Good question. I had expected Product teams to use this more often, but perhaps the ssh tunnel barrier is enough for them to never do so.

Or, perhaps its existence is too hidden in docs and they don't know about it! Let's ask Experimentation Lab and Product-Analytics what they think.

In T348763#10262402, @Ottomata wrote:

@BTullis do you think it would be possible to add authentication and a public domain to this service?

Yes, I think that would be quite feasible. We could use the CAS/SSO implementation and authenticate to it using the OIDC protocol, as we are with Superset and Airflow and DataHub and MPIC.
There would need to be an LDAP group to whom the rights would be given, equivalent to the analytics-privatedata-users POSIX group, I suppose. We are already configuring a number of new LDAP groups with cross-checking in T375729, so I can't see a big problem with this part.

Then the next question would be where to do the authentcation.
We could either:

• add it to the nodejs application natively, using something like angular-auth-oidc-client or openid-client. Looking at it now, I can see that MPIC uses openid-client, so @Sfaci will likely be able to help with this.

...or

• add an authenticating reverse proxy using envoy or some other kind of service.

At first glance, the envoy based solution looks pretty neat and tidy, given that we already have envoy installed in every pod.

In T348763#10262531, @BTullis wrote:

• add an authenticating reverse proxy using envoy or some other kind of service.

At first glance, the envoy based solution looks pretty neat and tidy, given that we already have envoy installed in every pod.

Envoy Gateway is a different thing from Envoy Proxy -- the former is a management layer around the latter. We only run Envoy Proxy.

But we're using oauth2-proxy on k8s in the aux cluster to front trace.wikimedia.org and it's been working fine for that -- link to our config. Other teams also use it on bare metal for access to Thanos and a few other pieces of infra.

In T348763#10262664, @CDanis wrote:

But we're using oauth2-proxy on k8s in the aux cluster to front trace.wikimedia.org and it's been working fine for that -- link to our config. Other teams also use it on bare metal for access to Thanos and a few other pieces of infra.

Nice! Thanks for that info.

Would it be valuable to move MPIC to using oauth2-proxy for consistency with these other systems?