Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

fix(headlamp): rename OIDC secret keys to OIDC_* so chart args expand

Browse Source 
Headlamp OIDC login failed with `unsupported protocol scheme ""`. The
kubernetes-sigs/headlamp chart `envFrom`s the headlamp-oidc Secret verbatim
and renders args like `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`, so the Secret
keys must be the exact env var names. The keys were camelCase
(clientID/issuerURL/scopes/callbackURL/clientSecret), following the mistaken
`.example`, so `OIDC_ISSUER_URL` was never defined. Kubernetes left the literal
`$(OIDC_ISSUER_URL)` in the arg and Headlamp's OIDC discovery hit
`Get "$(OIDC_ISSUER_URL)/.well-known/openid-configuration": unsupported
protocol scheme ""`.

Rename the SOPS Secret keys to OIDC_CLIENT_ID / OIDC_CLIENT_SECRET /
OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (values unchanged, still
SOPS/age-encrypted). Fix the `.example` and README so the correct, load-bearing
key names are documented and the camelCase footgun can't recur.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-29 15:09:15 -05:00
1 parent 7910128675
commit 071123ae43
4 files changed
+41 -25
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/headlamp/helmrelease.yaml
+6 -4
View File
@@ -58,10 +58,12 @@ spec:
config:
inCluster: true
oidc:
# OIDC config (clientID / clientSecret / issuerURL / scopes / callbackURL) is supplied via an
# EXISTING SOPS-encrypted Secret consumed by name only (R-IDP-04) — the chart envFrom's it.
# (The chart's `externalSecret` path reads OIDC_* env from this Secret; nothing sensitive is
# rendered into the HelmRelease.)
# OIDC config (OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES /
# OIDC_CALLBACK_URL) is supplied via an EXISTING SOPS-encrypted Secret consumed by name only
# (R-IDP-04) — the chart envFrom's it. The Secret keys ARE the env var names (no renaming),
# and the chart's `-oidc-*` args reference them via $(...), e.g.
# `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`; a camelCase key would leave that arg unexpanded
# and break OIDC login (`unsupported protocol scheme ""`). Nothing sensitive is rendered here.
externalSecret:
enabled: true
name: headlamp-oidc