From 748e9ca55ddeb05e0c668b1cb93d94c08d3875ad Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Fri, 28 Aug 2026 15:57:55 -0500 Subject: [PATCH] =?UTF-8?q?fix(oauth2-proxy):=20--allowed-groups=20?= =?UTF-8?q?=E2=86=92=20--allowed-group=20(correct=20oauth2-proxy=20v7.8.1?= =?UTF-8?q?=20flag)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The plural --allowed-groups does not exist in oauth2-proxy v7.8.1; the shared oauth2-proxy new pod and the crafty auth sidecar both crashlooped on 'unknown flag'. The flag is the singular, repeatable --allowed-group. Co-Authored-By: Claude Opus 4.8 --- platform/crafty/deployment.yaml | 2 +- platform/oauth2-proxy/helmrelease.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/platform/crafty/deployment.yaml b/platform/crafty/deployment.yaml index 1566849..8bcd53d 100644 --- a/platform/crafty/deployment.yaml +++ b/platform/crafty/deployment.yaml @@ -135,7 +135,7 @@ spec: - --oidc-groups-claim=groups # R-IDP-06: a valid Keycloak session is NOT enough — the user must ALSO be in platform-admins, # else /oauth2 returns 403. (Matches the platform oauth2-proxy floor.) - - --allowed-groups=platform-admins + - --allowed-group=platform-admins # Single provider => 302 straight to Keycloak, no oauth2-proxy interstitial button. - --skip-provider-button=true - --redirect-url=https://crafty.home.keithjackson.dev/oauth2/callback diff --git a/platform/oauth2-proxy/helmrelease.yaml b/platform/oauth2-proxy/helmrelease.yaml index f4fa869..2c741d6 100644 --- a/platform/oauth2-proxy/helmrelease.yaml +++ b/platform/oauth2-proxy/helmrelease.yaml @@ -57,7 +57,7 @@ spec: # HTTPRoute's `homelab.keithjackson.dev/auth-groups` annotation — oauth2-proxy honours the # per-request query on top of this floor. See forward-auth-cec.yaml + README "opt-in". oidc-groups-claim: groups - allowed-groups: platform-admins # R-IDP-06 floor: authenticated AND in platform-admins + allowed-group: platform-admins # R-IDP-06 floor: authenticated AND in platform-admins (oauth2-proxy flag is singular --allowed-group, repeatable) # Single Keycloak provider => skip the oauth2-proxy interstitial "Sign In" button and 302 # straight to Keycloak. Verified in-cluster: WITHOUT this, an ext_authz-denied browser request # gets oauth2-proxy's HTML sign-in page (HTTP 403) instead of an immediate redirect (docs/15 UX).