unkin-agent
1872b82550
The traefik dashboards (internal + external ingress classes) are being exposed behind oauth2-proxy; this adds the Authentik side as the prerequisite. - Adds config/providers_oauth2/traefik.yaml mirroring arrstack: confidential client, client_id traefik, secret from Vault kv kubernetes/namespace/traefik-system/default/oauth-credentials, openid/email/profile scopes (ak_groups is attached to every oauth2 provider by the module), strict redirect URIs for traefik-internal/traefik-external oauth2 callbacks. - Adds config/permissions/akP-traefik-admin.yaml bound to the traefik application and nests it under akR-global-admin.
24 lines
1.0 KiB
YAML
24 lines
1.0 KiB
YAML
# OAuth2/OIDC provider + application for the traefik dashboards
|
|
# (traefik-internal / traefik-external on k8s.syd1). An oauth2-proxy in front
|
|
# of each dashboard performs the OIDC login; access is gated on the user's
|
|
# hierarchical ak_groups claim (akP-traefik-admin).
|
|
# client_secret is read from Vault (seeded out of band), never committed.
|
|
name: traefik
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: traefik
|
|
launch_url: https://traefik-internal.k8s.syd1.au.unkin.net/
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: kubernetes/namespace/traefik-system/default/oauth-credentials
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://traefik-internal.k8s.syd1.au.unkin.net/oauth2/callback
|
|
- matching_mode: strict
|
|
url: https://traefik-external.k8s.syd1.au.unkin.net/oauth2/callback
|