AB#4182: Secure FromHttpRequest trigger node: validate access token and required role

[mmjakubpoddebniak]

Summary

The Communication Operator projects an identity authority into every workload it deploys, and an adapter uses it to validate the bearer tokens that a secured FromHttpRequest@2 route requires. This values file never set one. The operator therefore passed nothing on, each adapter fell back to its compiled-in loopback default, refused to use it, and disabled JWT bearer authentication altogether - so every caller of a secured route was rejected with 401 no matter how valid its token was. The chart has carried operator.authUri since the trigger was secured; only the value was missing here, which is why a freshly installed cluster looked healthy while every authenticated pipeline call failed. Found on a from-scratch 3.4.90 install, where the adapter logged exactly that condition and the route rejected a valid operator token until the authority was supplied.

What changed

• operator.authUri is set to https://identity.127-0-0-1.nip.io, the same public identity URI reporting-values.yaml in this repo already uses, so the value stays consistent across the install rather than introducing a second spelling.
• The public URI works in-cluster for the same two reasons the controller URI does: the CoreDNS rewrite resolves *.127-0-0-1.nip.io to ingress-nginx, and the root CA makes the certificate trusted.
• A comment records what breaks without it, because the symptom appears three layers away - in an adapter log, not in the operator or in this file.
• Verified by rendering the published 3.4.90 operator chart against this file: the manifest now carries OPERATOR__AUTHURI. Verified on a live cluster too - once the operator had the value, the adapter stopped disabling authentication and a secured route accepted a valid token.

[Copilot]

Pull request overview

Sets the missing identity authority (operator.authUri) in the Communication Operator Helm values so operator-deployed adapters can validate bearer tokens for secured FromHttpRequest@2 routes in local kind installs.

Changes:

• Add operator.authUri: "https://identity.127-0-0-1.nip.io" to the operator values.
• Document the failure mode when the authority is not provided (adapters disable JWT auth and secured routes return 401).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ArkadiuszPabian]

LGTM