Add NetBox OAuth2/OIDC provider + application #11

2026-07-28T16:45:35+10:00

unkinben commented

2026-07-28 16:45:35 +10:00

Why

NetBox is being deployed to k8s (argocd-apps PR) with Authentik SSO. NetBox authenticates via python-social-auth's OpenIdConnectAuth backend against Authentik.

Change

Add config/providers_oauth2/netbox.yaml: confidential OAuth2 provider + application, client_id: netbox, openid/email/profile scope mappings, strict redirect to https://netbox.k8s.syd1.au.unkin.net/oauth/complete/oidc/.
client_secret is read from Vault at kv/kubernetes/namespace/netbox/default/oauth-credentials (key client_secret). The terraform-authentik runner policy already grants kv/.../namespace/+/default/oauth-credentials, so no terraform-vault change is needed.

Manual step (ordered)

The Vault secret must be seeded before apply (the module reads it):

vault kv put kv/kubernetes/namespace/netbox/default/oauth-credentials \
  client_secret='<random>' \
  oidc.yaml='SOCIAL_AUTH_OIDC_SECRET: "<same random>"'

(The oidc.yaml key is consumed by NetBox itself; Authentik only reads client_secret.) The application slug resolves to netbox, so NetBox's SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = https://identity.k8s.syd1.au.unkin.net/application/o/netbox/.

Merge order

Independent of the argocd-apps PR; SSO only works once both are applied and the secret is seeded. Deploying NetBox without this just means OIDC login is unavailable until applied.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why NetBox is being deployed to k8s (argocd-apps PR) with Authentik SSO. NetBox authenticates via python-social-auth's `OpenIdConnectAuth` backend against Authentik. ## Change - Add `config/providers_oauth2/netbox.yaml`: confidential OAuth2 provider + application, `client_id: netbox`, openid/email/profile scope mappings, strict redirect to `https://netbox.k8s.syd1.au.unkin.net/oauth/complete/oidc/`. - `client_secret` is read from Vault at `kv/kubernetes/namespace/netbox/default/oauth-credentials` (key `client_secret`). The terraform-authentik runner policy already grants `kv/.../namespace/+/default/oauth-credentials`, so no terraform-vault change is needed. ## Manual step (ordered) The Vault secret must be seeded **before** apply (the module reads it): ``` vault kv put kv/kubernetes/namespace/netbox/default/oauth-credentials \ client_secret='<random>' \ oidc.yaml='SOCIAL_AUTH_OIDC_SECRET: "<same random>"' ``` (The `oidc.yaml` key is consumed by NetBox itself; Authentik only reads `client_secret`.) The application slug resolves to `netbox`, so NetBox's `SOCIAL_AUTH_OIDC_OIDC_ENDPOINT` = `https://identity.k8s.syd1.au.unkin.net/application/o/netbox/`. ## Merge order Independent of the argocd-apps PR; SSO only works once both are applied and the secret is seeded. Deploying NetBox without this just means OIDC login is unavailable until applied. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-28 16:45:36 +10:00

Add NetBox OAuth2/OIDC provider + application

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline failed

Details

8fa4192cc6

NetBox is being deployed to k8s (argocd-apps) with Authentik SSO via
python-social-auth's OpenIdConnectAuth backend. Add the confidential OAuth2
provider/application (client_id netbox, openid/email/profile scopes, strict
redirect to /oauth/complete/oidc/); the client_secret is read from Vault at
kubernetes/namespace/netbox/default/oauth-credentials (the terraform-authentik
runner policy already covers namespace/+/default/oauth-credentials).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-28 16:49:43 +10:00

Re-trigger CI after seeding netbox oauth-credentials in Vault

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline failed

Details

7d0b8416a7

The plan step reads the netbox client_secret from Vault at plan time; it now
exists at kv/kubernetes/namespace/netbox/default/oauth-credentials.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben commented

2026-07-28 16:53:02 +10:00

CI plan is red due to a transient Authentik API outage, not this change: the Authentik API returns HTML Server Error (500) while refreshing existing applications (saml["ceph"], oauth2["litellm"], oauth2["argocd"], oauth2["rancher"]). The NetBox additions resolve cleanly in the same run — data.vault_kv_secret_v2.oauth2["netbox"]: Read complete [id=kv/data/kubernetes/namespace/netbox/default/oauth-credentials] and the netbox flow/scope data sources all read OK. The Vault secret is already seeded. Re-run once the Authentik API recovers.

CI `plan` is red due to a transient Authentik API outage, not this change: the Authentik API returns HTML `Server Error` (500) while **refreshing existing** applications (`saml["ceph"]`, `oauth2["litellm"]`, `oauth2["argocd"]`, `oauth2["rancher"]`). The NetBox additions resolve cleanly in the same run — `data.vault_kv_secret_v2.oauth2["netbox"]: Read complete [id=kv/data/kubernetes/namespace/netbox/default/oauth-credentials]` and the netbox flow/scope data sources all read OK. The Vault secret is already seeded. Re-run once the Authentik API recovers.

unkinben added 1 commit 2026-07-28 17:48:04 +10:00

ci: re-run after authentik api recovery

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

e8d0457f00

The plan step failed on transient authentik API 500s while refreshing
unrelated existing applications; the API is healthy again (200).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit 21ef853a7c into main

2026-07-28 18:06:27 +10:00

benvin deleted branch benvin/netbox-oidc

2026-07-28 18:06:27 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#11