Skip to content
Ownkube

Access protection

Access protection puts a login wall in front of a public web app without writing any auth code. Turn it on from the deployment’s Security tab and pick one of two modes.

Two modes

Section titled “Two modes”

Password protection

Basic auth: a username and an org-viewable password. Anyone hitting the app has to enter them before they see anything.

Single sign-on (Google)

Sign in with Google, restricted to the email domains or specific email addresses you list. No shared password to manage.

The two modes are mutually exclusive, a deployment runs one or the other, not both at once.

Turning it on

Section titled “Turning it on”

  1. Open the Security tab

    Go to the deployment’s detail page and open Security.

  2. Pick a mode

    Choose Password protection or Single sign-on (Google).

  3. Set the credentials

    For password protection, set a username and password. For single sign-on, list the allowed email domains or specific email addresses.

  4. Save

    Ownkube updates the app’s auth config and triggers a rolling update. Once it’s live, visitors hit the login wall before reaching your app.

Where it’s available

Section titled “Where it’s available”
  • Public web apps only. Access protection applies to public web deployments, not workers, jobs, or databases.
  • Starter (K3s) clusters only. The Security tab is grayed out on Production (EKS) clusters, with an explanation.
  • Requires a recent platform version. If your cluster’s platform version is below the floor this feature needs, the tab is grayed out with an explanation there too. Upgrade the platform to unlock it.

Good for

Section titled “Good for”

Staging environments, internal tools, previews, and gating a site before launch, anywhere you want a public URL to exist without being open to everyone yet.

Deployments Public exposure and the rest of a deployment's settings.
Map a custom domain Serve a protected app from a hostname you own.