75 lines
4.2 KiB
YAML
75 lines
4.2 KiB
YAML
---
|
|
# oauth2-proxy — forward-auth for apps WITHOUT usable OIDC (PiHole, *arr UIs, qBittorrent, Homepage,
|
|
# Prometheus, Alertmanager, Hubble UI — ADR-0014). Authenticates users against the Keycloak `homelab`
|
|
# realm, then the Gateway ext-auth lets the request through only for an authenticated session
|
|
# (R-IDP-02: no management UI unauthenticated). Chart image is quay.io/oauth2-proxy (not Bitnami).
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: oauth2-proxy
|
|
version: ">=10.0.0 <11.0.0" # k8s-1.36 catch-up (app v7.15.x). Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: ${OAUTH2_PROXY_REPLICAS} # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
|
|
config:
|
|
# client-id / client-secret / cookie-secret from the SOPS secret (name only). client-id +
|
|
# client-secret MUST match the realm's `oauth2-proxy` client (keycloak-realm-clients secret).
|
|
existingSecret: oauth2-proxy-credentials
|
|
extraArgs:
|
|
provider: oidc
|
|
oidc-issuer-url: https://keycloak.home.keithjackson.dev/realms/homelab
|
|
# Forward-auth (ext-auth) mode: no upstream app; return 202 for an authenticated session so the
|
|
# Gateway ext-authz can allow/deny. Auth headers are surfaced to the backend.
|
|
reverse-proxy: "true"
|
|
upstream: static://202
|
|
set-xauthrequest: "true"
|
|
pass-access-token: "true"
|
|
email-domain: "*"
|
|
# Single sign-in/callback host for all forward-auth-protected services on the platform zone.
|
|
redirect-url: https://auth.home.keithjackson.dev/oauth2/callback
|
|
whitelist-domain: ".home.keithjackson.dev"
|
|
cookie-domain: ".home.keithjackson.dev"
|
|
cookie-secure: "true"
|
|
# Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
|
|
# Keycloak `oauth2-proxy` client emits a `groups` claim (full.path=false => bare names like
|
|
# `platform-admins`, keycloak-realm-import.yaml). `--allowed-groups` below is the PLATFORM FLOOR:
|
|
# a valid Keycloak session is NOT enough — the user must ALSO be in `platform-admins`, or
|
|
# /oauth2/auth returns 403 and ext_authz denies (R-IDP-06). Every currently-onboarded
|
|
# forward-auth app (pihole, *arr, qbittorrent, homepage, prometheus, alertmanager, hubble)
|
|
# declares `groups: [platform-admins]` in its ServiceDefinition, so this floor matches them all.
|
|
# Per-ROUTE group differentiation (a future app allowing a different group) does NOT need a
|
|
# second proxy: the ext_authz filter appends `?allowed_groups=<group>` to /oauth2/auth from the
|
|
# HTTPRoute's `homelab.keithjackson.dev/auth-groups` annotation — oauth2-proxy honours the
|
|
# per-request query on top of this floor. See forward-auth-cec.yaml + README "opt-in".
|
|
oidc-groups-claim: groups
|
|
allowed-group: platform-admins # R-IDP-06 floor: authenticated AND in platform-admins (oauth2-proxy flag is singular --allowed-group, repeatable)
|
|
# Single Keycloak provider => skip the oauth2-proxy interstitial "Sign In" button and 302
|
|
# straight to Keycloak. Verified in-cluster: WITHOUT this, an ext_authz-denied browser request
|
|
# gets oauth2-proxy's HTML sign-in page (HTTP 403) instead of an immediate redirect (docs/15 UX).
|
|
skip-provider-button: "true"
|
|
scope: "openid email profile"
|
|
# Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
|
|
metrics:
|
|
enabled: true
|
|
# ENFORCEMENT (Phase 6): oauth2-proxy is the AUTHENTICATOR; the per-route ext_authz ENFORCEMENT is
|
|
# Gateway-side. On Cilium 1.16.5 the shared Gateway's Envoy config is a machine-owned, constantly
|
|
# regenerated CiliumEnvoyConfig (`gateway/cilium-gateway-shared`) that CANNOT be injected into,
|
|
# and native Gateway-API ExternalAuth (GEP-1494) ships in NO released Cilium version yet. The
|
|
# enforcement mechanism + the three wiring options are documented in README.md; the interim
|
|
# self-authored ext_authz listener is forward-auth-cec.yaml (a template, not yet Flux-wired).
|