[Dashboard] Do not show role column in the user table for basic auth on ingress case (#7811)

do not show role column for basic auth on ingress case

Author: DanielZhangQD

charts/skypilot/templates/api-deployment.yaml

@@ -79,6 +79,10 @@ spec:
         - name: ENABLE_SERVICE_ACCOUNTS
           value: "true"
         {{- end }}
+        {{- if include "skypilot.ingressBasicAuthEnabled" . | trim | eq "true" }}
+        - name: SKYPILOT_INGRESS_BASIC_AUTH_ENABLED
+          value: "true"
+        {{- end }}
         {{- if .Values.gcpCredentials.enabled }}
         - name: GOOGLE_APPLICATION_CREDENTIALS
           value: /root/gcp-cred.json

sky/dashboard/src/components/users.jsx

@@ -257,6 +257,8 @@ export function Users() {
   const [basicAuthEnabled, setBasicAuthEnabled] = useState(undefined);
   const [serviceAccountTokenEnabled, setServiceAccountTokenEnabled] =
     useState(undefined);
+  const [ingressBasicAuthEnabled, setIngressBasicAuthEnabled] =
+    useState(undefined);
   const [healthCheckLoading, setHealthCheckLoading] = useState(true);
   const [activeMainTab, setActiveMainTab] = useState('users');
   const [showCreateDialog, setShowCreateDialog] = useState(false);
@@ -373,13 +375,16 @@ export function Users() {
           const data = await resp.json();
           setBasicAuthEnabled(!!data.basic_auth_enabled);
           setServiceAccountTokenEnabled(!!data.service_account_token_enabled);
+          setIngressBasicAuthEnabled(!!data.ingress_basic_auth_enabled);
         } else {
           setBasicAuthEnabled(false);
           setServiceAccountTokenEnabled(false);
+          setIngressBasicAuthEnabled(false);
         }
       } catch {
         setBasicAuthEnabled(false);
         setServiceAccountTokenEnabled(false);
+        setIngressBasicAuthEnabled(false);
       } finally {
         setHealthCheckLoading(false);
       }
@@ -866,6 +871,7 @@ export function Users() {
           onResetPassword={handleResetPasswordClick}
           onDeleteUser={handleDeleteUserClick}
           basicAuthEnabled={basicAuthEnabled}
+          ingressBasicAuthEnabled={ingressBasicAuthEnabled}
           currentUserRole={userRoleCache?.role}
           currentUserId={userRoleCache?.id}
           filters={filters}
@@ -1289,6 +1295,7 @@ function UsersTable({
   onResetPassword,
   onDeleteUser,
   basicAuthEnabled,
+  ingressBasicAuthEnabled,
   currentUserRole,
   currentUserId,
   filters,
@@ -2027,7 +2034,7 @@ function UsersTable({
                   User ID{getSortDirection('fullEmailID')}
                 </TableHead>
               )}
-              {!deduplicateUsers && (
+              {!deduplicateUsers && !ingressBasicAuthEnabled && (
                 <TableHead
                   onClick={() => requestSort('role')}
                   className="sortable whitespace-nowrap cursor-pointer hover:bg-gray-50 w-1/6"
@@ -2079,7 +2086,7 @@ function UsersTable({
                     {user.fullEmailID}
                   </TableCell>
                 )}
-                {!deduplicateUsers && (
+                {!deduplicateUsers && !ingressBasicAuthEnabled && (
                   <TableCell className="truncate" title={user.role}>
                     <div className="flex items-center gap-2">
                       {editingUserId === user.userId ? (
@@ -2266,6 +2273,7 @@ UsersTable.propTypes = {
   onResetPassword: PropTypes.func.isRequired,
   onDeleteUser: PropTypes.func.isRequired,
   basicAuthEnabled: PropTypes.bool,
+  ingressBasicAuthEnabled: PropTypes.bool,
   currentUserRole: PropTypes.string,
   currentUserId: PropTypes.string,
 };

sky/schemas/api/responses.py

@@ -77,9 +77,13 @@ class APIHealthResponse(ResponseBaseModel):
     version: str = ''
     version_on_disk: str = ''
     commit: str = ''
+    # Whether basic auth on api server is enabled
     basic_auth_enabled: bool = False
     user: Optional[models.User] = None
+    # Whether service account token is enabled
     service_account_token_enabled: bool = False
+    # Whether basic auth on ingress is enabled
+    ingress_basic_auth_enabled: bool = False
 
 
 class StatusResponse(ResponseBaseModel):

sky/server/server.py

@@ -1805,12 +1805,18 @@ async def health(request: fastapi.Request) -> responses.APIHealthResponse:
         version=sky.__version__,
         version_on_disk=common.get_skypilot_version_on_disk(),
         commit=sky.__commit__,
+        # Whether basic auth on api server is enabled
         basic_auth_enabled=os.environ.get(constants.ENV_VAR_ENABLE_BASIC_AUTH,
                                           'false').lower() == 'true',
         user=user if user is not None else None,
+        # Whether service account token is enabled
         service_account_token_enabled=(os.environ.get(
             constants.ENV_VAR_ENABLE_SERVICE_ACCOUNTS,
             'false').lower() == 'true'),
+        # Whether basic auth on ingress is enabled
+        ingress_basic_auth_enabled=os.environ.get(
+            constants.SKYPILOT_INGRESS_BASIC_AUTH_ENABLED,
+            'false').lower() == 'true',
     )
 
 

sky/skylet/constants.py

@@ -474,6 +474,7 @@
 # authentication is enabled in the API server.
 ENV_VAR_ENABLE_BASIC_AUTH = 'ENABLE_BASIC_AUTH'
 SKYPILOT_INITIAL_BASIC_AUTH = 'SKYPILOT_INITIAL_BASIC_AUTH'
+SKYPILOT_INGRESS_BASIC_AUTH_ENABLED = 'SKYPILOT_INGRESS_BASIC_AUTH_ENABLED'
 ENV_VAR_ENABLE_SERVICE_ACCOUNTS = 'ENABLE_SERVICE_ACCOUNTS'
 
 # Enable debug logging for requests.