feat: make OIDC passThroughAuthHeader and refreshToken configurable#430
Merged
jmpalomares merged 3 commits intoApr 27, 2026
Merged
Conversation
Expose envoy.security.passThroughAuthHeader and envoy.security.refreshToken (also per-policy) so services can match the proven graylog OIDC setup. Defaults change to passThroughAuthHeader: false and refreshToken: true, which rejects unauthenticated requests at the gateway and keeps sessions alive via refresh tokens. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Restore the previous hardcoded behavior as the default so that existing services opt in to false explicitly when needed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR makes Envoy Gateway OIDC passThroughAuthHeader and refreshToken configurable (globally and per-policy) in the shared SecurityPolicy template, and bumps chart versions to publish the change.
Changes:
- Add configurable
envoy.security.passThroughAuthHeader/envoy.security.refreshTokenwith per-policy overrides in the common SecurityPolicy template. - Change rendered defaults to
passThroughAuthHeader: falseandrefreshToken: true. - Bump chart versions:
common 1.3.6 → 1.3.7,microservice 0.5.6 → 0.5.7,monolith 0.5.7 → 0.5.8.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| parcellab/common/templates/_securitypolicies.tpl | Introduces per-policy/global config for OIDC passThroughAuthHeader and refreshToken, and renders them into the SecurityPolicy OIDC spec. |
| parcellab/common/Chart.yaml | Bumps common library chart version to release the template change. |
| parcellab/microservice/Chart.yaml | Bumps microservice chart version to consume the updated common chart. |
| parcellab/monolith/Chart.yaml | Bumps monolith chart version to consume the updated common chart. |
- Treat explicit null passThroughAuthHeader / refreshToken as unset so Helm does not render "<no value>" and break the SecurityPolicy YAML. - Add commented examples for the new settings in microservice and monolith values.yaml. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kpplis
approved these changes
Apr 27, 2026
andibeuge
approved these changes
Apr 27, 2026
jmpalomares
deleted the
chore/configurable-oidc-passthrough-refreshtoken
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
envoy.security.passThroughAuthHeaderandenvoy.security.refreshToken(also per-policy viaenvoy.security.policies[].*) in the commonSecurityPolicytemplate so services can match the proven graylog OIDC setup.passThroughAuthHeader: true/refreshToken: trueto preserve prior behavior. Services hitting "JWT is missing" (e.g. arena) can opt intopassThroughAuthHeader: falseso unauthenticated requests are rejected at the gateway instead of forwarded.common 1.3.6 → 1.3.7,microservice 0.5.6 → 0.5.7,monolith 0.5.7 → 0.5.8.Test plan
helm lint parcellab/microservicepasseshelm templatewith default values renderspassThroughAuthHeader: trueandrefreshToken: truehelm templatewith explicit overrides renders the supplied valuesmicroservice 0.5.7+passThroughAuthHeader: falseand confirm OIDC login works end-to-end🤖 Generated with Claude Code