jakman85andClaude Opus 4.8
071123ae43
Headlamp OIDC login failed with `unsupported protocol scheme ""`. The kubernetes-sigs/headlamp chart `envFrom`s the headlamp-oidc Secret verbatim and renders args like `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`, so the Secret keys must be the exact env var names. The keys were camelCase (clientID/issuerURL/scopes/callbackURL/clientSecret), following the mistaken `.example`, so `OIDC_ISSUER_URL` was never defined. Kubernetes left the literal `$(OIDC_ISSUER_URL)` in the arg and Headlamp's OIDC discovery hit `Get "$(OIDC_ISSUER_URL)/.well-known/openid-configuration": unsupported protocol scheme ""`. Rename the SOPS Secret keys to OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (values unchanged, still SOPS/age-encrypted). Fix the `.example` and README so the correct, load-bearing key names are documented and the camelCase footgun can't recur. Co-Authored-By: Claude Opus 4.8 <[email protected]>
46 lines
2.9 KiB
Plaintext
46 lines
2.9 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
|
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
|
#
|
|
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
|
|
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
|
|
# THIS Secret, so ALL OIDC env (OIDC_CLIENT_ID/OIDC_CLIENT_SECRET/OIDC_ISSUER_URL/OIDC_SCOPES/OIDC_CALLBACK_URL) live here,
|
|
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart `envFrom`s this Secret VERBATIM, so
|
|
# the KEYS ARE the container env var names — they MUST be exactly OIDC_CLIENT_ID / OIDC_CLIENT_SECRET
|
|
# / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL (the chart's `-oidc-*` args reference those
|
|
# names via $(...)). There is NO camelCase→OIDC_ mapping; a mismatched key breaks OIDC login.
|
|
#
|
|
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
|
|
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
|
|
# Keycloak `headlamp` client) — same cross-namespace mirror pattern as grafana/gitea (a Secret
|
|
# cannot be shared across namespaces, so the one value is stored in two encrypted files).
|
|
#
|
|
# HAND-OFF STEPS (operator):
|
|
# (a) Use the SAME headlamp-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
|
|
# (b) Copy to: platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
|
# (c) Fill `clientSecret`; encrypt:
|
|
# sops -e -i platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
|
# (d) It is already listed under `resources:` in platform/headlamp/kustomization.yaml.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: headlamp-oidc
|
|
namespace: headlamp
|
|
type: Opaque
|
|
stringData:
|
|
# KEY NAMES ARE LOAD-BEARING. The chart does NOT rename these — it `envFrom`s this Secret
|
|
# verbatim, so each key becomes a container env var of the SAME name, and the chart's OIDC args
|
|
# reference them by exact name: `-oidc-client-id=$(OIDC_CLIENT_ID)`,
|
|
# `-oidc-client-secret=$(OIDC_CLIENT_SECRET)`, `-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)`,
|
|
# `-oidc-scopes=$(OIDC_SCOPES)`. If a key is misnamed (e.g. camelCase `issuerURL`), the env var
|
|
# `OIDC_ISSUER_URL` is undefined, K8s leaves the literal string `$(OIDC_ISSUER_URL)` in the arg,
|
|
# and Headlamp's OIDC discovery fails with `unsupported protocol scheme ""`. Use these EXACT keys.
|
|
# Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
|
|
OIDC_CLIENT_ID: headlamp
|
|
OIDC_ISSUER_URL: https://keycloak.home.keithjackson.dev/realms/homelab
|
|
OIDC_SCOPES: "openid email profile"
|
|
OIDC_CALLBACK_URL: https://headlamp.home.keithjackson.dev/oidc-callback
|
|
# The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
|
|
OIDC_CLIENT_SECRET: REPLACE-ME
|