Authentication

Production deployments should protect the kprobe console and API with your organization’s identity provider.

Supported patterns

• SSO through OIDC
• private ingress behind an identity-aware proxy
• service-to-service tokens for API clients
• short-lived user sessions
• audit logs for administrative actions

Recommended setup

auth:
  mode: oidc
  oidc:
    issuer: https://idp.example.com
    clientIdSecretRef: kprobe-oidc-client

API access

API clients should use scoped tokens with the minimum permissions needed:

• read events
• read causal graphs
• manage replay sessions
• administer configuration