ProxyAuthK8s

ProxyAuthK8S is part of the Weebo SI project. It exposes Kubernetes API servers behind a single authenticating proxy, with a focus on security and ease of use, and makes it easy to share kubeconfig files between users and teams.

Documentation (French): https://batleforc.github.io/ProxyAuthK8S/

More screenshots, in both themes, on the Dashboard page of the documentation.

Features

• One entry point for many clusters: each target cluster is a ProxyKubeApi resource, reconciled by the built-in controller (expose a cluster).
• OIDC login for the UI and the CLI, with per-cluster group restrictions (security model).
• kubectl proxyauth plugin: login, credential plugin and kubeconfig generation (kubectl plugin).
• Request policy: allow-listed resources, port-forward port filtering, rate limiting, fail2login and an audit event per proxied request.
• Virtual APIs, such as OpenShift project discovery (virtual APIs).
• Web UI listing the clusters you can reach and their kubeconfig, on the BatleHub design system: light and dark themes, English and French, WCAG 2.2 AA, and a strict Content-Security-Policy built at container start.

Install

Two Helm charts are published as OCI artifacts: the CRDs, then the application.

helm upgrade --install proxyauthk8s-crd \
  oci://ghcr.io/batleforc/proxyauthk8s/chart-crd:<version> --namespace <ns>
helm upgrade --install proxyauthk8s \
  oci://ghcr.io/batleforc/proxyauthk8s/chart:<version> --namespace <ns> \
  --values proxyauthk8s-values.yaml

The Quick start covers Redis, the values file and a first cluster; the Helm chart page lists every value. The kubectl plugin installs with mise (mise use -g github:batleforc/ProxyAuthK8S) or from the release archive; see the kubectl plugin page.

Put an ingress or reverse proxy (TLS termination) in front of ProxyAuthK8S.

Architecture

flowchart LR
  UF[Web user] --> UI
  UC[CLI user] --> BE

  subgraph PX[ProxyAuthK8S]
    UI[ProxyAuthK8S UI]
    BE[Backend + controller]
    R[(Redis)]
  end

  UI --> BE
  BE <--> R
  BE <--> KC[(Host cluster: ProxyKubeApi CRDs, Lease)]
  BE <--> IDP[Identity providers]
  BE --> KX[Target Kubernetes clusters]

Local development

The local stack (Traefik, Redis, an OIDC provider and a k3d cluster) is described in the developer guide. Authelia is the default identity provider; Keycloak and Dex are documented there as alternatives.

Roadmap

The roadmap (done, in progress and planned work) is maintained in a single place: the Roadmap page of the documentation (source: docs/content/docs/roadmap.mdx). Design decisions are written as RFCs in .rfc/.

Contributing, security and license

• Contributing
• Security policy
• Licensed under the GNU GPL v3.0.