Onboard watchstate into Authentik (oauth2-proxy, admin-team-gated) #26

2026-08-25T20:12:03+10:00

unkin-agent commented

2026-08-25 20:12:03 +10:00

Why

Onboard watchstate (internal media watch-state sync admin tool) into Authentik so it can sit behind oauth2-proxy doing OIDC against Authentik (issuer identity.k8s.syd1.au.unkin.net). Deployed in-cluster at watchstate.k8s.syd1.au.unkin.net (no public domain); access must be restricted to the admin team only.

How

Mirrors the existing in-cluster admin-tool pattern (logviewer / traefik) 1:1:

config/providers_oauth2/watchstate.yaml — confidential OAuth2/OIDC provider + application. Redirect URI https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback (oauth2-proxy), openid/email/profile scopes, launch URL set. client_secret read from Vault kv kubernetes/namespace/watchstate/default/oauth-credentials (seeded out of band, not committed).
config/permissions/akP-watchstate-admin.yaml — permission group bound to the watchstate application; the module turns this into the gating authentik_policy_binding, so only members (and children) can authorize.
config/roles/akR-global-admin.yaml — nest akP-watchstate-admin into the existing admin-team role, so exactly the global admins reach watchstate. No new admin group created.

Validation

yamllint + pre-commit (end-of-file/trailing-whitespace/yamllint) pass locally. tofu-validate/tflint run in CI plan (need provider init). No HCL touched.

Note: the kv secret must be pre-seeded with a client_secret key before apply/plan resolves the data source.

## Why Onboard **watchstate** (internal media watch-state sync admin tool) into Authentik so it can sit behind oauth2-proxy doing OIDC against Authentik (issuer identity.k8s.syd1.au.unkin.net). Deployed in-cluster at watchstate.k8s.syd1.au.unkin.net (no public domain); access must be restricted to the admin team only. ## How Mirrors the existing in-cluster admin-tool pattern (logviewer / traefik) 1:1: - `config/providers_oauth2/watchstate.yaml` — confidential OAuth2/OIDC provider + application. Redirect URI `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback` (oauth2-proxy), openid/email/profile scopes, launch URL set. client_secret read from Vault kv `kubernetes/namespace/watchstate/default/oauth-credentials` (seeded out of band, not committed). - `config/permissions/akP-watchstate-admin.yaml` — permission group bound to the watchstate application; the module turns this into the gating `authentik_policy_binding`, so only members (and children) can authorize. - `config/roles/akR-global-admin.yaml` — nest `akP-watchstate-admin` into the existing admin-team role, so exactly the global admins reach watchstate. No new admin group created. ## Validation yamllint + pre-commit (end-of-file/trailing-whitespace/yamllint) pass locally. tofu-validate/tflint run in CI plan (need provider init). No HCL touched. Note: the kv secret must be pre-seeded with a `client_secret` key before apply/plan resolves the data source.

unkin-agent added 1 commit 2026-08-25 20:12:03 +10:00

Onboard watchstate into Authentik for oauth2-proxy

ci/woodpecker/pr/plan Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

db5bf753b5

watchstate is an internal media watch-state sync admin tool deployed at
watchstate.k8s.syd1.au.unkin.net behind oauth2-proxy (OIDC against
Authentik). Add the OAuth2/OIDC provider + application mirroring the
logviewer/traefik in-cluster admin pattern, gate it with the
akP-watchstate-admin permission group bound to the app, and nest that
permission into the akR-global-admin role so only the admin team can
authorize.

unkin-agent added 1 commit 2026-08-25 20:15:55 +10:00

Retrigger plan: oauth-credentials kv secret now seeded

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

00f835ac8c

benvin merged commit 31b92b2b93 into main

2026-08-25 20:48:02 +10:00

benvin deleted branch benvin/watchstate-oidc

2026-08-25 20:48:02 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#26