fix(umami): restore dashboard behind SSO by devantler · Pull Request #3813 · devantler-tech/platform

devantler · 2026-09-14T17:33:21Z

Root cause

Umami itself and its CNPG database are healthy. PR #2728 intentionally limited the Flagger-owned public route to /script.js and /api/send to close the default-admin first-boot takeover window. That correctly made / return 404 and disabled the Homepage tile, but #3134's SSO replacement route never landed.

Fix

add a separate / HTTPRoute through oauth2-proxy/Dex and the auth-proxy host router
keep collector endpoints public via the more-specific Flagger route
add the cross-namespace ReferenceGrant and narrow Cilium policy legs
restore exactly one Homepage tile on the authenticated route
add a rendered-manifest regression contract
add a repeatable end-to-end pageview probe that rejects Umami's HTTP-200 bot-discard response and requires the post-persistence session, visit, and cache fields

Verification

RED: FAIL: the SSO-protected Umami dashboard HTTPRoute must be present
GREEN: PASS: Umami collector stays public-only while its dashboard routes through SSO
RED: FAIL: the executable Umami tracking probe must be present
GREEN: PASS: Umami tracking probe distinguishes recorded events from bot discards
live pre-deploy collector baseline: /script.js returns 200 and a synthetic pageview returned session=ab0fbc94-de33-51c4-9347-f74f81120104, visit=9bb30335-586a-5708-8cfb-51ce0153c2d5
ksail workload validate — 120 kustomizations / 644 files
ksail --config ksail.prod.yaml workload validate — 120 kustomizations / 644 files
ksail workload scan --framework nsa
exact-renderer EKS authorization contract
relevant shell security/route tests and shellcheck

Closes #3134

devantler · 2026-09-14T20:35:21Z

@coderabbitai review

coderabbitai · 2026-09-14T20:35:38Z

@devantler I will review the changes in #3813.

✅ Action performed

Review finished.

coderabbitai · 2026-09-14T20:40:30Z

Warning

Review limit reached

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4677eb1c-520d-444b-8abd-4ee560befb84

📥 Commits

Reviewing files that changed from the base of the PR and between 91ad56d and 1a23973.

📒 Files selected for processing (4)

.github/workflows/ci.yaml
scripts/tests/fixtures/umami-curl-stub.sh
scripts/tests/test-umami-tracking-probe.sh
scripts/verify-umami-tracking.sh

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 64b72d79-b3cc-44a7-ad5e-937cd0c2133c

📥 Commits

Reviewing files that changed from the base of the PR and between bd0b2ad and 91ad56d.

📒 Files selected for processing (9)

.github/workflows/ci.yaml
k8s/bases/apps/umami/canary.yaml
k8s/bases/apps/umami/cilium-network-policy.yaml
k8s/bases/apps/umami/http-route-dashboard.yaml
k8s/bases/apps/umami/kustomization.yaml
k8s/bases/infrastructure/controllers/auth-proxy/cilium-network-policy.yaml
k8s/bases/infrastructure/controllers/auth-proxy/config-map.yaml
k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml
scripts/tests/test-umami-sso-dashboard-route.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2026-08-11T12:41:28.242Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3082
File: k8s/bases/infrastructure/controllers/coroot/cron-job-cnpg-degraded-alert.yaml:113-120
Timestamp: 2026-08-11T12:41:28.242Z
Learning: When changing behavior in Kubernetes manifests or related documentation, review comments and documentation in YAML/YML and Markdown files for statements describing the previous behavior. Update every stale statement in the same change so the repository’s explanatory text remains consistent with the implementation.

Applied to files:

k8s/bases/apps/umami/canary.yaml

📚 Learning: 2026-08-10T13:01:12.782Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3057
File: .github/workflows/ci.yaml:622-659
Timestamp: 2026-08-10T13:01:12.782Z
Learning: Repository shell tests and scripts must remain compatible with macOS Bash 3.2. Do not use Bash 4+ features such as `mapfile`; use portable constructs, such as a `while IFS= read -r` loop, instead.

Applied to files:

scripts/tests/test-umami-sso-dashboard-route.sh

🔇 Additional comments (9)

📝 Walkthrough

Walkthrough

The change adds a separate analytics.${domain} HTTPRoute for the Umami dashboard. All dashboard paths route through oauth2-proxy, while the collector route remains public only for /script.js and /api/send. Auth-proxy routing, cross-namespace authorization, and Cilium policies allow the protected path to reach Umami. A rendered-manifest test verifies these boundaries and runs in Kubernetes validation.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 91ad5

The dashboard route preserves the public collector boundary while adding the authenticated path and its required connectivity configuration. No actionable merge risk remains.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	❌ Error	The PR implements the separate `umami-dashboard` `HTTPRoute` through `oauth2-proxy`, restores the Homepage tile, adds the `ReferenceGrant`, auth-proxy routing, and Cilium rules. The Flagger-owned coll…	Add a reviewable end-to-end validation that sends a real Umami tracking event through `/script.js` and `/api/send`, then verifies that the event is recorded. Run this validation after the SSO dashboard route change.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (8 skipped: 8 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changed workflow, manifests, auth-proxy configuration, network policies, `ReferenceGrant`, Homepage annotations, and route regression test all support issue `#3134`. No unrelated change is demonstra…
Title check	✅ Passed	The title clearly and concisely states that the Umami dashboard is restored behind SSO, which matches the main change.
Description check	✅ Passed	The description directly explains the root cause, SSO routing fix, collector-route behavior, security changes, and validation for the changeset.

Full details: Linked Issues check

Explanation

The PR implements the separate umami-dashboard HTTPRoute through oauth2-proxy, restores the Homepage tile, adds the ReferenceGrant, auth-proxy routing, and Cilium rules. The Flagger-owned collector remains limited to /script.js and /api/send. The new scripts/tests/test-umami-sso-dashboard-route.sh checks rendered manifests and security rules. It does not send a tracking event or verify that a real event is recorded. Therefore, the end-to-end tracking requirement in issue #3134 is not met.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (8 skipped: 8 unsupported.)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-09-14T20:52:45Z

Addressed the Linked Issues finding at dbab274a222e05f251fc09c1841f1ef48ed9a66c.

added scripts/verify-umami-tracking.sh, which sends a real pageview to /api/send and requires Umami's post-persistence cache, session, and visit fields
rejects the HTTP-200 {"beep":"boop"} bot-discard response
added stubbed success, discard, payload, missing-value, and malformed-UUID regression coverage to CI
verified the live collector baseline: /script.js returned 200 and the probe returned session ab0fbc94-de33-51c4-9347-f74f81120104, visit 9bb30335-586a-5708-8cfb-51ce0153c2d5

The same committed probe will be rerun after the SSO route is deployed.

devantler · 2026-09-14T21:17:56Z

@coderabbitai review

coderabbitai · 2026-09-14T21:18:16Z

@devantler I will review the changes in #3813.

⚠️ Action not completed

Review rate limited.

devantler · 2026-09-14T21:22:30Z

@codex review for the SSO-only Umami dashboard route, collector path precedence, Cilium connectivity, and recorded-event probe

chatgpt-codex-connector · 2026-09-14T21:22:52Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T21:25:33.214402Z	`1a23973`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-09-14T21:25:31Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 1a23973023

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

devantler · 2026-09-14T21:26:33Z

Readiness — `1a2397302332d3be4306d4f0053b38ceaaba8642`

hosted CI: 24 passed, 0 failed; full manifest validation completed in 10m23s
rendered contract: PASS: Umami collector stays public-only while its dashboard routes through SSO
event-probe contract: PASS: Umami tracking probe distinguishes recorded events from bot discards
live collector baseline: /script.js returned 200 and the synthetic pageview returned session ab0fbc94-de33-51c4-9347-f74f81120104, visit 9bb30335-586a-5708-8cfb-51ce0153c2d5
security/config validation: local and production KSail renders, Kubescape, production authorization, CodeQL, dependency review, and workflow scanning passed
review: CodeRabbit reviewed the original nine-file routing change with no actionable comments; its current-head request was rate-limited, then Codex completed a clean review explicitly at 1a23973023
hygiene: 0 unresolved review threads; mergeable and clean against current main

The SSO dashboard route is GitOps configuration and cannot become externally observable before the merge-group deployment. After deployment I will verify the live HTTPRoute conditions, the Dex redirect, the restored Homepage entry, the still-public collector paths, and a newly recorded event with the committed probe.

devantler · 2026-09-14T21:49:33Z

Production verification

Merge-group revision 70e2142adb923bd90727ccae07ffd9238e0715d6 deployed successfully in run 34899141603.

HTTPRoute/umami-dashboard: Accepted=True, ResolvedRefs=True
Homepage discovery annotation is live as gethomepage.dev/enabled=true
oauth2-proxy ReferenceGrant includes namespace umami
both Cilium policy legs are present; Umami app pods remain 2/2 Running and CNPG remains 3/3 Running
unauthenticated https://analytics.platform.devantler.tech/ returns 302 to Dex instead of the former 404
authenticated browser reaches Umami's login surface at /login
Homepage visibly renders Analytics → Umami after a hard refresh
collector remains public: /script.js returns 200
committed post-deploy probe: PASS: Umami recorded synthetic pageview session=ab0fbc94-de33-51c4-9347-f74f81120104 visit=8667eb5f-8130-5099-951d-040627a5aa26

fix(umami): restore dashboard behind SSO

91ad56d

github-project-automation Bot added this to 🌊 Project Board Sep 14, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Sep 14, 2026

test(umami): add end-to-end tracking probe

dbab274

fix(ci): satisfy shellcheck in umami probe

1a23973

devantler marked this pull request as ready for review September 14, 2026 21:26

devantler added this pull request to the merge queue Sep 14, 2026

Merged via the queue into main with commit 70e2142 Sep 14, 2026
30 checks passed

devantler deleted the codex/umami-sso-dashboard-3134 branch September 14, 2026 21:42

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Sep 14, 2026

devantler mentioned this pull request Sep 25, 2026

fix(auth): deep links lose path and query through the oauth2-proxy login redirect #3169

Closed

4 tasks

Conversation

devantler commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Fix

Verification

Uh oh!

devantler commented Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Pre-merge checks failed

❌ Failed checks (1 error, 1 warning)

Uh oh!

devantler commented Sep 14, 2026

Uh oh!

devantler commented Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Sep 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Sep 14, 2026

Uh oh!

devantler commented Sep 14, 2026

Readiness — 1a2397302332d3be4306d4f0053b38ceaaba8642

Uh oh!

Uh oh!

devantler commented Sep 14, 2026

Production verification

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devantler commented Sep 14, 2026 •

edited

Loading

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 14, 2026 •

edited

Loading

Readiness — `1a2397302332d3be4306d4f0053b38ceaaba8642`