nebari-dev/nebari-operator

View on GitHub

Kubernetes Operator designed to streamline and centralize the configuration of routing, TLS certificates, and user authentication within NICs ecossystem.

Stars: 0
Forks: 2
Open beginner issues: 0
Indexed issues: 47
Avg merge: 11d 6h
Merged PRs (30d): 1

Dominant language: Go
License: Apache-2.0
Last GitHub push: Aug 31, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

47 open issues indexed

SecurityPolicy OIDC issuer uses the internal Keycloak URL which is rejected by Envoy Gateway's v1.9.1 issuer validation Open

needs: discussion 💬

Difficulty 3/5 1-2 days Newbie friendliness 68/100

nebari-dev/nebari-operator#186 · Opened Sep 7, 2026
Add longDescription field to NebariApp.spec.landingPage Open

area: user experience 👩🏻‍💻 type: enhancement 💅🏼

Difficulty 3/5 1-2 days Newbie friendliness 70/100

nebari-dev/nebari-operator#181 · Opened Aug 14, 2026
Migrate off deprecated controller-runtime events API (GetEventRecorderFor) and scheme.Builder Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

nebari-dev/nebari-operator#171 · Opened Aug 7, 2026
Support TLS-passthrough routing (TLSRoute / routing.tcp) in NebariApp Open

nebari-dev/nebari-operator#169 · 1 comment · 1 assignee · Opened Jul 23, 2026
feat(tls): adopt per-app ListenerSet for TLS ownership (ADR-0011, Option 2) Open

nebari-dev/nebari-operator#168 · 1 assignee · Opened Jul 20, 2026
Epic: Security assessment remediation (v0.1.0-alpha.20) Open

area: security epic

Difficulty 5/5 Over a week Newbie friendliness 20/100

nebari-dev/nebari-operator#166 · Opened Jul 15, 2026
security: user-provided TLS Secrets are not cryptographically or semantically validated Open

area: security priority: low 🌱 type: bug 🐛

Difficulty 4/5 3-5 days Newbie friendliness 48/100

nebari-dev/nebari-operator#165 · Opened Jul 15, 2026
security: identity and credential reconciliation is additive with incomplete cleanup Open

area: security priority: medium ⚡ type: tech debt 🧹

Difficulty 5/5 Over a week Newbie friendliness 28/100

nebari-dev/nebari-operator#164 · Opened Jul 15, 2026
security: build uses a stale Go patch and lacks govulncheck, image-scan, and SBOM gates Open

area: security priority: medium ⚡ type: maintenance 🛠

Difficulty 5/5 Over a week Newbie friendliness 38/100

nebari-dev/nebari-operator#163 · Opened Jul 15, 2026
security: broad Kubernetes and Keycloak authority lacks network containment Open

area: security priority: medium ⚡ type: tech debt 🧹

Difficulty 4/5 3-5 days Newbie friendliness 45/100

nebari-dev/nebari-operator#162 · Opened Jul 15, 2026
security: token exchange trusts every peer NebariApp client in the realm Open

area: security priority: medium ⚡ type: tech debt 🧹

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#161 · Opened Jul 15, 2026
security: cross-namespace Service backends lack target-owner consent and leak an existence oracle Open

area: security priority: medium ⚡ type: tech debt 🧹

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#160 · Opened Jul 15, 2026
security: generic-oidc issuerURL is unvalidated (gateway-side SSRF and client-secret exposure) Open

area: security priority: medium ⚡ type: bug 🐛

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#159 · Opened Jul 15, 2026
security: generated child resources can overwrite unrelated same-name objects Open

area: security priority: medium ⚡ type: bug 🐛

Difficulty 5/5 Over a week Newbie friendliness 42/100

nebari-dev/nebari-operator#158 · Opened Jul 15, 2026
security: release artifacts use mutable inputs and lack signing, provenance, and SBOM Open

area: security priority: high 🔥 type: maintenance 🛠

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#157 · Opened Jul 15, 2026
security: hostname and TLS listener delegation lacks an ownership boundary Open

area: security priority: high 🔥 type: tech debt 🧹

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#156 · Opened Jul 15, 2026
security: caller-selected spaClient.clientId can reconfigure or delete an existing Keycloak client Open

area: security priority: high 🔥 type: bug 🐛

Difficulty 5/5 Over a week Newbie friendliness 42/100

nebari-dev/nebari-operator#155 · Opened Jul 15, 2026
security: self-service NebariApp fields can create and administer Keycloak realm groups and memberships Open

area: security priority: high 🔥 type: tech debt 🧹

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#154 · Opened Jul 15, 2026
security: auth.groups is documented as access control but is not enforced at the gateway Open

area: security priority: high 🔥 type: bug 🐛

Difficulty 5/5 Over a week Newbie friendliness 38/100

nebari-dev/nebari-operator#153 · Opened Jul 15, 2026
security: auth-enabled routes are published before SecurityPolicy is accepted (fail-open) Open

area: security priority: critical 🚨 type: bug 🐛

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#152 · Opened Jul 15, 2026
Inject non-sensitive Keycloak values into NebariApp workloads so packs stop hardcoding them Open

type: enhancement 💅🏼

Difficulty 4/5 3-5 days Newbie friendliness 52/100

nebari-dev/nebari-operator#147 · Opened Jun 24, 2026
Inject standard OTLP env vars into NebariApp workloads so packs auto-publish telemetry Open

type: enhancement 💅🏼

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#146 · 1 comment · Opened Jun 23, 2026
Epic: Routing & SecurityPolicy consolidation Open

epic

Difficulty 5/5 Over a week Newbie friendliness 20/100

nebari-dev/nebari-operator#139 · Opened Jun 6, 2026
Routing: curated CORS block on the generated SecurityPolicy Open

needs: discussion 💬 type: enhancement 💅🏼

Difficulty 5/5 Over a week Newbie friendliness 42/100

nebari-dev/nebari-operator#138 · Opened Jun 6, 2026
Routing: expose HTTPRouteFilter pass-through on generated HTTPRoutes Open

nebari-dev/nebari-operator#137 · 1 assignee · Opened Jun 4, 2026
Generated SecurityPolicy uses wrong Keycloak port (8080) and missing /auth path prefix Open

nebari-dev/nebari-operator#136 · 2 comments · 1 assignee · Opened Jun 1, 2026
Pre-v0.1.0 release validation pass Open

nebari-dev/nebari-operator#132 · 2 comments · 1 assignee · Opened May 24, 2026
v1.0.0: stabilize CRD + graduate to stable (reframed from v0.1.0) Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

nebari-dev/nebari-operator#129 · 4 comments · Opened May 21, 2026
Add Keycloak client-role support to NebariApp.auth.keycloakConfig Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

nebari-dev/nebari-operator#119 · 1 comment · Opened May 16, 2026
NebariApp: publicRoutes + default enforceAtGateway produces two competing HTTPRoutes for the same path Open

area: security priority: medium ⚡

nebari-dev/nebari-operator#118 · 2 comments · 1 assignee · Opened May 12, 2026
[ENH] - Expose running child resources via NebariApp status.serviceDiscovery.children Open

area: user experience 👩🏻‍💻 needs: discussion 💬 priority: low 🌱 type: enhancement 💅🏼

nebari-dev/nebari-operator#117 · 1 assignee · Opened May 7, 2026
Watch user-provided TLS secrets to fast-track TLSReady transitions Open

nebari-dev/nebari-operator#115 · 2 comments · 1 assignee · Opened May 6, 2026
[MAINT] - Check if Keycloak redirection and access is still working when running operator locally Open

needs: triage 🚦

Difficulty 4/5 3-5 days Newbie friendliness 35/100

nebari-dev/nebari-operator#84 · 3 comments · Opened Mar 23, 2026
Epic: Nebari Operator - NebariApp CRD Evolution Open

epic

Difficulty 5/5 Over a week Newbie friendliness 35/100

nebari-dev/nebari-operator#78 · Opened Mar 19, 2026
Epic: Nebari Operator - Keycloak & Auth Open

epic

Difficulty 5/5 Over a week Newbie friendliness 25/100

nebari-dev/nebari-operator#79 · Opened Mar 19, 2026
Epic: Nebari Operator - Reconciler & Tech Debt Open

epic

Difficulty 5/5 Over a week Newbie friendliness 20/100

nebari-dev/nebari-operator#80 · Opened Mar 19, 2026
Make hostname optional in NebariApp, add subdomain field Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

nebari-dev/nebari-operator#69 · Opened Mar 12, 2026
[Architecture] - Service Discovery API — Using NebariApp CRDs as a Kubernetes-Native Service Registry Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

nebari-dev/nebari-operator#54 · 3 comments · Opened Feb 26, 2026
Handle concurrent realm scope creation in syncClientScopes Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

nebari-dev/nebari-operator#45 · Opened Feb 19, 2026
syncClientScopes should remove scopes no longer in Spec.Auth.Scopes Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

nebari-dev/nebari-operator#44 · Opened Feb 19, 2026
enhancement: Add test coverage for Keycloak integration and main Reconcile method Open

area: testing ✅ priority: medium ⚡ type: tech debt 🧹

Difficulty 4/5 3-5 days Newbie friendliness 38/100

nebari-dev/nebari-operator#38 · Opened Feb 16, 2026
security: Restrict Keycloak OIDC client WebOrigins from wildcard to specific hostnames Open

area: security priority: medium ⚡ type: tech debt 🧹

nebari-dev/nebari-operator#37 · 1 assignee · Opened Feb 16, 2026
enhancement: Log warning on invalid environment variable values Open

priority: low 🌱 type: tech debt 🧹

Difficulty 3/5 1-2 days Newbie friendliness 55/100

nebari-dev/nebari-operator#36 · Opened Feb 16, 2026
enhancement: Replace unconditional 1-minute requeue with event-driven reconciliation Open

priority: medium ⚡ type: tech debt 🧹

Difficulty 4/5 3-5 days Newbie friendliness 45/100

nebari-dev/nebari-operator#35 · Opened Feb 16, 2026
cleanup: Remove dead code - unused LoadConfig() and duplicate LoadKeycloakCredentials() Open

priority: medium ⚡ type: tech debt 🧹

Difficulty 3/5 1-2 days Newbie friendliness 45/100

nebari-dev/nebari-operator#34 · Opened Feb 16, 2026
enhancement: Initialize all sub-reconcilers consistently in main.go Open

priority: medium ⚡ type: tech debt 🧹

Difficulty 3/5 1-2 days Newbie friendliness 52/100

nebari-dev/nebari-operator#33 · Opened Feb 16, 2026
enhancement: Add watches on owned resources (HTTPRoute, SecurityPolicy, Secret) Open

type: tech debt 🧹

nebari-dev/nebari-operator#30 · 2 comments · 1 assignee · Opened Feb 16, 2026

nebari-dev/nebari-operator

Get new issues in your inbox