README:
- The InfluxDB/Prometheus metric backends described in the overview do not
exist; describe the built-in metric store and the external cc-metric-store
routing instead.
- The demo instructions still told the reader to add cluster entries to
config.json. Clusters come from the cluster.json in each job archive
directory.
- Dead link to docs/JWT-Handling.md (there is no docs/ directory), configs/
described as holding environment-variable documentation, missing tools, OIDC
missing from the list of authentication methods, and web/ indented as a child
of tools/ in the project structure.
- Added a Configuration section: the top-level sections and which are required,
the "-file" indirection, and how unknown keys are handled per section.
ReleaseNotes: the 1.6.0 entry covered only the session backend and none of the
breaking changes. Added the .env removal, the policy-based resampling config
(configs carrying trigger/resolutions/minimum-points now abort), the switch to
average downsampling, the OIDC role-mapping requirement, LDAP role-filters, the
auth schema now actually validating, and the new features and bug fixes since
v1.5.4. Fixed the clusterockpit.org typo and marked the 1.5.2 known-issues list
as belonging to that release.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Browser sessions are now server-side, stored in the SQLite database via
scs/sqlite3store (new `sessions` table, DB migration to version 12) instead
of gorilla/sessions client-side cookie storage. Only an opaque random token
is kept in the cookie; session data lives server-side and survives restarts.
Session middleware is wired as a hybrid to avoid buffering large responses:
scs.LoadAndSave on the login/logout write paths, and a non-buffering
read-only LoadSession middleware on the secured/config/frontend read paths
so the large GraphQL /query responses stream unbuffered. JWT-only APIs
(/api, /userapi, /api/metricstore) and static files are left unwrapped.
The session cookie Secure flag is now derived from the server config (set
when cc-backend terminates TLS itself); previously it was effectively never
set. The SESSION_KEY env var is removed as server-side tokens need no
signing secret. The dormant Bearer-JWT branch in the frontend urql client
is removed; the web UI authenticates GraphQL via the session cookie.
Closes#558
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: b51075f43cc7
moebiusbandandClaude Opus 5
Christoph Kluge