Installation

Identity providers and connection security

Plan LDAP/Google/OIDC, TLS/DNS, ingress, system proxy, and repository egress boundaries in the target environment.

Content statusEvaluation guidanceDocumentation versionLatest

Identity integration

Built-in auth, LDAP, Google, and generic OIDC are supported. LDAP group membership can be mapped at sign-in.

Connection security

Proxy TLS validation, SSRF and redirect controls, system proxy, and write-only upstream-secret handling are applied.

Inbound trust boundary

Define canonical HTTPS host, DNS, ingress class, TLS Secret, certificate chain, maximum body size, and long upload or download timeouts together for management UI and API plus package protocols. Validate HTTP-to-HTTPS redirection and proxy-header trust with the target ingress controller.

Identity-provider checklist

For every enabled provider, document owner, secret source, callback or redirect URI, issuer or LDAP endpoint, TLS trust, claim and group mapping, user-disable behavior, and emergency local-admin access.

Successful sign-in and expected local or LDAP group mapping
Controlled rejection for an invalid issuer, state, callback, bind, or certificate
Removal of effective access for a user or group removed from the provider
Observable failure and authorized break-glass procedure during provider outage

Outbound and proxy boundary

Handle package upstreams, OSV sources, LDAP or OIDC, and system-proxy destinations with separate allowlists and DNS or TLS policy. Repository upstream secrets are managed as write-only values; test target connectivity without disabling SSRF, redirect, or TLS-validation controls.

Secret and certificate operations

Application, database, S3, LDAP or OIDC, registry-pull, and TLS material must have separate secret lifecycles. Test rotation order, rollout impact, rollback, and old-credential revocation before production; never write values into values.yaml, logs, or evidence packs.

Connectivity acceptance criteria

For each internal and external connection, successful requests, DNS or TLS failures, timeouts, and authorization denials must be observable. Reconcile application logs, Outbound or Operation records, and ingress or provider evidence over the same time window.