unkin-agent
230db5ad7e
Adds config/providers_oauth2/vault.yaml so human logins to OpenBao go
through Authentik SSO (bao CLI and the web UI). Machine auth (approle,
kubernetes, CI) and break-glass are unchanged and stay on the OpenBao side.
Extends the oauth2 provider module so a config may generate its own client
secret instead of reading a pre-seeded one: client_secret_vault.generate
creates a random_password and writes {client_id, client_secret} to the given
kv-v2 path. Providers without the flag keep the existing read-only data source
behaviour. This is what lets the provider land with no manual Vault seed.
Gates the new application with akP-vault-admin and nests it in
akR-global-admin, matching how every other app in this repo is bound.
33 lines
1.5 KiB
YAML
33 lines
1.5 KiB
YAML
# OAuth2/OIDC provider + application for OpenBao (the estate's Vault), making
|
|
# Authentik the default *human* login. Machine auth (approle, k8s, CI) and the
|
|
# break-glass paths are untouched and stay on the OpenBao side.
|
|
#
|
|
# client_secret is generated here and written to kv/service/authentik/oidc-vault
|
|
# ({client_id, client_secret}); the companion terraform-vault change reads it to
|
|
# configure the OIDC auth mount. Nothing is seeded by hand.
|
|
name: OpenBao
|
|
authorization_flow: default-provider-authorization-implicit-consent
|
|
invalidation_flow: default-provider-invalidation-flow
|
|
client_type: confidential
|
|
client_id: vault
|
|
client_secret_vault:
|
|
mount: kv
|
|
path: service/authentik/oidc-vault
|
|
generate: true
|
|
scope_mappings:
|
|
- goauthentik.io/providers/oauth2/scope-openid
|
|
- goauthentik.io/providers/oauth2/scope-email
|
|
- goauthentik.io/providers/oauth2/scope-profile
|
|
redirect_uris:
|
|
# `bao login -method=oidc` CLI callback (local listener, fixed port 8250).
|
|
- matching_mode: strict
|
|
url: http://localhost:8250/oidc/callback
|
|
# UI SSO callback, gateway host (traefik-internal -> vault svc :8200).
|
|
- matching_mode: strict
|
|
url: https://vault.k8s.syd1.au.unkin.net/ui/vault/auth/oidc/oidc/callback
|
|
# UI SSO callback, direct Consul service address (the address the estate
|
|
# documents for Vault access; any node forwards to the active replica).
|
|
- matching_mode: strict
|
|
url: https://vault.service.consul:8200/ui/vault/auth/oidc/oidc/callback
|
|
launch_url: https://vault.k8s.syd1.au.unkin.net/ui/
|