From 2f80c4a5360f0bce0e9c7255edceba607a20a3c0 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 15:09:47 +1000 Subject: [PATCH] Onboard repospawner UI to Authentik OIDC Add an OAuth2/OIDC provider + application for the repospawner operator tool, fronted by oauth2-proxy, and gate it on a new akP-repospawner-admin permission group nested under akR-global-admin (mirrors the watchstate precedent). --- config/permissions/akP-repospawner-admin.yaml | 3 +++ config/providers_oauth2/repospawner.yaml | 25 +++++++++++++++++++ config/roles/akR-global-admin.yaml | 1 + 3 files changed, 29 insertions(+) create mode 100644 config/permissions/akP-repospawner-admin.yaml create mode 100644 config/providers_oauth2/repospawner.yaml diff --git a/config/permissions/akP-repospawner-admin.yaml b/config/permissions/akP-repospawner-admin.yaml new file mode 100644 index 0000000..caf3da6 --- /dev/null +++ b/config/permissions/akP-repospawner-admin.yaml @@ -0,0 +1,3 @@ +# Permission group akP-repospawner-admin (name = filename). Grants admin +# access to repospawner: bound to the repospawner application, gating the UI. +application: repospawner diff --git a/config/providers_oauth2/repospawner.yaml b/config/providers_oauth2/repospawner.yaml new file mode 100644 index 0000000..0004fa2 --- /dev/null +++ b/config/providers_oauth2/repospawner.yaml @@ -0,0 +1,25 @@ +# OAuth2/OIDC provider + application for repospawner (the internal repository +# provisioning admin tool, served at +# https://repospawner.k8s.syd1.au.unkin.net (cluster hostname) and +# https://repospawner.unkin.net (external hostname) in the repospawner namespace). +# An oauth2-proxy in front of the UI performs the OIDC login; access is gated on +# the user's hierarchical ak_groups claim (akP-repospawner-admin). +# client_secret is read from Vault (seeded out of band), never committed. +name: repospawner +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: repospawner +launch_url: https://repospawner.unkin.net/ +client_secret_vault: + mount: kv + path: kubernetes/namespace/repospawner/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://repospawner.k8s.syd1.au.unkin.net/oauth2/callback + - matching_mode: strict + url: https://repospawner.unkin.net/oauth2/callback diff --git a/config/roles/akR-global-admin.yaml b/config/roles/akR-global-admin.yaml index 15b9c61..62bff92 100644 --- a/config/roles/akR-global-admin.yaml +++ b/config/roles/akR-global-admin.yaml @@ -8,6 +8,7 @@ permissions: - akP-traefik-admin - akP-logviewer-admin - akP-watchstate-admin + - akP-repospawner-admin # arrstack has no admin tier (it is a proxy front door); grant global admins # the front door plus every per-app entitlement so they reach all media apps. - akP-arrstack-user