Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(headlamp): rename OIDC secret keys to OIDC_* so chart args expand

Browse Source 
Headlamp OIDC login failed with `unsupported protocol scheme ""`. The
kubernetes-sigs/headlamp chart `envFrom`s the headlamp-oidc Secret verbatim
and renders args like `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`, so the Secret
keys must be the exact env var names. The keys were camelCase
(clientID/issuerURL/scopes/callbackURL/clientSecret), following the mistaken
`.example`, so `OIDC_ISSUER_URL` was never defined. Kubernetes left the literal
`$(OIDC_ISSUER_URL)` in the arg and Headlamp's OIDC discovery hit
`Get "$(OIDC_ISSUER_URL)/.well-known/openid-configuration": unsupported
protocol scheme ""`.

Rename the SOPS Secret keys to OIDC_CLIENT_ID / OIDC_CLIENT_SECRET /
OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (values unchanged, still
SOPS/age-encrypted). Fix the `.example` and README so the correct, load-bearing
key names are documented and the camelCase footgun can't recur.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-29 15:09:15 -05:00
1 parent 7910128675
commit 071123ae43
4 files changed
+41 -25
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/headlamp/headlamp-oidc-credentials.sops.yaml.example
+17 -8
View File
@@ -4,9 +4,11 @@
#
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
# THIS Secret, so ALL OIDC env (clientID/clientSecret/issuerURL/scopes/callbackURL) live here,
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart maps these keys to the container's
# OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL env vars.
# THIS Secret, so ALL OIDC env (OIDC_CLIENT_ID/OIDC_CLIENT_SECRET/OIDC_ISSUER_URL/OIDC_SCOPES/OIDC_CALLBACK_URL) live here,
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart `envFrom`s this Secret VERBATIM, so
# the KEYS ARE the container env var names — they MUST be exactly OIDC_CLIENT_ID / OIDC_CLIENT_SECRET
# / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (the chart's `-oidc-*` args reference those
# names via $(...)). There is NO camelCase→OIDC_ mapping; a mismatched key breaks OIDC login.
#
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
@@ -27,10 +29,17 @@ metadata:
namespace: headlamp
type: Opaque
stringData:
# KEY NAMES ARE LOAD-BEARING. The chart does NOT rename these — it `envFrom`s this Secret
# verbatim, so each key becomes a container env var of the SAME name, and the chart's OIDC args
# reference them by exact name: `-oidc-client-id=$(OIDC_CLIENT_ID)`,
# `-oidc-client-secret=$(OIDC_CLIENT_SECRET)`, `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`,
# `-oidc-scopes=$(OIDC_SCOPES)`. If a key is misnamed (e.g. camelCase `issuerURL`), the env var
# `OIDC_ISSUER_URL` is undefined, K8s leaves the literal string `$(OIDC_ISSUER_URL)` in the arg,
# and Headlamp's OIDC discovery fails with `unsupported protocol scheme ""`. Use these EXACT keys.
# Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
clientID: headlamp
issuerURL: https://keycloak.home.keithjackson.dev/realms/homelab
scopes: "openid email profile"
callbackURL: https://headlamp.home.keithjackson.dev/oidc-callback
OIDC_CLIENT_ID: headlamp
OIDC_ISSUER_URL: https://keycloak.home.keithjackson.dev/realms/homelab
OIDC_SCOPES: "openid email profile"
OIDC_CALLBACK_URL: https://headlamp.home.keithjackson.dev/oidc-callback
# The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
clientSecret: REPLACE-ME
OIDC_CLIENT_SECRET: REPLACE-ME