From 79983d1e03bee80c337ec9ed7d5d6527e43fc3bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Fonseca?= <jfonseca@aneo.fr>
Date: Fri, 16 Jan 2026 13:44:18 +0100
Subject: [PATCH 1/2] chore: support enabling authentication in deploy action

---
 deploy/action.yml | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/deploy/action.yml b/deploy/action.yml
index c357ad6..40f4936 100644
--- a/deploy/action.yml
+++ b/deploy/action.yml
@@ -36,6 +36,22 @@ inputs:
     description: "Path to custom client certificate authority"
     required: false
     default: ""
+  require-authentication:
+    description: "Use authentication"
+    required: false
+    default: false
+  require-authorization:
+    description: "Use authorization"
+    required: false
+    default: false
+  trusted-cns:
+    description: "List of trusted common names"
+    required: false
+    default: "[]"
+  auth-datafile:
+    description: "Path to custom authentication configuration data file"
+    required: false
+    default: ""
   working-directory:
     description: "Working directory (should be the ArmoniK repo root folder)"
     required: false
@@ -95,6 +111,10 @@ runs:
         GENCERT: ${{ inputs.generate-client-cert }}
         CUSTOM_CA: ${{ inputs.custom-client-ca }}
         SHARED_HOST: ${{ inputs.shared-data-folder }}
+        AUTHENTICATION: ${{ inputs.require-authentication }}
+        AUTHORIZATION: ${{ inputs.require-authorization }}
+        AUTH_DATAFILE: ${{ inputs.auth-datafile }}
+        TRUSTED_CNS: ${{ inputs.trusted-cns }}
       run: |
         set -ex
         ingress() {
@@ -104,7 +124,8 @@ runs:
           gencert="$3"
           custom_ca="$4"
           if [ "$tls" == "true" ]; then
-            jq --argjson tls "$tls" --argjson mtls "$mtls" --argjson gencert "$gencert" --arg custom_ca "$custom_ca" '.ingress={tls:$tls, mtls:$mtls, generate_client_cert:$gencert, custom_client_ca_file:$custom_ca}' extra.tfvars.json > .extra.tfvars.json
+            jq --argjson tls "$tls" --argjson mtls "$mtls" --argjson gencert "$gencert" --arg custom_ca "$custom_ca" \
+            '.ingress={tls:$tls, mtls:$mtls, generate_client_cert:$gencert, custom_client_ca_file:$custom_ca}' extra.tfvars.json > .extra.tfvars.json
             mv .extra.tfvars.json extra.tfvars.json
           fi
         }
@@ -113,6 +134,19 @@ runs:
           jq --arg shared "$SHARED_HOST" '.shared_storage={host_path:$shared}' extra.tfvars.json > .extra.tfvars.json
           mv .extra.tfvars.json extra.tfvars.json
         fi
+        auth() {
+          local authentication authorization auth_datafile trusted_cns
+          authentication="$1"
+          authorization="$2"
+          auth_datafile="$3"
+          trusted_cns="$4"
+          if [ "$authentication" == "true" ]; then
+            jq --argjson authentication "$authentication" --argjson authorization "$authorization" --arg auth_datafile "$auth_datafile" --arg trusted_cns "$trusted_cns" \
+            '.authentication={require_authentication:$authentication, require_authorization:$authorization, authentication_datafile:$auth_datafile, trusted_common_names:$trusted_cns}' extra.tfvars.json > .extra.tfvars.json
+            mv .extra.tfvars.json extra.tfvars.json
+          fi
+        }
+        auth "$AUTHENTICATION" "$AUTHORIZATION" "$AUTH_DATAFILE" "$TRUSTED_CNS"
     - id: apply
       name: Apply
       shell: bash

From b14bd0fa7de7e3141666e7577864bcca7f2e954a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Fonseca?= <jfonseca@aneo.fr>
Date: Fri, 16 Jan 2026 16:42:23 +0100
Subject: [PATCH 2/2] parse trusted cns as list of strings instead of single
 one

---
 deploy/action.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/action.yml b/deploy/action.yml
index 40f4936..473d173 100644
--- a/deploy/action.yml
+++ b/deploy/action.yml
@@ -45,9 +45,9 @@ inputs:
     required: false
     default: false
   trusted-cns:
-    description: "List of trusted common names"
+    description: "List (of strings) of trusted common names"
     required: false
-    default: "[]"
+    default: '[]'
   auth-datafile:
     description: "Path to custom authentication configuration data file"
     required: false
@@ -139,9 +139,9 @@ runs:
           authentication="$1"
           authorization="$2"
           auth_datafile="$3"
-          trusted_cns="$4"
+          trusted_cns=$4
           if [ "$authentication" == "true" ]; then
-            jq --argjson authentication "$authentication" --argjson authorization "$authorization" --arg auth_datafile "$auth_datafile" --arg trusted_cns "$trusted_cns" \
+            jq --argjson authentication "$authentication" --argjson authorization "$authorization" --arg auth_datafile "$auth_datafile" --argjson trusted_cns "$trusted_cns" \
             '.authentication={require_authentication:$authentication, require_authorization:$authorization, authentication_datafile:$auth_datafile, trusted_common_names:$trusted_cns}' extra.tfvars.json > .extra.tfvars.json
             mv .extra.tfvars.json extra.tfvars.json
           fi