crypto: update certificate api and component#17921
Conversation
✅ Deploy Preview for authentik-docs canceled.
|
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations canceled.
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #17921 +/- ##
==========================================
- Coverage 92.98% 92.92% -0.06%
==========================================
Files 869 869
Lines 47962 48016 +54
==========================================
+ Hits 44596 44618 +22
- Misses 3366 3398 +32
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| public includeDetails = false; | ||
|
|
||
| /** | ||
| * Optional array of allowed key algorithm types to filter certificates. |
There was a problem hiding this comment.
Add comment about performance implications
There was a problem hiding this comment.
I've updated them, let me know what you think
There was a problem hiding this comment.
I know my grammar queen shouldn't get too sharp on comments, but that's... awkward. Maybe something like?
When
allowedKeyTypesis set, only certificates or keypairs with matching key algorithms will be shown. Since certificates must be parsed to extract algorithm details, an instance with many certificates may experience long delays and server performance slowdowns. Avoid setting this field whenever possible.
... which raises the question, @BeryJu: Why isn't that information stored separately from the certificate?
There was a problem hiding this comment.
that's a good idea, we could cache the key/cert data alongside the cert instead of re-parsing it every time
maybe something to look into rather than just having this warning
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-034a9ab2272630d2bf39e06fadd040e93f9857c2
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-034a9ab2272630d2bf39e06fadd040e93f9857c2Afterwards, run the upgrade commands from the latest release notes. |
kensternberg-authentik
left a comment
There was a problem hiding this comment.
I made a suggestion for rewording a comment; that shouldn't delay merging, but if @PeshekDotDev wants to update the comment before the merge, I'd welcome it.
| public includeDetails = false; | ||
|
|
||
| /** | ||
| * Optional array of allowed key algorithm types to filter certificates. |
There was a problem hiding this comment.
I know my grammar queen shouldn't get too sharp on comments, but that's... awkward. Maybe something like?
When
allowedKeyTypesis set, only certificates or keypairs with matching key algorithms will be shown. Since certificates must be parsed to extract algorithm details, an instance with many certificates may experience long delays and server performance slowdowns. Avoid setting this field whenever possible.
... which raises the question, @BeryJu: Why isn't that information stored separately from the certificate?
|
Storing the keytype in the database is something I'm willing to add in a different PR |
* main: webiste/docs: remove broken info box and fix sentence (#17963) web/admin: fixes capitalization in application wizard title (#17959) website/docs: added Note about email_verified scope mapping is set to false by default (#17942) crypto: update certificate api and component (#17921) core: bump openapitools/openapi-diff from 2.1.4 to 2.1.5 in /scripts/api (#17929) ci: bump getsentry/action-release from 3.3.0 to 3.4.0 (#17931) ci: bump helm/kind-action from 1.12.0 to 1.13.0 (#17930) tasks/schedules: fix rel obj not being associated or updated (#17934) core, web: update translations (#17807) brands: sort matched brand by match length (#17920) web: bump the storybook group across 1 directory with 5 updates (#17787) brands: add more matching tests (#16185)
Details
This PR improves how we use the crypto api for certificates, including adding for filtering on the front-end and better typing throughout
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make docs)