Repository navigation
Expose the Longhorn UI read-only behind platform OIDC #5649
Description
🤖 Generated by the Agentic Engineer
Summary
Provide a read-only Longhorn dashboard through the platform's existing sign-in.
Motivation
The maintainer needs to inspect storage health during the V2 migration without exposing storage administration. Requested directly in the interactive session.
Proposed Solution
Use the existing OIDC gateway and enforce read-only access on requests reaching Longhorn. Add a discoverable dashboard link and operational documentation.
Acceptance Criteria
- Signed-out visitors must authenticate through the existing OIDC service.
- The existing maintainer-team access restriction applies.
- Authenticated users can load the dashboard and inspect storage state.
- Storage-changing requests are denied at the API boundary, including direct requests through the public host.
- Static validation, protected deployment and live access checks pass.
Alternatives Considered
Hiding controls alone would leave write requests possible and does not satisfy read-only access.
Additional Context
Related to #5582; this dashboard does not itself enable V2 or migrate data.
Metadata
Metadata
Assignees
Labels
No labels
Type
Fields
Priority
None yet
Start date
None yet
Target date
None yet
Effort
None yet
Projects
- Status
Activity
1 remaining item
devantler commentedon Nov 1, 2026
Reopened after post-merge verification. #5651 merged and its protected production deployment passed, but the authenticated dashboard is blank. The fixed production access check failed before establishing its required read response: run 41305612293.
Authenticated browser navigation can read the volume API. Its schema link advertises HTTP on the HTTPS page, which needs correction; this does not yet explain the blank dashboard. #5676 adds bounded status-only diagnostics for the API boundaries and the deployed UI's JavaScript files. Acceptance remains outstanding; no storage migration or iSCSI removal is implied by this UI change.
chore: agent-claim #5649 nonce=efa7abd143899b1b4ead0bf05495489d
chore: agent-claim #5649 nonce=21db43323c713259c5547af70f65f684
chore: agent-claim #5649 nonce=351a4125263eda3570e0f8929e8bf0a7
chore: agent-claim #5649 nonce=84483be7da396531ef1516d514f58c6b
chore: agent-claim #5649 nonce=189ed1f3b50e05a0bc76a308391d58a2
chore: agent-claim #5649 nonce=a19850fe24b688c0700c65c12ef5d532
devantler commentedon Nov 1, 2026
The deployed read-only boundary proof now passes. #5690 merged through the protected queue, and a new first-attempt run from reviewed
mainpassed all 14 fixed requests: dashboard API and JavaScript reads succeeded; write attempts, the duplicate-action bypass, diagnostic downloads, and unknown API requests were denied. Production proof.The public dashboard still redirects signed-out visitors to sign-in. The previous authenticated Dashboard, Volumes, and Nodes checks succeeded after #5676 deployed. A fresh authenticated browser check remains outstanding before closing this issue; the browser connection is currently unavailable. This UI delivery does not migrate storage or remove iSCSI.
chore: agent-claim #5649 nonce=79acb2b64918723abab4b6acd89963be
devantler commentedon Nov 2, 2026
Re-read on 2 November: a browser with no session opening the public dashboard is redirected to GitHub sign-in for the platform's OIDC app, so the signed-out criterion still holds.
The fresh authenticated check is still outstanding. An agent browser has no session here and agents don't sign in with passwords. This card stays open until a run has an existing authenticated session, or the maintainer opens the dashboard during normal use and reports what they see.
devantler commentedon Nov 2, 2026
UI acceptance is complete on 2 November. A fresh platform OIDC sign-in succeeded, and following the visible Homepage tile opened the Longhorn dashboard. Dashboard, Nodes and both Volumes pages rendered in the authenticated browser. The signed-out path still requires the existing sign-in.
The new protected first-attempt production boundary proof 41464206188 passed at reviewed source
b7f918d977e2ccb2b0b9862ac791ef75b89bff15. All 14 fixed requests passed: dashboard API and JavaScript reads succeeded; writes, the duplicate-action bypass, diagnostic downloads and unknown API requests were denied. The earlier failed observations remain recorded.A scoped live read confirmed the proxy's maintainer-team group restriction and no deployment argument or environment override for that restriction. This verifies the deployed configuration; no second user's credentials were used. #5676 and #5690 are merged, and their protected deployment plus the current browser and boundary checks satisfy this card.
The UI issue can close. Storage migration and iSCSI removal remain tracked by #5582 and are not implied by this acceptance.