unkin-agent
a9a66a07b1
## Why repospawner v0.1.0 is built and its Vault kubernetes auth role is applied, but nothing deploys it. It turns a "I want a new repository" request into a terraform-git pull request, follows that PR to merge, and optionally activates the repo in Woodpecker, so the review gate stays where it is instead of moving into an agent's hands. ## How - Add `apps/base/repospawner/`: namespace, ServiceAccount `repospawner`, `default` VaultAuth for VSO, and a namespaced Role/RoleBinding granting jobs create/get/list/watch/delete plus pods and pods/log reads (mirrors mediamover). - Deployment pinned to `artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0`, one replica with the `Recreate` strategy because request state is in memory and rebuilt from Job labels; the same image reference is passed down as `REPOSPAWNER_IMAGE` so the spawned Jobs stay in step. - Mount a projected `audience: vault` service account token at `/var/run/secrets/vault` — the app logs into Vault natively rather than through VSO — and the `repospawner-woodpecker` Secret at `/etc/repospawner/woodpecker`, optional so the server still starts and refuses `woodpecker: true` with 503 when it is absent. - Two VaultStaticSecrets: `oauth-credentials` from `kv/kubernetes/namespace/repospawner/default/oauth-credentials` and `repospawner-woodpecker` (key `token`) from `.../default/woodpecker`, with reloader annotations on both consumers. - oauth2-proxy front door on the watchstate/mediamark pattern, gated on `akP-repospawner-admin` via the `ak_groups` claim and re-checked by the app from `X-Forwarded-Groups`; public `repospawner.unkin.net` on the reflected wildcard and internal `repospawner.k8s.syd1.au.unkin.net` on `vault-issuer`, both routed to the oauth2 Service. - Register the overlay in the platform ApplicationSet and AppProject, and append `repospawner` to the wildcard Certificate's two reflector namespace lists. Depends on the terraform-authentik `repospawner` client being applied and `kv/kubernetes/namespace/repospawner/default/oauth-credentials` + `.../woodpecker` being seeded. Reviewed-on: #445 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
46 lines
2.5 KiB
YAML
46 lines
2.5 KiB
YAML
---
|
|
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
|
|
# from the oauth-credentials Secret). Single auth front for repospawner on both
|
|
# host names; access is gated here on the akP-repospawner-admin Authentik group
|
|
# and re-checked by the app from X-Forwarded-Groups.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: repospawner-oauth2-env
|
|
namespace: repospawner
|
|
data:
|
|
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
|
OAUTH2_PROXY_PROVIDER: "oidc"
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/repospawner/"
|
|
# Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
|
|
# derives scheme+host per request from X-Forwarded-Proto/Host, so the same
|
|
# deployment serves BOTH the external repospawner.unkin.net and internal
|
|
# repospawner.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
|
|
# registered on the Authentik provider (terraform-authentik, separate PR).
|
|
OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
|
|
OAUTH2_PROXY_UPSTREAMS: "http://repospawner.repospawner.svc.cluster.local:8080/"
|
|
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
|
# Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
|
|
# then emits it as a single comma-joined X-Forwarded-Groups header.
|
|
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
|
OAUTH2_PROXY_ALLOWED_GROUPS: "akP-repospawner-admin"
|
|
# Forward identity + groups to repospawner as X-Forwarded-{User,Email,Groups}.
|
|
# NOTE: set-xauthrequest is intentionally NOT set -- it only populates
|
|
# auth_request *response* headers, which never reach a proxied upstream.
|
|
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
|
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
|
# Authentik hardcodes email_verified=false in the id_token; authorization is
|
|
# enforced via ak_groups, so accepting the unverified email is safe.
|
|
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
|
|
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
|
# One cookie domain per host (a single parent-domain cookie can't span
|
|
# unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
|
|
# matching the request host. Whitelist both so post-auth `rd` redirects to
|
|
# either front door are honoured.
|
|
OAUTH2_PROXY_COOKIE_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_WHITELIST_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
|
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
|
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
|
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|