From 5dba924d676dc79870949f0d9e0bd3ae32071d8b Mon Sep 17 00:00:00 2001 From: Kaio Oliveira Date: Mon, 23 Mar 2026 17:31:26 -0300 Subject: [PATCH 1/2] fix: gate RESOURCE_SERVER and local resource management on gateway presence EDA server defaults `RESOURCE_SERVER__URL` to `"https://localhost"`, which causes `apply_resource_server_auth` to unconditionally restrict authentication to JWT-only, breaking session-based login for standalone deployments. This was introduced by the gateway-only auth enforcing, whenever `RESOURCE_SERVER__URL` is truthy. Development mode is unaffected because development_defaults.py sets it to None [3]. We now use `public_base_url` (the same mechanism other operators use) to detect gateway presence and explicitly configure standalone deployments in the ConfigMap. It should unblock access to the UI when deploying the EDA operator in standalone mode. --- roles/eda/templates/eda.configmap.yaml.j2 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/eda/templates/eda.configmap.yaml.j2 b/roles/eda/templates/eda.configmap.yaml.j2 index 55f62f7b..f8b2f741 100644 --- a/roles/eda/templates/eda.configmap.yaml.j2 +++ b/roles/eda/templates/eda.configmap.yaml.j2 @@ -34,6 +34,12 @@ data: EDA_STATIC_URL: /api/eda/static/ + # Resource Server configuration +{% if not (public_base_url | default('') | length > 0) %} + EDA_RESOURCE_SERVER__URL: "" + EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT: "True" +{% endif %} + # Custom user variables {% for item in extra_settings | default([]) %} {{ item.setting | upper }}: "{{ item.value }}" From 7b7b837e059e0d86a3b905a3f9f7132614bdd4f8 Mon Sep 17 00:00:00 2001 From: Kaio Oliveira Date: Mon, 24 Aug 2026 21:01:26 -0300 Subject: [PATCH 2/2] fix: guard resource server config against extra_settings duplicates Address review feedback: build a list of user-declared settings and skip emitting EDA_RESOURCE_SERVER__URL / EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT when the user already provides them via extra_settings. Also simplify the double-negative condition to a positive length == 0 check. Drop the now-redundant EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT entries from all bundled dev CR samples and update the README to reflect that the operator auto-configures standalone deployments. Co-authored-by: Claude --- README.md | 6 ++++-- dev/eda-cr/eda-k8s-ing.yml | 2 -- dev/eda-cr/eda-k8s-nodeport-cr.yml | 2 -- dev/eda-cr/eda-openshift-cr.yml | 2 -- dev/eda-cr/eda-resource-quota-cr.yml | 4 ---- dev/eda-cr/lightweight-eda.yml | 2 -- roles/eda/templates/eda.configmap.yaml.j2 | 7 ++++++- 7 files changed, 10 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index e5392ca3..11014e49 100644 --- a/README.md +++ b/README.md @@ -187,7 +187,9 @@ stringData: ### Allow Local Resource Management -Resources such as users, teams, or organizations are recommended to be managed by the *Platform Provider*. Flag `EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT` can be toggled to instruct whether EDA can create/modify/delete these resources. The following example allows EDA to manage such resources. It is necessary when EDA is deployed alone. +Resources such as users, teams, or organizations are recommended to be managed by the *Platform Provider*. When EDA is deployed standalone (without `public_base_url`), the operator automatically sets `EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT` to `True` and clears `EDA_RESOURCE_SERVER__URL`, enabling local user/team/organization management and session-based login. + +If you need to override this behavior in a standalone deployment, use `extra_settings`: ```yaml apiVersion: eda.ansible.com/v1alpha1 @@ -197,7 +199,7 @@ metadata: spec: extra_settings: - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true + value: false ``` ### Database Fields Encryption Configuration diff --git a/dev/eda-cr/eda-k8s-ing.yml b/dev/eda-cr/eda-k8s-ing.yml index b0dd4fdf..81845bed 100644 --- a/dev/eda-cr/eda-k8s-ing.yml +++ b/dev/eda-cr/eda-k8s-ing.yml @@ -25,8 +25,6 @@ spec: # -- Example extra settings extra_settings: - - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true - setting: DEFAULT_PULL_POLICY value: "Always" diff --git a/dev/eda-cr/eda-k8s-nodeport-cr.yml b/dev/eda-cr/eda-k8s-nodeport-cr.yml index 04107cdd..8f603cd0 100644 --- a/dev/eda-cr/eda-k8s-nodeport-cr.yml +++ b/dev/eda-cr/eda-k8s-nodeport-cr.yml @@ -25,8 +25,6 @@ spec: # -- Example extra settings extra_settings: - - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true - setting: DEFAULT_PULL_POLICY value: "Always" diff --git a/dev/eda-cr/eda-openshift-cr.yml b/dev/eda-cr/eda-openshift-cr.yml index be78079b..41fb8293 100644 --- a/dev/eda-cr/eda-openshift-cr.yml +++ b/dev/eda-cr/eda-openshift-cr.yml @@ -28,8 +28,6 @@ spec: # -- Example extra settings extra_settings: - - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true - setting: DEFAULT_PULL_POLICY value: "Always" diff --git a/dev/eda-cr/eda-resource-quota-cr.yml b/dev/eda-cr/eda-resource-quota-cr.yml index cc6defef..263acd42 100644 --- a/dev/eda-cr/eda-resource-quota-cr.yml +++ b/dev/eda-cr/eda-resource-quota-cr.yml @@ -9,10 +9,6 @@ spec: ingress_type: Route no_log: false image_pull_policy: Always - extra_settings: - - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true - api: replicas: 1 resource_requirements: diff --git a/dev/eda-cr/lightweight-eda.yml b/dev/eda-cr/lightweight-eda.yml index 81cfc70d..d1f08f73 100644 --- a/dev/eda-cr/lightweight-eda.yml +++ b/dev/eda-cr/lightweight-eda.yml @@ -5,8 +5,6 @@ metadata: name: eda spec: extra_settings: - - setting: EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT - value: true - setting: GIT_SSL_NO_VERIFY value: "true" diff --git a/roles/eda/templates/eda.configmap.yaml.j2 b/roles/eda/templates/eda.configmap.yaml.j2 index f8b2f741..ecb439ff 100644 --- a/roles/eda/templates/eda.configmap.yaml.j2 +++ b/roles/eda/templates/eda.configmap.yaml.j2 @@ -35,9 +35,14 @@ data: EDA_STATIC_URL: /api/eda/static/ # Resource Server configuration -{% if not (public_base_url | default('') | length > 0) %} +{% set _user_settings = (extra_settings | default([])) | map(attribute='setting') | map('upper') | list %} +{% if public_base_url | default('') | length == 0 %} +{% if 'EDA_RESOURCE_SERVER__URL' not in _user_settings %} EDA_RESOURCE_SERVER__URL: "" +{% endif %} +{% if 'EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT' not in _user_settings %} EDA_ALLOW_LOCAL_RESOURCE_MANAGEMENT: "True" +{% endif %} {% endif %} # Custom user variables