Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Gap]: Document the complete Connector Gateway deployment contract

Aperta
  • Qualcosa non va?
#1,159 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
helm, kubernetes
Ambito
authentication, devops, documentation, infrastructure

Direzione di ricerca

Inizia da docs/platform/enterprise-platform/configure-connector-gateway.mdx e confrontalo con deployment.mdx, configure-identity.mdx e docs/platform/enterprise-directory/index.mdx, quindi traccia i valori e i commenti di chart a cui si fa riferimento. Documenta una configurazione sicura completa, alternative mirate e verifiche separate per l'accesso, la registrazione del gateway, una chiamata autenticata al control-plane e il data plane di MCP. Il lavoro è completato quando gli operatori possono seguire un'unica checklist supportata senza dover assemblare dettagli del contratto non documentati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

documentation enhancement needs-triage

What needs documentation?

The Configure the Connector Gateway page currently shows only:

  • global.stacklok.connectorGateway.enabled
  • global.stacklok.connectorGatewayId
  • global.stacklok.authServerIssuer

That is not enough to deploy a working Connector Gateway. The chart requires a coupled set of auth-server, incoming-auth, directory, key-management, storage, corporate-IdP, and Enterprise Manager values. Operators currently discover them one failure at a time from Helm errors, pod logs, and the chart's very long values.yaml comments.

Add a complete, task-oriented configuration path that covers at least:

  • vmcpConfig.incomingAuth.type: oidc, issuer, audience/resource, and how those values must match the auth server's allowed_audiences.
  • enterpriseConfig.authServer, including its schema, upstream behavior, storage contract, and the fact that auth-less mode is not supported.
  • kek and authServerKeys, including the production recommendation to use existing Secrets rather than render-unstable generated values.
  • enterpriseConfig.directory.addr and binding claims.
  • The two supported Directory transport arms:
    • production TLS, projected ServiceAccount token, caller issuer/audience, and subject allowlists on Enterprise Manager;
    • the development-only cleartext configuration, which currently requires matching client and server flags.
  • The corporate primary IdP's audience/client requirements for both cloud-ui and the Connector Gateway control plane.
  • The Enterprise Manager platform-admin role/binding required to use the admin connector/directory endpoints. The current directory landing page says "The platform admin grant covers" this work but does not show how to create that grant or identify admin.enterprise.stacklok.com.
  • A verification sequence that tests login, gateway registration, an authenticated control-plane call, and the data-plane MCP endpoint separately.

Prefer one complete secure example, followed by focused alternatives, rather than making readers assemble fragments from component chart comments.

Context and references

This gap surfaced while moving stacklok-enterprise-demo-sandbox to Stacklok Enterprise Platform v0.17.0.

Related platform issues found during the same deployment:

Relevant source pages:

  • docs/platform/enterprise-platform/configure-connector-gateway.mdx
  • docs/platform/enterprise-platform/deployment.mdx
  • docs/platform/enterprise-platform/configure-identity.mdx
  • docs/platform/enterprise-directory/index.mdx

Use case

As a platform operator, I need to enable Connector Gateway from a single supported checklist and understand which values form one contract across the umbrella chart, so that a successful Helm install produces a usable login, control plane, and MCP data plane without iterative crash-loop debugging.

Lingua principale
JavaScript
Stelle
4
Fork
4
Merge medio
1g 1h
PR unite (30g)
58

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stacklok/docs-website

Tutte le issue di stacklok/docs-website

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.