Skip to content

Commit 9c1f722

Browse files
tisniktisnik
authored
Merge pull request #1897 from tisnik/lcore-1356-updated-config-docs
LCORE-1356: Updated config docs
2 parents c9f7cdd + b916612 commit 9c1f722

3 files changed

Lines changed: 150 additions & 10 deletions

File tree

‎docs/config.html‎

Lines changed: 63 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,11 @@ <h2 id="authenticationconfiguration">AuthenticationConfiguration</h2>
381381
<td/>
382382
<td/>
383383
</tr>
384+
<tr class="even">
385+
<td>trusted_proxy_config</td>
386+
<td/>
387+
<td/>
388+
</tr>
384389
</tbody>
385390
</table>
386391
<h2 id="authorizationconfiguration">AuthorizationConfiguration</h2>
@@ -464,7 +469,8 @@ <h2 id="byokrag">ByokRag</h2>
464469
<tr class="even">
465470
<td>rag_type</td>
466471
<td>string</td>
467-
<td>Type of RAG database.</td>
472+
<td>Type of RAG database (e.g.&#xA0;&#x2018;inline::faiss&#x2019;,
473+
&#x2018;remote::pgvector&#x2019;).</td>
468474
</tr>
469475
<tr class="odd">
470476
<td>embedding_model</td>
@@ -484,7 +490,7 @@ <h2 id="byokrag">ByokRag</h2>
484490
<tr class="even">
485491
<td>db_path</td>
486492
<td>string</td>
487-
<td>Path to RAG database.</td>
493+
<td>Path to RAG database. Required for inline::faiss.</td>
488494
</tr>
489495
<tr class="odd">
490496
<td>score_multiplier</td>
@@ -1993,6 +1999,61 @@ <h2 id="tlsconfiguration">TLSConfiguration</h2>
19931999
</tr>
19942000
</tbody>
19952001
</table>
2002+
<h2 id="trustedproxyconfiguration">TrustedProxyConfiguration</h2>
2003+
<p>Configuration for trusted-proxy auth module.</p>
2004+
<table>
2005+
<colgroup>
2006+
<col style="width: 26%"/>
2007+
<col style="width: 23%"/>
2008+
<col style="width: 50%"/>
2009+
</colgroup>
2010+
<thead>
2011+
<tr class="header">
2012+
<th>Field</th>
2013+
<th>Type</th>
2014+
<th>Description</th>
2015+
</tr>
2016+
</thead>
2017+
<tbody>
2018+
<tr class="odd">
2019+
<td>user_header</td>
2020+
<td>string</td>
2021+
<td>HTTP header containing the forwarded user identity.</td>
2022+
</tr>
2023+
<tr class="even">
2024+
<td>allowed_service_accounts</td>
2025+
<td>array</td>
2026+
<td>Optional allowlist of Kubernetes ServiceAccount identities permitted
2027+
to act as trusted proxies. When set to null/omitted, any ServiceAccount
2028+
with a valid token is accepted. When set to a non-empty list, only the
2029+
listed ServiceAccounts are allowed. An empty list behaves the same as
2030+
null (no restriction).</td>
2031+
</tr>
2032+
</tbody>
2033+
</table>
2034+
<h2 id="trustedproxyserviceaccount">TrustedProxyServiceAccount</h2>
2035+
<p>A Kubernetes ServiceAccount identity for trusted-proxy allowlist.</p>
2036+
<table>
2037+
<thead>
2038+
<tr class="header">
2039+
<th>Field</th>
2040+
<th>Type</th>
2041+
<th>Description</th>
2042+
</tr>
2043+
</thead>
2044+
<tbody>
2045+
<tr class="odd">
2046+
<td>namespace</td>
2047+
<td>string</td>
2048+
<td>Kubernetes namespace of the ServiceAccount.</td>
2049+
</tr>
2050+
<tr class="even">
2051+
<td>name</td>
2052+
<td>string</td>
2053+
<td>Name of the Kubernetes ServiceAccount.</td>
2054+
</tr>
2055+
</tbody>
2056+
</table>
19962057
<h2 id="userdatacollection">UserDataCollection</h2>
19972058
<p>User data collection configuration.</p>
19982059
<table>

‎docs/config.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,17 @@
246246
}
247247
],
248248
"default": null
249+
},
250+
"trusted_proxy_config": {
251+
"anyOf": [
252+
{
253+
"$ref": "#/components/schemas/TrustedProxyConfiguration"
254+
},
255+
{
256+
"type": "null"
257+
}
258+
],
259+
"default": null
249260
}
250261
},
251262
"title": "AuthenticationConfiguration",
@@ -1628,6 +1639,49 @@
16281639
"title": "TLSConfiguration",
16291640
"type": "object"
16301641
},
1642+
"TrustedProxyConfiguration": {
1643+
"additionalProperties": false,
1644+
"description": "Configuration for trusted-proxy auth module.",
1645+
"properties": {
1646+
"user_header": {
1647+
"default": "X-Forwarded-User",
1648+
"description": "HTTP header containing the forwarded user identity.",
1649+
"title": "User identity header",
1650+
"type": "string"
1651+
},
1652+
"allowed_service_accounts": {
1653+
"type": "array",
1654+
"nullable": true,
1655+
"default": null,
1656+
"description": "Optional allowlist of Kubernetes ServiceAccount identities permitted to act as trusted proxies. When set to null/omitted, any ServiceAccount with a valid token is accepted. When set to a non-empty list, only the listed ServiceAccounts are allowed. An empty list behaves the same as null (no restriction).",
1657+
"title": "Allowed service accounts"
1658+
}
1659+
},
1660+
"title": "TrustedProxyConfiguration",
1661+
"type": "object"
1662+
},
1663+
"TrustedProxyServiceAccount": {
1664+
"additionalProperties": false,
1665+
"description": "A Kubernetes ServiceAccount identity for trusted-proxy allowlist.",
1666+
"properties": {
1667+
"namespace": {
1668+
"description": "Kubernetes namespace of the ServiceAccount.",
1669+
"title": "Namespace",
1670+
"type": "string"
1671+
},
1672+
"name": {
1673+
"description": "Name of the Kubernetes ServiceAccount.",
1674+
"title": "Name",
1675+
"type": "string"
1676+
}
1677+
},
1678+
"required": [
1679+
"namespace",
1680+
"name"
1681+
],
1682+
"title": "TrustedProxyServiceAccount",
1683+
"type": "object"
1684+
},
16311685
"UserDataCollection": {
16321686
"additionalProperties": false,
16331687
"description": "User data collection configuration.",

‎docs/config.md‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ Authentication configuration.
113113
| jwk_config | | |
114114
| api_key_config | | |
115115
| rh_identity_config | | |
116+
| trusted_proxy_config | | |
116117

117118

118119
## AuthorizationConfiguration
@@ -149,17 +150,17 @@ BYOK (Bring Your Own Knowledge) RAG configuration.
149150
| Field | Type | Description |
150151
|---------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
151152
| rag_id | string | Unique RAG ID |
152-
| rag_type | string | Type of RAG database. |
153+
| rag_type | string | Type of RAG database (e.g. 'inline::faiss', 'remote::pgvector'). |
153154
| embedding_model | string | Embedding model identification |
154155
| embedding_dimension | integer | Dimensionality of embedding vectors. |
155156
| vector_db_id | string | Vector database identification. |
156-
| db_path | string | Path to RAG database. |
157-
| score_multiplier | number | Multiplier applied to relevance scores from this vector store. Used to weight results when querying multiple knowledge sources. Values > 1 boost this store's results; values < 1 reduce them. |
158-
| host | string | PostgreSQL host for remote::pgvector. Defaults to ${env.POSTGRES_HOST} when rag_type is remote::pgvector. |
159-
| port | string | PostgreSQL port for remote::pgvector. Defaults to ${env.POSTGRES_PORT} when rag_type is remote::pgvector. |
160-
| db | string | PostgreSQL database name for remote::pgvector. Defaults to ${env.POSTGRES_DATABASE} when rag_type is remote::pgvector. |
161-
| user | string | PostgreSQL user for remote::pgvector. Defaults to ${env.POSTGRES_USER} when rag_type is remote::pgvector. |
162-
| password | string | PostgreSQL password for remote::pgvector. Defaults to ${env.POSTGRES_PASSWORD} when rag_type is remote::pgvector. |
157+
| db_path | string | Path to RAG database. Required for inline::faiss. |
158+
| score_multiplier | number | Multiplier applied to relevance scores from this vector store. Used to weight results when querying multiple knowledge sources. Values > 1 boost this store's results; values < 1 reduce them. |
159+
| host | string | PostgreSQL host for remote::pgvector. Defaults to ${env.POSTGRES_HOST} when rag_type is remote::pgvector. |
160+
| port | string | PostgreSQL port for remote::pgvector. Defaults to ${env.POSTGRES_PORT} when rag_type is remote::pgvector. |
161+
| db | string | PostgreSQL database name for remote::pgvector. Defaults to ${env.POSTGRES_DATABASE} when rag_type is remote::pgvector. |
162+
| user | string | PostgreSQL user for remote::pgvector. Defaults to ${env.POSTGRES_USER} when rag_type is remote::pgvector. |
163+
| password | string | PostgreSQL password for remote::pgvector. Defaults to ${env.POSTGRES_PASSWORD} when rag_type is remote::pgvector. |
163164

164165

165166
## CORSConfiguration
@@ -750,6 +751,30 @@ Useful resources:
750751
| tls_key_password | string | Path to file containing the password to decrypt the SSL/TLS private key. |
751752

752753

754+
## TrustedProxyConfiguration
755+
756+
757+
Configuration for trusted-proxy auth module.
758+
759+
760+
| Field | Type | Description |
761+
|--------------------------|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
762+
| user_header | string | HTTP header containing the forwarded user identity. |
763+
| allowed_service_accounts | array | Optional allowlist of Kubernetes ServiceAccount identities permitted to act as trusted proxies. When set to null/omitted, any ServiceAccount with a valid token is accepted. When set to a non-empty list, only the listed ServiceAccounts are allowed. An empty list behaves the same as null (no restriction). |
764+
765+
766+
## TrustedProxyServiceAccount
767+
768+
769+
A Kubernetes ServiceAccount identity for trusted-proxy allowlist.
770+
771+
772+
| Field | Type | Description |
773+
|-----------|--------|---------------------------------------------|
774+
| namespace | string | Kubernetes namespace of the ServiceAccount. |
775+
| name | string | Name of the Kubernetes ServiceAccount. |
776+
777+
753778
## UserDataCollection
754779

755780

0 commit comments

Comments
 (0)