unkin-agent
571c3c0320
Wire phase-1 plugin-based auth into both Jellyfin instances so browser users sign in via Authentik OIDC (jellyfin-plugin-sso) and native/app-password clients authenticate through the Authentik LDAP outpost (jellyfin-plugin-ldapauth), JIT-provisioning users. Both instances share the single Authentik "jellyfin" OAuth2 client, so the SSO config is identical; each reads the shared client_secret from its own namespace-scoped Vault path via a per-namespace VaultStaticSecret. - plugin-configmap.yaml: SSO-Auth.xml (OID provider "authentik", issuer identity.k8s.syd1.au.unkin.net/application/o/jellyfin/, EnableAllFolders, groups-claim role mapping akP-jellyfin-admin->admin / akP-jellyfin-user->user), LDAP-Auth.xml (server authentik-ldap.authentik.svc:6636 LDAPS, CreateUsersFromLdap), and branding.xml with a "Sign in with SSO" login link to /sso/OID/start/authentik. - statefulset.yaml: inject-plugin-config initContainer renders the XMLs into /config/plugins/configurations/, substituting client_secret / ldap_bind_password from the VSO-synced Secret (never committed) before Jellyfin starts. - vaultstaticsecret.yaml: per-namespace oauth-credentials VSS. Image tag is intentionally left at v0.1.3; the plugin DLLs land via a separate jellyfin-ha release and a follow-up pin bump.
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
---
|
|
# restic repository password for the k8up cheeztv-config backups. Seeded at
|
|
# kv/kubernetes/namespace/cheeztv/default/k8up-restic (key: password); the
|
|
# default k8s role's templated policy already grants read here, so no
|
|
# terraform-vault change is needed. VSO syncs it into the cheeztv-k8up-restic
|
|
# Secret that the Schedule references via backend.repoPasswordSecretRef.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: cheeztv-k8up-restic
|
|
namespace: cheeztv
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: cheeztv-k8up-restic
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/cheeztv/default/k8up-restic
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Shared Authentik "jellyfin" OAuth2 client secret (key: client_secret) plus the
|
|
# LDAP outpost bind password (key: ldap_bind_password) for the auth plugins.
|
|
# The default k8s role's templated policy is namespace-scoped
|
|
# (kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*), so each instance
|
|
# reads its own namespace path; the SAME shared values must be seeded at both
|
|
# fafflix and cheeztv paths. VSO syncs into the oauth-credentials Secret, whose
|
|
# keys the inject-plugin-config initContainer substitutes into the plugin XML.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: cheeztv
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/cheeztv/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|