decommission test-browser (KasmWeb): remove app per owner directive #218

2026-07-14T10:06:19Z

claude-bot commented

2026-07-14 10:06:19 +00:00

Fixes #195

Issue #195 flagged KasmWeb (browser.renner.uno) for having no Authentik forward-auth gate and hardcoded weak credentials (VNC_PW: kasmtest, KASM_USER: kasm_user) baked into deployment.yaml.

Owner comment on the issue overrides the originally-proposed "add auth gate" fix:

can be decomissiond

Changes

Remove kubernetes/apps/test-browser/ (deployment, service, ingressroute+cert, firefox-policies, kustomization) entirely.
Drop the test-browser/ entry from kubernetes/apps/kustomization.yaml.
Remove the now-orphaned kubernetes/infrastructure/image-automation/firefox.yaml (ImageRepository/ImagePolicy for kasmweb/firefox) and its kustomization entry — nothing consumes it anymore.
Update comments in kubernetes/apps/insecure-backend-serverstransport.yaml and kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml that listed test-browser as a consumer/example of shared infra (file/pve remain valid consumers of both).

Verification

kubectl kustomize kubernetes/apps and kubectl kustomize kubernetes/infrastructure/image-automation both build cleanly post-removal.
Grepped the whole repo for test-browser, browser.renner.uno, browser.k.renner.uno, and kasm (case-insensitive) — no remaining references except an unrelated deprecated opentofu migration script (opentofu/scripts/remove_unifi_clients.sh) that references a stale kasm_srv_renner_uno Terraform module name from history; no live .tf module by that name exists, so left untouched as out of scope.
No separate Flux Kustomization CR existed for test-browser (unlike some other apps) — kubernetes/apps/kustomization.yaml was the only wiring point, now updated.

Fixes #195 Issue #195 flagged KasmWeb (browser.renner.uno) for having no Authentik forward-auth gate and hardcoded weak credentials (VNC_PW: kasmtest, KASM_USER: kasm_user) baked into deployment.yaml. Owner comment on the issue overrides the originally-proposed "add auth gate" fix: > can be decomissiond ## Changes - Remove kubernetes/apps/test-browser/ (deployment, service, ingressroute+cert, firefox-policies, kustomization) entirely. - Drop the test-browser/ entry from kubernetes/apps/kustomization.yaml. - Remove the now-orphaned kubernetes/infrastructure/image-automation/firefox.yaml (ImageRepository/ImagePolicy for kasmweb/firefox) and its kustomization entry — nothing consumes it anymore. - Update comments in kubernetes/apps/insecure-backend-serverstransport.yaml and kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml that listed test-browser as a consumer/example of shared infra (file/pve remain valid consumers of both). ## Verification - kubectl kustomize kubernetes/apps and kubectl kustomize kubernetes/infrastructure/image-automation both build cleanly post-removal. - Grepped the whole repo for test-browser, browser.renner.uno, browser.k.renner.uno, and kasm (case-insensitive) — no remaining references except an unrelated deprecated opentofu migration script (opentofu/scripts/remove_unifi_clients.sh) that references a stale kasm_srv_renner_uno Terraform module name from history; no live .tf module by that name exists, so left untouched as out of scope. - No separate Flux Kustomization CR existed for test-browser (unlike some other apps) — kubernetes/apps/kustomization.yaml was the only wiring point, now updated.

claude-bot added 1 commit 2026-07-14 10:06:20 +00:00

decommission test-browser (KasmWeb): remove app per owner directive b51e4cf6c1

Issue #195 flagged KasmWeb (browser.renner.uno) for having no Authentik
gate and hardcoded weak credentials. Owner comment overrides the
originally-proposed auth-gate fix: "can be decomissiond". Removes the
app dir, its apps/kustomization.yaml entry, the orphaned firefox
image-automation policy, and updates comments in the shared
insecure-backend ServersTransport and external-dns-unifi HelmRelease
that referenced test-browser as a consumer/example.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>

claude-bot referenced this pull request

2026-07-14 10:06:27 +00:00

[security][high] KasmWeb (browser.renner.uno) has no auth gate and hardcoded weak credentials #195

k.renner merged commit 50f4cd0959 into master

2026-07-14 15:11:09 +00:00

k.renner referenced this issue from a commit

2026-07-14 15:11:11 +00:00

Merge pull request 'decommission test-browser (KasmWeb): remove app per owner directive' (#218) from fix/issue-195 into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#218