Kubernetes debug terminal,
in your browser.

Skip both layers. Every request becomes the local-dev principal; OPA isn't consulted. Zero JWT validation, zero policy evaluation — useful for tearing things apart over kubectl port-forward.

auth:
  disabled: true     # JWT validation off — `local-dev` for everyone
opa:
  enabled: false    # authZ short-circuits to allow

Coarse but simple — the JWT's groups claim maps directly to a role, no namespace constraint. Good when porthole serves a single team and namespaces aren't multi-tenant.

opa:
  data: |
    {
      "policy": {
        "roles": {
          "viewer":   ["list_namespaces", "list_pods", "list_ec"],
          "debugger": ["list_namespaces", "list_pods", "list_ec",
                       "inject_ec", "attach_ec", "terminate_ec"]
        },
        "bindings": [
          // Anyone in this group can debug any namespace.
          {"group": "platform-oncall", "role": "debugger", "namespace_glob": "*"},
          // Read-only — see pods, can't inject.
          {"group": "support",         "role": "viewer",   "namespace_glob": "*"}
        ]
      }
    }

The full pattern. A binding can combine JWT groups, namespace name globs, namespace labels, and an optional business_hours: true time window. All present constraints must hold (logical AND), so you can express things like "tenant-acme debugs tenant-* namespaces labeled tenant=acme", "secops debugs anything labeled tier=production", or "junior devs only during working hours".

How the time window resolves: porthole stamps input.now on every OPA call with its own time.Now().UTC().Format(RFC3339) — the wall clock is the porthole pod's, not the user's browser. The Rego in policy/porthole.rego compares via time.weekday and time.clock: Mon–Fri, 09 ≤ hour < 17 UTC. Want a different range or a non-UTC zone? Edit the violates_time_window rule (e.g. time.clock(now, "America/New_York") for ET). The chart's bundled default policy doesn't include business_hours — load the full file via --set-file opa.policy=./policy/porthole.rego to enable it.

opa:
  data: |
    {
      "policy": {
        "roles": {
          "debugger": ["list_namespaces", "list_pods", "list_ec",
                       "inject_ec", "attach_ec", "terminate_ec"]
        },
        "bindings": [
          // Per-team — glob match on namespace name only.
          {"group": "team-payments",
           "role":  "debugger",
           "namespace_glob": "payments-*"},

          // Tenant — glob AND label must both match.
          {"group": "tenant-acme",
           "role":  "debugger",
           "namespace_glob": "tenant-*",
           "namespace_labels": {"tenant": "acme"}},

          // SecOps — any namespace labeled tier=production.
          {"group": "secops",
           "role":  "debugger",
           "namespace_labels": {"tier": "production"}},

          // Junior devs — dev-* only, Mon–Fri 09:00–17:00 (server-side).
          // Needs policy/porthole.rego loaded via --set-file (the default
          // chart policy ignores `business_hours`).
          {"group": "junior-devs",
           "role":  "debugger",
           "namespace_glob": "dev-*",
           "business_hours": true}
        ]
      }
    }

# What porthole sends OPA per inject_ec call:

{
  "user":             {"groups": ["team-payments"]},
  "request":          {"action": "inject_ec",
                       "namespace": "payments-checkout"},
  "namespace_labels": {"tier": "staging", "team": "payments"}
}