From f71dbdb689e9ee34389ccec708fb30b4e1e44df8 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Sun, 15 Mar 2026 14:55:53 -0500 Subject: [PATCH] Add Envoy Gateway cookie-based session persistence for Guacamole OIDC Fixes OIDC nonce validation failures with 2 replicas by using a BackendTrafficPolicy with cookie-based consistent hashing instead of Service-level ClientIP affinity (which doesn't work behind Envoy proxy). Co-Authored-By: Claude Opus 4.6 --- .../manifests/deployment-complete.yaml | 4 ---- apps/guacamole/manifests/envoy-gateway.yaml | 22 +++++++++++++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/apps/guacamole/manifests/deployment-complete.yaml b/apps/guacamole/manifests/deployment-complete.yaml index 666df43..ec2f8b0 100644 --- a/apps/guacamole/manifests/deployment-complete.yaml +++ b/apps/guacamole/manifests/deployment-complete.yaml @@ -227,10 +227,6 @@ metadata: component: client spec: type: ClusterIP - sessionAffinity: ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 3600 ports: - port: 8080 targetPort: http diff --git a/apps/guacamole/manifests/envoy-gateway.yaml b/apps/guacamole/manifests/envoy-gateway.yaml index a382bdf..ad686a7 100644 --- a/apps/guacamole/manifests/envoy-gateway.yaml +++ b/apps/guacamole/manifests/envoy-gateway.yaml @@ -74,3 +74,25 @@ spec: name: guacamole port: 8080 weight: 1 + +--- +# Cookie-based session persistence so OIDC nonce validation works across 2 replicas. +# Without this, the OIDC callback can hit a different pod than the one that generated +# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors. +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: guacamole-session-persistence + namespace: guacamole +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: HTTPRoute + name: guacamole + loadBalancer: + type: ConsistentHash + consistentHash: + type: Cookie + cookie: + name: GUAC_ROUTE + ttl: 3600s