Anonymous Auth disabled, but still allowing unauthenticated requests (k8s weaviate deployment)

I just had a quick look at the code and the problem is the following:

  • we have anon auth enabled by default (==if all others are disabled and we cannot distinguish between explicitly disabled and not set)
  • you disable all authentication methods by setting them to false

So to make it work, you need to enable either OIDC or APIkey authentication.

Is the ‘allowed_keys’ field here supposed to map to the password and the ‘users’ field to the username ?

yes exactly. Note that we also have dynamic user management via APIs if you are planning to have a lot of users: Manage users | Weaviate Documentation

For basic auth, should we beuing the basic auth option
CLUSTER_BASIC_AUTH_USERNAME=xxxx
CLUSTER_BASIC_AUTH_PASSWORD=yyyy

These are for inter-node communication

1 Like