Issue with Dashboard Authentication on Self-Managed Airbyte

Slack Knowledge Base Q&A API, Terraform and Other Topics
, , , ,
1

Summary

User is experiencing a 401 error when attempting to log in to the Airbyte dashboard after enabling authentication with Kubernetes secrets in a Helm deployment on GCP. The user has tried disabling secure cookies and is seeking assistance in troubleshooting the issue.


Question

Hello all, I’ve an issue when setting up dashboard authentication on a self-managed Airbyte deployed through Helm v1.2.0 on GCP : I’ve enabled authentication in values, set emailSecretKey & passwordSecretKey with kubernetes secrets but when I try to login on dashboard (either on localhost with port-forwarding or using external load balancer IP) with the email/password set in secrets I get a 401 error. I also tried disabling secure cookies to discard the option where it would be due to the fact i’m not using HTTPS yet but I have still the same issue.
I’ve been through a lot of issues/thread but could not find a solution, would someone have an idea of what’s the issue ? :pray:


This topic has been created from a Slack thread to give it more visibility.
It will be on Read-Only mode here. Click here if you want
to access the original thread.

Join the conversation on Slack

['dashboard-authentication', 'helm', 'kubernetes', 'gcp', '401-error']
2

Have you run consecutive updates with helm upgrade ... or always full cleanup and fresh installation with helm install?

3

Have you run consecutive updates with helm upgrade ... or always full cleanup and fresh installation with helm install?

4

Thanks for your answer, yes I tried both, upgrade and uninstalling the whole thing and reinstalling with helm install but I still cannot login

5

Here is my auth config in values.yml if it helps

  auth:
    enabled: true
    instanceAdmin:
      secretName: "airbyte-config-secrets"
      firstName: "Airbyte"
      lastName: "Admin"
      emailSecretKey: "ADMIN_EMAIL"
      passwordSecretKey: "ADMIN_PASSWORD"```
6

okay, and how does definition of airbyte-config-secrets secret look like?

7

Like this

kind: Secret
metadata:
  name: airbyte-config-secrets
type: Opaque
stringData:
  ADMIN_EMAIL: <ADMIN_EMAIL>
  ADMIN_PASSWORD: <ADMIN_PASSWORD>
  DATABASE_USER: <DATABASE_USER>
  DATABASE_PASSWORD: <DATABASE_PASSWORD>```
Also I just tried to remove authentication to test other features and I cannot open source/destination pages because of an API error so it seems something's wrong globally with the API side of the setup
8

Can you compare password that you set in secret with the one in environment variable
kubectl exec -it $(kubectl get pods -l <http://app.kubernetes.io/name=server|app.kubernetes.io/name=server> -o jsonpath="{.items[0].metadata.name}") -- env | grep "AB_INSTANCE_ADMIN_PASSWORD"?

9

As I checked, email from secret/values.yaml is used probably only for enterprise https://github.com/airbytehq/airbyte-platform/blob/f73b1387aae00ef0528c3ceb8800f48f29b77195/charts/airbyte/templates/_enterprise.tpl#L39

10

The command above does not return anything, I checked by removing the grep part and indeed there is no envvar named AB_INSTANCE_ADMIN_PASSWORD in my server

11

Ok it was because auth was still disabled, after enabling it again I see a value for AB_INSTANCE_ADMIN_PASSWORD but indeed it’s not the one in my secrets. But when I use it I can login !

12

It’s good to know that the password from this environment variable worked :slightly_smiling_face:

13

Yes thanks a lot ! I’ll try to understand why I get errors in dashboard now :stuck_out_tongue:

14

https://github.com/airbytehq/airbyte-platform/blob/f73b1387aae00ef0528c3ceb8800f48f29b77195/charts/airbyte-server/templates/deployment.yaml#L222-L226|https://github.com/airbytehq/airbyte-platform/blob/f73b1387aae00ef0528c3ceb8800f48f29b77195/charts/airbyte-server/templates/deployment.yaml#L2[…]226

15

indentation matters

  auth:
    enabled: true
    instanceAdmin:
      secretName: "airbyte-config-secrets"```
```global:
  auth:
    enabled: true
    secretName: "airbyte-config-secrets"```
16

it would be nice to have some validator for values.yaml to easier spot issues

17

Oh you’re right, it’s not nested in instanceAdmin :astonished:
I was mislead by airbyte helm chart default value file that was showing the version I used : https://github.com/airbytehq/airbyte-platform/blob/main/charts/airbyte/values.yaml#L42

18

I didn’t find a better “documentation” for possible values than this file but maybe there is a better place where I can see all possible options and how they could be configured ?

19

every time I need to check specific helm chart I go to https://github.com/airbytehq/helm-charts and extract archive for the version I need
there are READMEs in helm charts, and most of the time they are useful as descriptions for different options, but when I need to be sure then I check values.yaml and check references to keys

20

Ok, good to know thanks