mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
1ab292e185
GITLAB_OMNIBUS_CONFIG (gitlab_rails['omniauth_providers'] = [...]) is
an omnibus-Docker-image-only convention. This chart's CNG webservice
image never processes it - confirmed via gitlab/charts/gitlab/
templates/_omniauth.tpl, which only reads
global.appConfig.omniauth.providers (a list of {secret,key} refs, each
pointing at a Secret key holding a whole YAML-encoded provider block
loaded via Ruby's YAML.load_file). So GITLAB_OMNIBUS_CONFIG was always
a silent no-op on both home and VPS - neither ever actually had SSO
configured despite gitlab-oidc-secret existing and looking correct.
Yesterday's fix for 'FailedMount: references non-existent secret key:
provider' removed the providers: list entirely instead of populating
that key - stopped the crash, but also silently deleted the only real
OIDC config path on both sites (no error, login page just lost its SSO
button). This restores providers: on both, and gitlab-oidc-secret's
ExternalSecret template now actually renders a provider key containing
a real YAML provider block (with the templated client_id/secret
substituted in), matching what _omniauth.tpl expects.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
2.7 KiB
YAML
70 lines
2.7 KiB
YAML
# gitlab-oidc-secret was a manually kubectl-created plain Secret (never
|
|
# git-tracked, never rotatable, no record of what it was) - found and
|
|
# fixed 2026-08-20 alongside infrastructure/authentik/gitlab-blueprint.yaml
|
|
# (same value, same Vault path - see that file for the full story).
|
|
#
|
|
# `provider` key added 2026-08-21: found live that GITLAB_OMNIBUS_CONFIG's
|
|
# `gitlab_rails['omniauth_providers'] = [...]` (still set in this app's
|
|
# values.yaml's extraEnv, for reference/documentation only at this point)
|
|
# is an omnibus-image-only convention - the CNG webservice image this
|
|
# chart actually runs never processes it, so it was always a no-op and
|
|
# GitLab never had SSO configured despite it looking configured. The
|
|
# REAL mechanism (gitlab/charts/gitlab/templates/_omniauth.tpl in the
|
|
# chart) is global.appConfig.omniauth.providers: a list of
|
|
# {secret, key} refs, each pointing at a Secret key whose value is a
|
|
# whole YAML-encoded provider block (loaded via Ruby's YAML.load_file
|
|
# at container start, baked into gitlab.yml) - not raw client_id/secret
|
|
# strings. This is also why the `providers:` list got removed entirely
|
|
# a day earlier chasing a "FailedMount: references non-existent secret
|
|
# key: provider" error: the fix should have been to populate that key
|
|
# correctly (this), not remove the reference to it - doing so silently
|
|
# killed SSO on both home and VPS GitLab (no error, the login page just
|
|
# had no SSO button).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-oidc
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-backend
|
|
target:
|
|
name: gitlab-oidc-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
GITLAB_OIDC_CLIENT_ID: "{{ .clientId }}"
|
|
GITLAB_OIDC_CLIENT_SECRET: "{{ .clientSecret }}"
|
|
provider: |
|
|
name: openid_connect
|
|
label: Authentik
|
|
args:
|
|
name: openid_connect
|
|
scope:
|
|
- openid
|
|
- profile
|
|
- email
|
|
response_type: code
|
|
issuer: 'https://auth.kube.huskypup.net/application/o/gitlab/'
|
|
discovery: true
|
|
client_auth_method: query
|
|
uid_field: sub
|
|
send_scope_to_token_endpoint: true
|
|
pkce: true
|
|
client_options:
|
|
identifier: '{{ .clientId }}'
|
|
secret: '{{ .clientSecret }}'
|
|
redirect_uri: 'https://gitlab.kube.huskypup.net/users/auth/openid_connect/callback'
|
|
data:
|
|
- secretKey: clientId
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-id
|
|
- secretKey: clientSecret
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-secret
|