Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CLAUDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ cd authbridge && podman build -f cmd/authbridge-proxy/Dockerfile \

### Running the Full Demo

1. Set up a Kind cluster with SPIRE + Keycloak (use [Rossoctl Ansible installer](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md))
1. Set up a Kind cluster with SPIRE + Keycloak (use [Rossoctl installer](https://www.rossoctl.dev/docs/overview/quickstart))
2. Deploy the webhook via [operator](https://github.com/rossoctl/operator)
3. See the [AuthBridge demos index](authbridge/demos/README.md) for a recommended learning path:
- **Getting started**: `authbridge/demos/weather-agent/demo-ui.md` (inbound validation, UI deployment)
Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ please report it responsibly.

1. **Do NOT create public GitHub issues** for security vulnerabilities
2. **Email**: Report vulnerabilities privately via GitHub Security Advisories
- Go to the [Security tab](../../security/advisories/new) and create a new advisory
- Go to the [Security tab](https://github.com/rossoctl/cortex/security/advisories/new) and create a new advisory
3. **Include**: A clear description of the vulnerability, steps to reproduce,
and potential impact

Expand Down
6 changes: 3 additions & 3 deletions authbridge/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ AuthBridge provides **secure, transparent token management** for Kubernetes work

## Deployment Modes

The [`cmd/authbridge/`](./cmd/authbridge/) directory contains a unified binary that supports three deployment modes in a single codebase. Two container images are published:
Two container images are published:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Clarify the published-image count.

This says two container images are published, but the table lists three image identifiers, including authbridge-lite. Please state that there are two base images plus the authbridge-lite build variant, or update the count.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@authbridge/README.md` at line 9, Update the README statement near “Two
container images are published” to accurately describe the table: state that
there are two base images plus the authbridge-lite build variant, or revise the
count to reflect all three listed image identifiers.


| Image | Contents |
|-------|----------|
Expand Down Expand Up @@ -344,7 +344,7 @@ sequenceDiagram

### Quick Setup

The easiest way to get all prerequisites is to use the [Rossoctl Ansible installer](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md#ansible-based-installer-recommended).
The easiest way to get all prerequisites is to use the [Rossoctl Quickstart](https://www.rossoctl.dev/docs/overview/quickstart).

## Getting Started

Expand Down Expand Up @@ -456,6 +456,6 @@ Keycloak client registration is handled by the [operator](https://github.com/ros

## References

- [Rossoctl Installation](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md)
- [Rossoctl Installation](https://github.com/rossoctl/rossoctl/blob/main/docs/getting-started/install.md)
- [SPIRE Documentation](https://spiffe.io/docs/latest/)
- [OAuth 2.0 Token Exchange (RFC 8693)](https://www.rfc-editor.org/rfc/rfc8693)
2 changes: 1 addition & 1 deletion authbridge/cmd/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ ConfigMap contracts are documented in
- **Default deployment**: use `authbridge-proxy`. No iptables, no
Envoy, observable via abctl.
- **Need ambient/transparent interception via Envoy**: use
`authbridge-envoy`. Requires the [`proxy-init`](../authproxy/)
`authbridge-envoy`. Requires the [`proxy-init`](../proxy-init/)
iptables init container.
- **Size-constrained, no protocol-aware events needed**: use the
`authbridge-lite` image — the `authbridge-proxy` binary built with
Expand Down
4 changes: 1 addition & 3 deletions authbridge/demos/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ more AuthBridge capabilities.

All demos require:
- A Kubernetes cluster with the Rossoctl platform installed
([Installation Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md))
([Installation Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/getting-started/install.md))
- Keycloak deployed in the `keycloak` namespace
- SPIRE deployed (for demos using SPIFFE identity)

Expand Down Expand Up @@ -145,6 +145,4 @@ pip install -r requirements.txt
## Related Documentation

- [AuthBridge Overview](../README.md) — Architecture and design
- [AuthBridge Binary](../cmd/authbridge/README.md) — Unified authbridge binary
supporting ext_proc, ext_authz, and proxy modes
- [Rossoctl Operator](https://github.com/rossoctl/operator) — Admission webhook for sidecar injection (migrated from this repo)
2 changes: 1 addition & 1 deletion authbridge/demos/github-issue/demo-manual.md
Original file line number Diff line number Diff line change
Expand Up @@ -1197,7 +1197,7 @@ kubectl delete mutatingwebhookconfiguration rossoctl-webhook-authbridge-mutating
## Next Steps

- **UI Deployment**: See [demo-ui.md](demo-ui.md) for deploying via the Rossoctl dashboard
- **AuthBridge Binary**: See the [AuthBridge README](../../cmd/authbridge/README.md) for inbound
- **AuthBridge Binary**: See the [AuthBridge README](../../cmd/authbridge-envoy/README.md) for inbound

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JWT validation and outbound token exchange internals
- **Token-Exchange Routes**: See the [routes-configuration guide](../token-exchange-routes/README.md) for
route-based token exchange to multiple tool services
Expand Down
4 changes: 2 additions & 2 deletions authbridge/demos/weather-agent/demo-ui.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ plugin pipeline in real time while chatting with the agent, see
## Prerequisites

Ensure you have completed the Rossoctl platform setup as described in the
[Installation Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md),
[Installation Guide](https://www.rossoctl.dev/docs/getting-started/install),
including the Rossoctl UI.

You should also have:
Expand Down Expand Up @@ -789,7 +789,7 @@ kubectl delete namespace team1

- **Advanced Demo**: See the [GitHub Issue Agent demo](../github-issue/demo.md) for
outbound token exchange, scope-based access control, and Alice vs Bob scenarios
- **AuthBridge Binary**: See the [AuthBridge README](../../cmd/authbridge/README.md) for inbound
- **AuthBridge Binary**: See the [AuthBridge README](../../cmd/README.md) for inbound
JWT validation and outbound token exchange internals
- **Token-Exchange Routes**: See the [routes-configuration guide](../token-exchange-routes/README.md) for
route-based token exchange to multiple tool services
Expand Down
2 changes: 1 addition & 1 deletion authbridge/demos/weather-agent/demo-with-abctl.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ This demo extends the standard [Weather Agent demo](./demo-ui.md) with a live vi

Before starting, complete these in order:

1. **Install Rossoctl** (operator + Keycloak + UI + SPIFFE/SPIRE): [Rossoctl Installation Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/install.md). Works on Kind (local) or OpenShift.
1. **Install Rossoctl** (operator + Keycloak + UI + SPIFFE/SPIRE): [Rossoctl Installation Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/getting-started/install.md). Works on Kind (local) or OpenShift.
2. **Deploy the Weather Agent + Tool** through the Rossoctl UI: [Weather Agent Demo with AuthBridge](./demo-ui.md). At the end of that demo you'll have:
- `weather-service` agent running in the `team1` namespace (with AuthBridge sidecars).
- `weather-tool-mcp` MCP tool running in `team1`.
Expand Down
2 changes: 1 addition & 1 deletion authbridge/docs/plugin-tutorial.md
Original file line number Diff line number Diff line change
Expand Up @@ -396,6 +396,6 @@ All optional. A plugin that doesn't implement them is treated as
- [`framework-architecture.md`](./framework-architecture.md) — how the pipeline
composes plugins, the Run / RunResponse dispatch order, and the
lifecycle hooks.
- [`pipeline/plugin.go`](../pipeline/plugin.go) — the Plugin interface
- [`pipeline/plugin.go`](../authlib/pipeline/plugin.go) — the Plugin interface
and all optional interfaces (Initializer / Shutdowner / Readier /
Configurable).
Loading