Repository navigation
Secure the kagent UI #2028
Description
The kagent UI/dashboard is exposed without authentication. We should have a story for securing access to it.
Two things that came up:
- A
HTTPRoute+NetworkPolicyto gate/restrict access. - The OpenShift Route (openshift-route.yaml) renders whenever the
route.openshift.io/v1API is present — there's no value to toggle it off and no auth in front of it, so on OpenShift it's effectively always exposed.
Activity
davidkarlsen commentedon Jun 23, 2026
Linking the two halves of this so they read as one story.
This issue is about exposure — keeping the UI/Route from being reachable with nothing in front of it (HTTPRoute + NetworkPolicy, and the always-on OpenShift Route). That's the edge: authenticate, and don't let traffic bypass the proxy.
The complementary half is authorization — once a user is in, who's allowed to see and invoke which agents. The controller currently ships a no-op authorizer (everyone can do everything), so the edge work above gets you authentication but not access control.
I've posted a concrete design proposal for that half on #1270 — a CEL-based authorizer behind the existing
Authorizerinterface, with per-agent policy on the CR: #1270 (comment)So the full picture: gate + authenticate at the edge (this issue) → authorize per-resource inside the controller (#1270).