable v1 APIs. However, the Subscription does not append environment variables to the ApicurioRegistry Deployment. According to the OLM specs, Subscription Configs should be supported to make adjustments to the installation. https://github.com/operator-framework/operator-lifecycle-manager/blob/master/doc/design/subscription-config.md#resources

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: apicurio-registry-operator
  namespace: apicurio-registry-operator
spec:
  channel: 2.x
  name: apicurio-registry
  source: community-operators
  sourceNamespace: openshift-marketplace
  installPlanApproval: Automatic
  config:
    env:
      - name: REGISTRY_DISABLE_APIS # this doesn't work...
        value: /apis/ibmcompat/.*,/api/.* # v1 APIs circumvent auth, force users to use v2 of the api

Also would be nice to support disabling v1 APIs directly via the ApicurioRegistry CRD, since this is a security hole for some use cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant