mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
1ab292e185
GITLAB_OMNIBUS_CONFIG (gitlab_rails['omniauth_providers'] = [...]) is
an omnibus-Docker-image-only convention. This chart's CNG webservice
image never processes it - confirmed via gitlab/charts/gitlab/
templates/_omniauth.tpl, which only reads
global.appConfig.omniauth.providers (a list of {secret,key} refs, each
pointing at a Secret key holding a whole YAML-encoded provider block
loaded via Ruby's YAML.load_file). So GITLAB_OMNIBUS_CONFIG was always
a silent no-op on both home and VPS - neither ever actually had SSO
configured despite gitlab-oidc-secret existing and looking correct.
Yesterday's fix for 'FailedMount: references non-existent secret key:
provider' removed the providers: list entirely instead of populating
that key - stopped the crash, but also silently deleted the only real
OIDC config path on both sites (no error, login page just lost its SSO
button). This restores providers: on both, and gitlab-oidc-secret's
ExternalSecret template now actually renders a provider key containing
a real YAML provider block (with the templated client_id/secret
substituted in), matching what _omniauth.tpl expects.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
62 lines
2.2 KiB
YAML
62 lines
2.2 KiB
YAML
# Shares the same Authentik OAuth2 provider/client_id as home's GitLab
|
|
# (infrastructure/authentik/gitlab-blueprint.yaml has both redirect_uris
|
|
# registered). Same Vault path (secret/gitlab-oauth) home's copy reads
|
|
# from - vps-eso-reader policy widened to allow this one extra path
|
|
# (infrastructure/vps-eso/manifests/clustersecretstore.yaml's policy,
|
|
# applied live via vault CLI, not git-tracked - matches how every other
|
|
# Vault policy/auth-method in this repo is set up).
|
|
#
|
|
# `provider` key added 2026-08-21: found live that GITLAB_OMNIBUS_CONFIG
|
|
# (this app's values.yaml extraEnv) is an omnibus-image-only convention
|
|
# the CNG webservice image never processes - see the matching comment
|
|
# in apps/gitlab/manifests/external-secret-oidc.yaml (home) for the
|
|
# full story. The real mechanism needs this key to hold a whole
|
|
# YAML-encoded provider block, not raw client_id/secret strings.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-oidc
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-backend
|
|
target:
|
|
name: gitlab-oidc-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
GITLAB_OIDC_CLIENT_ID: "{{ .clientId }}"
|
|
GITLAB_OIDC_CLIENT_SECRET: "{{ .clientSecret }}"
|
|
provider: |
|
|
name: openid_connect
|
|
label: Authentik
|
|
args:
|
|
name: openid_connect
|
|
scope:
|
|
- openid
|
|
- profile
|
|
- email
|
|
response_type: code
|
|
issuer: 'https://auth.kube.huskypup.net/application/o/gitlab/'
|
|
discovery: true
|
|
client_auth_method: query
|
|
uid_field: sub
|
|
send_scope_to_token_endpoint: true
|
|
pkce: true
|
|
client_options:
|
|
identifier: '{{ .clientId }}'
|
|
secret: '{{ .clientSecret }}'
|
|
redirect_uri: 'https://gitlab.vps.huskypup.net/users/auth/openid_connect/callback'
|
|
data:
|
|
- secretKey: clientId
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-id
|
|
- secretKey: clientSecret
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-secret
|