From a177d629257efac503a35082bdea2378e611b7c4 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 23:09:06 -0500 Subject: [PATCH] fix(conformance): busybox-compatible wget in oidc-sso-grafana probe (R-IDP-01) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit busybox wget has no --max-redirect flag → it printed usage, so the probe never saw the 302 and R-IDP-01 falsely failed. Grafana verified live: /login/generic_oauth 302s to the Keycloak homelab authorize endpoint. Use 'wget -S' (dumps the 302 Location before follow). --- .../tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml b/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml index ac92c8c..6fb93c1 100644 --- a/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml +++ b/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml @@ -65,7 +65,11 @@ spec: - | set -u svc="http://kube-prometheus-stack-grafana.monitoring.svc.cluster.local" - out="$(wget -S --max-redirect=0 -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)" + # busybox wget has no --max-redirect; -S dumps every response header + # (incl. the initial 302 Location to the IdP) before following, so the + # grep below still matches the Keycloak authorize URL. (Grafana verified + # live: 302 -> keycloak.home.keithjackson.dev/realms/homelab/.../auth.) + out="$(wget -S -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)" echo "$out" if echo "$out" | grep -qi 'keycloak.home.keithjackson.dev/realms/homelab'; then echo GRAFANA_OIDC_REDIRECT_OK