Add traefik OAuth2 provider/application and akP-traefik-admin #20

2026-08-23T12:35:41+10:00

unkin-agent commented

2026-08-23 12:35:41 +10:00

Why

The traefik dashboards (internal + external) are being exposed behind oauth2-proxy; Authentik needs an OAuth2 provider/application for them first. This is the provider-side prerequisite.

Changes

Adds config/providers_oauth2/traefik.yaml mirroring the arrstack provider: confidential client, client_id traefik, client secret read from Vault kv mount kv at kubernetes/namespace/traefik-system/default/oauth-credentials, openid/email/profile scope mappings (the hierarchical ak_groups mapping is attached to every oauth2 provider by the module), strict redirect URIs https://traefik-internal.k8s.syd1.au.unkin.net/oauth2/callback and https://traefik-external.k8s.syd1.au.unkin.net/oauth2/callback
Adds config/permissions/akP-traefik-admin.yaml bound to the traefik application, gating dashboard access
Nests akP-traefik-admin under akR-global-admin alongside the other app admin permissions

NOTE: requires Ben to seed kv kubernetes/namespace/traefik-system/default/oauth-credentials (keys: client_id, client_secret, cookie_secret_internal, cookie_secret_external) before apply.

## Why The traefik dashboards (internal + external) are being exposed behind oauth2-proxy; Authentik needs an OAuth2 provider/application for them first. This is the provider-side prerequisite. ## Changes - Adds `config/providers_oauth2/traefik.yaml` mirroring the arrstack provider: confidential client, `client_id` `traefik`, client secret read from Vault kv mount `kv` at `kubernetes/namespace/traefik-system/default/oauth-credentials`, openid/email/profile scope mappings (the hierarchical `ak_groups` mapping is attached to every oauth2 provider by the module), strict redirect URIs `https://traefik-internal.k8s.syd1.au.unkin.net/oauth2/callback` and `https://traefik-external.k8s.syd1.au.unkin.net/oauth2/callback` - Adds `config/permissions/akP-traefik-admin.yaml` bound to the `traefik` application, gating dashboard access - Nests `akP-traefik-admin` under `akR-global-admin` alongside the other app admin permissions NOTE: requires Ben to seed kv `kubernetes/namespace/traefik-system/default/oauth-credentials` (keys: `client_id`, `client_secret`, `cookie_secret_internal`, `cookie_secret_external`) before apply.

unkin-agent added 1 commit 2026-08-23 12:35:41 +10:00

Add traefik OAuth2 provider/application and akP-traefik-admin permission

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

1872b82550

The traefik dashboards (internal + external ingress classes) are being
exposed behind oauth2-proxy; this adds the Authentik side as the
prerequisite.

- Adds config/providers_oauth2/traefik.yaml mirroring arrstack: confidential
  client, client_id traefik, secret from Vault kv
  kubernetes/namespace/traefik-system/default/oauth-credentials,
  openid/email/profile scopes (ak_groups is attached to every oauth2
  provider by the module), strict redirect URIs for
  traefik-internal/traefik-external oauth2 callbacks.
- Adds config/permissions/akP-traefik-admin.yaml bound to the traefik
  application and nests it under akR-global-admin.

unkin-agent commented

2026-08-23 12:38:03 +10:00

CI status: pre-commit is green; the plan step is red as expected — data.vault_kv_secret_v2.oauth2["traefik"] reads the client secret at plan time and kv kubernetes/namespace/traefik-system/default/oauth-credentials is not seeded yet.

Seed spec (kv-v2, mount kv), then re-run the pipeline:

vault kv put kv/kubernetes/namespace/traefik-system/default/oauth-credentials \
  client_id=traefik \
  client_secret=<random, e.g. openssl rand -hex 32> \
  cookie_secret_internal=<32-byte base64url, e.g. openssl rand -base64 32 | tr -- '+/' '-_'> \
  cookie_secret_external=<32-byte base64url, distinct from internal>

Only client_secret is read by this repo; the cookie secrets are for the oauth2-proxy deployments (internal/external) consuming the same path.

CI status: pre-commit is green; the `plan` step is red as expected — `data.vault_kv_secret_v2.oauth2["traefik"]` reads the client secret at plan time and kv `kubernetes/namespace/traefik-system/default/oauth-credentials` is not seeded yet. Seed spec (kv-v2, mount `kv`), then re-run the pipeline: ``` vault kv put kv/kubernetes/namespace/traefik-system/default/oauth-credentials \ client_id=traefik \ client_secret=<random, e.g. openssl rand -hex 32> \ cookie_secret_internal=<32-byte base64url, e.g. openssl rand -base64 32 | tr -- '+/' '-_'> \ cookie_secret_external=<32-byte base64url, distinct from internal> ``` Only `client_secret` is read by this repo; the cookie secrets are for the oauth2-proxy deployments (internal/external) consuming the same path.

unkin-agent added 1 commit 2026-08-23 22:14:08 +10:00

Merge remote-tracking branch 'origin/main' into benvin/traefik-oidc

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

c1eea2d441

# Conflicts:
#	config/roles/akR-global-admin.yaml

unkin-agent added 1 commit 2026-08-23 22:16:19 +10:00

ci: re-run plan after merge of main

ci/woodpecker/pr/plan Pipeline was canceled

Details

ci/woodpecker/pr/pre-commit Pipeline was canceled

Details

b4e3ef3149

unkin-agent added 1 commit 2026-08-23 22:17:56 +10:00

ci: trigger pipeline on PR head

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

5f8dfc8450

benvin merged commit 5079d95ada into main

2026-08-23 22:46:36 +10:00

benvin deleted branch benvin/traefik-oidc

2026-08-23 22:46:36 +10:00

unkinben referenced this issue from a commit

2026-08-23 22:48:38 +10:00

Merge origin/main (traefik #20) into benvin/logviewer-oidc

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#20