fix(headlamp): per-environment OIDC URLs — prod was dialing DEV's Keycloak
The operator could not log in to Headlamp on prod: Get "https://keycloak.home.keithjackson.dev/realms/homelab/.well-known/openid-configuration": dial tcp 192.168.1.53:443: i/o timeout ROOT CAUSE: OIDC_ISSUER_URL and OIDC_CALLBACK_URL were keys INSIDE the SOPS-encrypted headlamp-oidc-credentials.sops.yaml. Flux's ${BASE_DOMAIN} postBuild substitution rewrites the RENDERED manifest text and can never reach inside ciphertext, so both values were frozen at the apex `home.keithjackson.dev` in BOTH environments. Dev IS the apex, so dev looked correct; prod (BASE_DOMAIN = prod.home.keithjackson.dev) therefore pointed at dev's Keycloak at 192.168.1.53 — on the dev LAN behind pfSense, unroutable from prod's 192.168.2.0/24. FIX: an issuer URL and a callback URL are PUBLIC. Move both out of the Secret into the HelmRelease's spec.values.env, written with ${BASE_DOMAIN} so substitution resolves them per environment. The Secret keeps only what is genuinely secret or environment-invariant (OIDC_CLIENT_SECRET, OIDC_CLIENT_ID, OIDC_SCOPES). Exactly ONE source per variable: the chart renders `env:` after `envFrom:`, and an explicit env entry silently WINS over the same name from envFrom — so the two sets must not overlap, and they no longer do. The five load-bearing names the chart's $(...) args require (OIDC_CLIENT_ID/CLIENT_SECRET/ISSUER_URL/SCOPES/CALLBACK_URL) are all still delivered; verified by rendering platform/headlamp per overlay, `flux envsubst --strict`, and `helm template` of chart 0.41.0 against the substituted values. Side effect, deliberate: naming OIDC_CALLBACK_URL in `env:` makes the chart finally EMIT `-oidc-callback-url=$(OIDC_CALLBACK_URL)` — it gates that arg on the value being set via `env:`/`config.oidc`, which a Secret key alone never tripped, so the Secret's callback URL had been dead weight. The value is byte-identical to the single redirectUri registered on the Keycloak `headlamp` client (also ${BASE_DOMAIN}-templated), the only URI Keycloak accepts. [parity] holds: prod's kube-apiserver oidc-issuer-url is an install-time k3s flag from k3s_base_domain=prod.home.keithjackson.dev, which is exactly what Headlamp now uses. Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5 committed
1 parent
d1a6628a97
commit
bfa39bc5d0
4 files changed
+121
-41
No files matched your search
@@ -1,6 +1,6 @@
|
||||
# Headlamp — Kubernetes dashboard (Keycloak OIDC + per-user RBAC)
|
||||
|
||||
Headlamp is served at `https://headlamp.home.keithjackson.dev` behind the shared Gateway
|
||||
Headlamp is served at `https://headlamp.${BASE_DOMAIN}` behind the shared Gateway
|
||||
(wildcard TLS), with **native Keycloak OIDC login** and **per-user RBAC** (ADR-0014, docs/15).
|
||||
|
||||
## How per-user RBAC works (end to end)
|
||||
@@ -33,6 +33,49 @@ carry `aud=[headlamp, kubernetes]`:
|
||||
|
||||
This keeps the apiserver OIDC config untouched (preferred over widening `--api-audiences`).
|
||||
|
||||
## Where the OIDC config comes from (two sources, no overlap)
|
||||
|
||||
The container needs five env vars, and their **names are load-bearing**: the chart's args reference
|
||||
them via `$(...)` (`-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`, `-oidc-client-id=$(OIDC_CLIENT_ID)`, …).
|
||||
They must be exactly `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, `OIDC_ISSUER_URL`, `OIDC_SCOPES`,
|
||||
`OIDC_CALLBACK_URL` — **not** camelCase. A misnamed or missing name does **not** fail loudly:
|
||||
Kubernetes leaves the literal string `$(OIDC_ISSUER_URL)` in the argument and login dies with
|
||||
`unsupported protocol scheme ""`.
|
||||
|
||||
| Env var | Source | Why |
|
||||
|---|---|---|
|
||||
| `OIDC_CLIENT_ID`, `OIDC_SCOPES`, `OIDC_CLIENT_SECRET` | `headlamp-oidc-credentials.sops.yaml`, `envFrom`'d by `config.oidc.externalSecret` | secret, or environment-invariant |
|
||||
| `OIDC_ISSUER_URL`, `OIDC_CALLBACK_URL` | `helmrelease.yaml` → `spec.values.env`, templated `${BASE_DOMAIN}` | **environment-specific and public** |
|
||||
|
||||
**Exactly one source per variable.** Never define the same name in both places: an explicit `env:`
|
||||
entry silently overrides the same name arriving via `envFrom`, so an overlap hides which value is
|
||||
actually live.
|
||||
|
||||
### Why the URLs are not in the Secret (the 2026-09-07 prod outage)
|
||||
|
||||
Flux's `${BASE_DOMAIN}` postBuild substitution runs over the **rendered manifest text**; it can never
|
||||
reach inside an encrypted Secret. `OIDC_ISSUER_URL` and `OIDC_CALLBACK_URL` used to be keys in
|
||||
`headlamp-oidc-credentials.sops.yaml`, so both were frozen at the apex `home.keithjackson.dev`.
|
||||
Dev **is** the apex, so dev looked fine — but prod (`BASE_DOMAIN = prod.home.keithjackson.dev`) was
|
||||
pointed at **dev's** Keycloak, `192.168.1.53`, which sits on the dev LAN behind pfSense and is
|
||||
unroutable from prod's `192.168.2.0/24`. Every prod login failed with:
|
||||
|
||||
```
|
||||
Get "https://keycloak.home.keithjackson.dev/realms/homelab/.well-known/openid-configuration":
|
||||
dial tcp 192.168.1.53:443: i/o timeout
|
||||
```
|
||||
|
||||
An issuer URL and a callback URL are public, so they now live in cleartext in `helmrelease.yaml`
|
||||
where substitution works. Only the client secret stays encrypted. The same root cause and the same
|
||||
fix apply to Semaphore (`catalog/semaphore.yaml`, `SEMAPHORE_OIDC_PROVIDERS`).
|
||||
|
||||
**[parity] `OIDC_ISSUER_URL` must equal the kube-apiserver's `oidc-issuer-url`**, which is an
|
||||
install-time k3s flag set from `k3s_base_domain` (`infra/ansible/roles/k3s_server/defaults/main.yml`,
|
||||
overridden per inventory group), *not* from `cluster-vars`. Headlamp forwards the user's `id_token`
|
||||
to the apiserver, so a mismatch 401s every request. Both derive from the same per-environment
|
||||
domain — dev `home.keithjackson.dev`, prod `prod.home.keithjackson.dev` — which is what keeps them
|
||||
in step; changing one without the other breaks login.
|
||||
|
||||
## Secrets
|
||||
|
||||
- The confidential client secret lives SOPS-encrypted in
|
||||
@@ -41,11 +84,6 @@ This keeps the apiserver OIDC config untouched (preferred over widening `--api-a
|
||||
placeholder) and mirrored in this namespace's `headlamp-oidc-credentials.sops.yaml`
|
||||
(`OIDC_CLIENT_SECRET`), which the chart `config.oidc.externalSecret` envFrom's. Same cross-namespace
|
||||
mirror pattern as grafana/gitea.
|
||||
- **Key names are load-bearing.** The chart `envFrom`s this Secret verbatim, so its keys become the
|
||||
container env vars referenced by the chart's OIDC args (`-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`,
|
||||
etc.). They must be exactly `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, `OIDC_ISSUER_URL`, `OIDC_SCOPES`
|
||||
(and `OIDC_CALLBACK_URL`) — **not** camelCase. A misnamed key leaves `$(OIDC_ISSUER_URL)`
|
||||
unexpanded and OIDC login fails with `unsupported protocol scheme ""`.
|
||||
|
||||
## Break-glass
|
||||
|
||||
@@ -58,6 +96,6 @@ access if Keycloak/OIDC is down — the standard break-glass path.
|
||||
|---|---|---|
|
||||
| `namespace.yaml` | platform | `headlamp` namespace (`gateway-access=shared`; platform, not app-namespace) |
|
||||
| `helmrepository.yaml` / `helmrelease.yaml` | platform | Official `kubernetes-sigs/headlamp` chart + OIDC/RBAC values |
|
||||
| `headlamp-oidc-credentials.sops.yaml` | platform | SOPS OIDC config the chart envFrom's (decrypted by the `platform` Flux Kustomization) |
|
||||
| `headlamp-oidc-credentials.sops.yaml` | platform | SOPS OIDC **secret** the chart envFrom's — client id/scopes/secret only; the per-env URLs live in `helmrelease.yaml` `spec.values.env` |
|
||||
| `networkpolicy.yaml` | platform | default-deny baseline + Cilium ingress(gateway)/egress(apiserver+Keycloak) allows |
|
||||
| `httproute.yaml` | platform-config | Gateway API HTTPRoute for `headlamp.home.keithjackson.dev` (needs Gateway CRDs) |
|
||||
| `httproute.yaml` | platform-config | Gateway API HTTPRoute for `headlamp.${BASE_DOMAIN}` (needs Gateway CRDs) |
|
||||
@@ -5,11 +5,9 @@ metadata:
|
||||
namespace: headlamp
|
||||
type: Opaque
|
||||
stringData:
|
||||
OIDC_CLIENT_ID: ENC[AES256_GCM,data:dXAzoFfar4A=,iv:dHOJFcS6tpvtJes1c++nU6BbHyRlmGuLpncucbkJ4xA=,tag:lFI+KJPid2f/2r/ZjYlFTg==,type:str]
|
||||
OIDC_ISSUER_URL: ENC[AES256_GCM,data:Er1ljhH62WahtEJkNvxk1BA2jz28OOCZmmyjkbVN82e/TFM7O+FB/FPjWUaW3lhd+dK16ro=,iv:Z3aP7+T+ytItYpbxjoYymLNGa7m8KGic4WqIQrrBSGE=,tag:/Rvhp5+r7AXIj2uDgL/dPg==,type:str]
|
||||
OIDC_SCOPES: ENC[AES256_GCM,data:WoGaQKY9BFsi5/kDlRMXatINtmE=,iv:kTN+C176I8o5ftzZiKR10s9gl9VvBsOCJhFIZzj9gm4=,tag:ZyRIykD1h5YBq4grd6FB/w==,type:str]
|
||||
OIDC_CALLBACK_URL: ENC[AES256_GCM,data:SZdpxEuW1BJccLyRGjuIDWBu6KpySARv/6M0mWtzc9jS+v64Lgr4VWKwgW0tdZrH5jM9rw==,iv:UbLwgfz7J0SIWbcQ4csqxv5B3enTmfHJzSDw/lmqAEI=,tag:lge2AuoQXK/u3uZbWvGnLQ==,type:str]
|
||||
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:r0pb73gat8E7BFLPbdhguLh8G5PUT7PlJJeIcv7QPdMnN4iIB8MedMwxd77DkbxHSR7bav2ohQczjnbJBA4tPA==,iv:O0RbMFz4UD1sy8mbY7SXWCSGNF+lapDTL7tpphEcx7c=,tag:bEyuEs/lsK28fJeYDpYiOg==,type:str]
|
||||
OIDC_CLIENT_ID: ENC[AES256_GCM,data:FCW6yV5oUCM=,iv:+oWwATPxrukg7BbNDraaWhBoLmRsAAlF/HwlyYtLBgI=,tag:aoEMlyxyXLeiLak+i3Suww==,type:str]
|
||||
OIDC_SCOPES: ENC[AES256_GCM,data:k9jHaTSEQ7zl0gmK2zTW7AAbQ8c=,iv:cOGN1Oi/E9tTSZqNKY6i35wWk6fXatlYNRRhtVQrl1E=,tag:Q3I2pJ/a6ESX/ox2VvNDiA==,type:str]
|
||||
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:qoWJYdYx5bZztHJRYlGgxVRy/n9izkgffoGuQwePWtV6YrQpxZGgS3sak8cP6tt5M+3ZkFSrysxgcqcjrzJFuA==,iv:ZtEfWbPOucVnYv3x107XEjZ8Qt7HXBpwTlSuoxv+x5I=,tag:PXuEyhIoPOxo/Aw6hEhfKw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
@@ -19,14 +17,14 @@ sops:
|
||||
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UDV1RzRWeGZvdWxFQlgz
|
||||
dCtjTU8wZzR5Tks5dmYreFliREZGaDdXMVVjCkVPY2lZby9LNzJMelJkTlE1Yks2
|
||||
cXN5YmhlaUtwN3ZjQUo5R0xnQWNQYm8KLS0tIDBMSUMxZ1pHaDRnUWs5RGtRNlhI
|
||||
N0I4ekhqMWVWUFZoeGU4SERpYXVDQUkKUUwY6ZxEiWGdqV8s3wbnbPF9SkZJoxfy
|
||||
3MkNQ7rZHSILFTPVaZSErNTI21vqQr3lG24+yKLfNhAZBNyB5lvedQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdDZ6Zm9hSW9NY1Mrd0FO
|
||||
NXQxdC9NWXlrd2VXUjBYeGVLREJjOU56dmdJCk15NzlCdFRaWDdvUWVTcWtRc3hj
|
||||
eVJCNVdYSFZQU0V4Q0txTzhEMHVJMUEKLS0tIG5kamFsU3RwTWp6MWRlNTlQRlE3
|
||||
MFJFZ2NvUXAvc3J6NUl2b0NHNUVDYTQKb7tibY/OHM4FRfQ2dzTnIRTIgWG8gddU
|
||||
lFJCZG03U79MEG/UeottO4uNJ3jSXImXpysXSHnH3o5muNvIuEN9rw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-08-29T20:04:33Z"
|
||||
mac: ENC[AES256_GCM,data:Haj8wMqDuIdtBopP02L1Z63+T8f0fcuSDpF5jnjgCB1+uzX+d4ylqpcVP5r8Ug8M/2ay2nYWoJBWzL0Y1iHcnDP7/T60M8hT46cBYPrDh3MqY0rWF5GwpjJxL9tStoSlDTYICeilAPqo2Vw4UM1CqnZv+th40rz5/R4MwRsU04w=,iv:5HPvtnF6nnDYDaT84r1JWf+ZH1X5/L1Aiim2lgOucH4=,tag:VM/2FXNW7sdjCk/k2AVl+g==,type:str]
|
||||
lastmodified: "2026-09-07T07:04:07Z"
|
||||
mac: ENC[AES256_GCM,data:hGJmhdXg0XaaCh6YRI7Wj1TlnjFtckASY4OSyfEgLM8tbwPoElXLir5HQJz7F19uPirbSslVuG8+s58Zvv4/JG/Qki9tQyTItJzbkFVg7iXnXOcYwxW8vw+P26NeE84CYXCIGGunzKZuY7/6ftul8czt/3p83I0X4Y4YzbttaGs=,iv:i2wY7tPaeizv1k7O7b9bMSdbGABFDri5WdDsOxGBkOw=,tag:QI1b2rYgeme26NoGBm3GEA==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.9.4
|
||||
@@ -2,15 +2,27 @@
|
||||
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
||||
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
||||
#
|
||||
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
|
||||
# WHAT THIS IS: the SECRET half of Headlamp's OIDC config for the Keycloak `homelab` realm's
|
||||
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
|
||||
# THIS Secret, so ALL OIDC env (OIDC_CLIENT_ID/OIDC_CLIENT_SECRET/OIDC_ISSUER_URL/OIDC_SCOPES/OIDC_CALLBACK_URL) live here,
|
||||
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart `envFrom`s this Secret VERBATIM, so
|
||||
# the KEYS ARE the container env var names — they MUST be exactly OIDC_CLIENT_ID / OIDC_CLIENT_SECRET
|
||||
# / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (the chart's `-oidc-*` args reference those
|
||||
# names via $(...)). There is NO camelCase→OIDC_ mapping; a mismatched key breaks OIDC login.
|
||||
# THIS Secret, so its KEYS ARE the container env var names — the chart renames nothing, and its
|
||||
# `-oidc-*` args reference those names via $(...). They MUST be spelled exactly as below.
|
||||
#
|
||||
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
|
||||
# ── THE URLS ARE NOT HERE, AND MUST NOT BE PUT BACK (2026-09-07) ─────────────────────────────
|
||||
# OIDC_ISSUER_URL and OIDC_CALLBACK_URL are ENVIRONMENT-SPECIFIC and NON-SECRET. They live in
|
||||
# `helmrelease.yaml` under `spec.values.env`, written as
|
||||
# https://keycloak.${BASE_DOMAIN}/realms/homelab
|
||||
# https://headlamp.${BASE_DOMAIN}/oidc-callback
|
||||
# so Flux's postBuild `${BASE_DOMAIN}` substitution resolves them per environment. They used to be
|
||||
# keys in this Secret; substitution CANNOT reach inside ciphertext, so both were frozen at the apex
|
||||
# `home.keithjackson.dev` and PROD pointed Headlamp at DEV's Keycloak (192.168.1.53 — on the dev LAN
|
||||
# behind pfSense, unroutable from prod's 192.168.2.0/24). Every prod login failed with
|
||||
# dial tcp 192.168.1.53:443: i/o timeout on .../.well-known/openid-configuration
|
||||
# Dev only ever looked correct because dev IS the apex. Adding either key back here re-breaks prod.
|
||||
#
|
||||
# ONE SOURCE PER VARIABLE: never define a name in BOTH this Secret and `spec.values.env` — an
|
||||
# explicit `env:` entry silently WINS over the same name from `envFrom`, hiding which one is live.
|
||||
#
|
||||
# The `OIDC_CLIENT_SECRET` value MUST equal the `headlamp-client-secret` placed in
|
||||
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
|
||||
# Keycloak `headlamp` client) — same cross-namespace mirror pattern as grafana/gitea (a Secret
|
||||
# cannot be shared across namespaces, so the one value is stored in two encrypted files).
|
||||
@@ -18,7 +30,7 @@
|
||||
# HAND-OFF STEPS (operator):
|
||||
# (a) Use the SAME headlamp-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
|
||||
# (b) Copy to: platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
||||
# (c) Fill `clientSecret`; encrypt:
|
||||
# (c) Fill `OIDC_CLIENT_SECRET`; encrypt:
|
||||
# sops -e -i platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
||||
# (d) It is already listed under `resources:` in platform/headlamp/kustomization.yaml.
|
||||
# =============================================================================
|
||||
@@ -32,14 +44,12 @@ stringData:
|
||||
# KEY NAMES ARE LOAD-BEARING. The chart does NOT rename these — it `envFrom`s this Secret
|
||||
# verbatim, so each key becomes a container env var of the SAME name, and the chart's OIDC args
|
||||
# reference them by exact name: `-oidc-client-id=$(OIDC_CLIENT_ID)`,
|
||||
# `-oidc-client-secret=$(OIDC_CLIENT_SECRET)`, `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`,
|
||||
# `-oidc-scopes=$(OIDC_SCOPES)`. If a key is misnamed (e.g. camelCase `issuerURL`), the env var
|
||||
# `OIDC_ISSUER_URL` is undefined, K8s leaves the literal string `$(OIDC_ISSUER_URL)` in the arg,
|
||||
# and Headlamp's OIDC discovery fails with `unsupported protocol scheme ""`. Use these EXACT keys.
|
||||
# Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
|
||||
# `-oidc-client-secret=$(OIDC_CLIENT_SECRET)`, `-oidc-scopes=$(OIDC_SCOPES)`. If a key is misnamed
|
||||
# (e.g. camelCase `clientID`), the env var is undefined, K8s leaves the LITERAL string
|
||||
# `$(OIDC_CLIENT_ID)` in the arg — it does NOT fail loudly — and OIDC login breaks. Use these
|
||||
# EXACT keys. Environment-INVARIANT, non-secret values stay here simply because the chart wants a
|
||||
# single envFrom source; anything that varies per environment belongs in helmrelease.yaml `env:`.
|
||||
OIDC_CLIENT_ID: headlamp
|
||||
OIDC_ISSUER_URL: https://keycloak.home.keithjackson.dev/realms/homelab
|
||||
OIDC_SCOPES: "openid email profile"
|
||||
OIDC_CALLBACK_URL: https://headlamp.home.keithjackson.dev/oidc-callback
|
||||
# The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
|
||||
OIDC_CLIENT_SECRET: REPLACE-ME
|
||||
@@ -58,16 +58,50 @@ spec:
|
||||
config:
|
||||
inCluster: true
|
||||
oidc:
|
||||
# OIDC config (OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES /
|
||||
# OIDC_CALLBACK_URL) is supplied via an EXISTING SOPS-encrypted Secret consumed by name only
|
||||
# (R-IDP-04) — the chart envFrom's it. The Secret keys ARE the env var names (no renaming),
|
||||
# and the chart's `-oidc-*` args reference them via $(...), e.g.
|
||||
# `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`; a camelCase key would leave that arg unexpanded
|
||||
# and break OIDC login (`unsupported protocol scheme ""`). Nothing sensitive is rendered here.
|
||||
# OIDC config reaches the container as env vars whose NAMES ARE LOAD-BEARING: the chart's
|
||||
# args reference them via $(...) — `-oidc-client-id=$(OIDC_CLIENT_ID)`,
|
||||
# `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`, `-oidc-callback-url=$(OIDC_CALLBACK_URL)`, … — so
|
||||
# they MUST be exactly OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES /
|
||||
# OIDC_CALLBACK_URL. A misnamed or absent name does NOT fail: Kubernetes leaves the LITERAL
|
||||
# string `$(OIDC_ISSUER_URL)` in the arg and login dies with `unsupported protocol scheme ""`.
|
||||
#
|
||||
# There are exactly TWO sources, with NO variable served by both (a name defined in `env:`
|
||||
# would silently WIN over the same name coming from `envFrom`, so overlap is forbidden here):
|
||||
# • envFrom this SOPS Secret → OIDC_CLIENT_ID, OIDC_SCOPES, OIDC_CLIENT_SECRET
|
||||
# • the `env:` block below → OIDC_ISSUER_URL, OIDC_CALLBACK_URL
|
||||
# The Secret is consumed by name only (R-IDP-04); nothing sensitive is rendered here.
|
||||
externalSecret:
|
||||
enabled: true
|
||||
name: headlamp-oidc
|
||||
hasScopes: true
|
||||
# ── PER-ENVIRONMENT OIDC URLs (2026-09-07 fix) ───────────────────────────────────────────────
|
||||
# These two used to be keys INSIDE headlamp-oidc-credentials.sops.yaml. That was the bug: Flux's
|
||||
# `${BASE_DOMAIN}` postBuild substitution operates on the RENDERED manifest text and can never
|
||||
# reach inside an encrypted Secret, so both were frozen at the apex `home.keithjackson.dev`.
|
||||
# Dev is the apex, so dev looked fine; PROD (BASE_DOMAIN = prod.home.keithjackson.dev) therefore
|
||||
# pointed Headlamp at DEV's Keycloak — 192.168.1.53, on the dev LAN behind pfSense, unroutable
|
||||
# from prod's 192.168.2.0/24 — and every login died with
|
||||
# dial tcp 192.168.1.53:443: i/o timeout on .../.well-known/openid-configuration
|
||||
# An issuer URL and a callback URL are PUBLIC. They belong in cleartext, where substitution works.
|
||||
#
|
||||
# [parity] OIDC_ISSUER_URL MUST equal the kube-apiserver's `oidc-issuer-url`, which is an
|
||||
# INSTALL-TIME k3s flag derived from `k3s_base_domain` (infra/ansible roles/k3s_server/defaults +
|
||||
# inventory/group_vars/k3s_<env>/vars.yml), NOT from this ConfigMap. Headlamp forwards the user's
|
||||
# id_token to the apiserver as the bearer, so an issuer mismatch = every request 401s. Both sides
|
||||
# are keyed off the same per-environment domain (BASE_DOMAIN == k3s_base_domain), which is what
|
||||
# keeps them in step — dev home.keithjackson.dev, prod prod.home.keithjackson.dev.
|
||||
#
|
||||
# NOTE: naming OIDC_CALLBACK_URL here also makes the chart EMIT `-oidc-callback-url=$(…)`, which
|
||||
# it previously omitted (the arg is gated on the value being set via `env:`/`config.oidc`, and the
|
||||
# Secret key alone did not trip that gate — so the Secret's callback URL was dead weight). The
|
||||
# value is byte-identical to the single redirectUri registered on the Keycloak `headlamp` client
|
||||
# (platform/keycloak/keycloak-realm-import.yaml, also `${BASE_DOMAIN}`-templated), which is the
|
||||
# only URI Keycloak will accept, so making it explicit cannot change behaviour in either env.
|
||||
env:
|
||||
- name: OIDC_ISSUER_URL
|
||||
value: https://keycloak.${BASE_DOMAIN}/realms/homelab
|
||||
- name: OIDC_CALLBACK_URL
|
||||
value: https://headlamp.${BASE_DOMAIN}/oidc-callback
|
||||
# PER-USER RBAC: do NOT grant Headlamp's ServiceAccount cluster-admin. User requests are
|
||||
# authorized by their forwarded OIDC token against the existing oidc:* group bindings.
|
||||
serviceAccount:
|
||||
|
||||
Reference in new issue
Block a user