Cluster mode

Install the chart

The published OCI chart runs the same binary inside the cluster. It needs the public URL people open and an explicit authentication mode.

helm upgrade --install spinoza oci://ghcr.io/sophotechlabs/charts/spinoza \
  --namespace spinoza --create-namespace \
  --set publicURL=https://spinoza.example.com \
  --set auth.mode=oidc \
  --set auth.oidc.issuerURL=https://id.example.com/realms/main \
  --set auth.oidc.clientID=spinoza \
  --set auth.oidc.clientSecret=...

Sign-in and roles

Use OIDC when Spinoza should run the login, or an authenticated proxy when one already fronts your internal tools. Groups map to viewer, editor and admin roles. Anonymous administration is off unless you opt into it explicitly.

What the cluster permits

Spinoza impersonates the signed-in account for apiserver calls, so Kubernetes RBAC decides what that person may do. Tables and search are scoped to namespaces the account may list; cluster-wide views require cluster-wide read access.

What changes from local mode

• One cluster and one replica, rather than several local kubeconfigs and tabs.
• No desktop window or local port-forwarding.
• No update check or self-install path inside the pod.
• Node shell stays off unless an administrator enables it.