Console and auth

Experimental: fleet-console-auth is not a production-certified identity or authorization service.

fleet-console-auth authenticates console users and authorizes proxied requests to fleet-site (sites, clusters, FleetApp, chart library) and the optional LLM proxy. Its authorization CRDs use console.umkim.com/v1alpha1.

Use the console or an approved API client that obtains a supported session or service-account credential. Do not expose direct upstream endpoints, bypass the proxy, publish credentials, or fabricate identity metadata.

The supported deployment can use a vault-backed break-glass account or LDAP. The current OIDC exchange is incomplete and must not be represented as a complete SSO integration.

Role	Intended scope
dc-admin	Full platform administration, including global LLM API keys
viewer	Read-only access to sites, clusters, apps, charts, infrastructure, and health
site-admin	Site, cluster, FleetApp, and chart library operations
cluster-admin	Cluster and FleetApp operations; chart library is read-only

Scoped roles (site-admin, cluster-admin) use FleetRoleBinding scope without organization partitioning. Organization tenancy (FleetOrg, org-admin, customer) is not part of the current model.

Enrollment is a separate bootstrap flow with its own bearer token; it is not an anonymous public API.

Use narrowly scoped automation credentials, keep them in an approved secret manager, rotate them after use, and validate TLS, session-cookie, firewall, and external-access behavior in the deployment.

The umkim CLI uses the same auth gate (umkim login or a service-account token).