jakman85andClaude Opus 4.8
3472f1d161
Lets users kubectl into the cluster via Keycloak SSO, mapping realm groups to cluster RBAC. The cert-based admin kubeconfig is untouched and remains a fully independent break-glass path (works even if Keycloak/OIDC is down). - keycloak-realm-import.yaml: new `kubernetes` PUBLIC client + PKCE (S256) — no client secret in any kubeconfig; kubelogin runs auth-code+PKCE to localhost. groups mapper + email/profile/roles scopes. - k8s-oidc-rbac.yaml (NEW, platform-config): ClusterRoleBindings oidc:platform-admins -> cluster-admin, oidc:viewers -> view. - k3s_server role: kube-apiserver-arg OIDC flags (issuer=homelab realm, client-id=kubernetes, username-claim=email + oidc: prefix, groups-claim=groups + oidc: prefix). No oidc-ca-file (nodes reach the issuer via the gateway VIP and trust the public LE cert). Applied via the rolling Restart k3s handler. Keycloak/RBAC land via Flux now; the API-server flags take effect on the next `ansible-playbook playbooks/k3s.yml` rolling restart (deferred until cluster load from the VM-import incident settles). Co-Authored-By: Claude Opus 4.8 <[email protected]>
infra/ — Phase 1 node provisioning (local KVM)
OpenTofu (libvirt) + cloud-init + Ansible bring up the 3-node k3s/Cilium cluster. See PHASE1-SCOPE.md. Spec: ../home-network-k3s/docs/02-environments-and-provisioning.md.