homelab-frontend

riotpiao-poimen/homelab-frontend

Fork 0

...

Author	SHA1	Message	Date
Admin Bot	6acaec4a5c	fix(gateway): fetch JWKS from the in-cluster ZITADEL service CI / CI (pull_request) Successful in 2m7s Details CI / CI (push) Successful in 3m26s Details The public host resolves through the CoreDNS rewrite to ingress-nginx and the fetch timed out, so the validator answered 403 with a context-deadline error on every caller. Point jwksUrl at zitadel.iam.svc.cluster.local:8080, which the NetworkPolicy already allows.	2026-10-27 01:28:10 -07:00
Admin Bot	ba8800d565	fix(gateway): set jwksUrl so the dispatcher builds a validator CI / CI (pull_request) Successful in 2m9s Details CI / CI (push) Successful in 3m29s Details cmd/gateway/main.go:144 constructs the adapter validator only when both cfg.Auth.Enabled and cfg.Auth.JWKSURL are set. The config left jwksUrl unset on purpose, so jwtValidator stayed nil and every adapter request passed with one warning line: auth required but jwtValidator nil; request unauthenticated That made auth.required cosmetic: sqs, workflow, memory, s3 and iam all answered unauthenticated calls. Set the JWKS URL to the ZITADEL key endpoint.	2026-10-27 01:17:09 -07:00

Author

SHA1

Message

Date

Admin Bot

6acaec4a5c

fix(gateway): fetch JWKS from the in-cluster ZITADEL service

CI / CI (pull_request) Successful in 2m7s

Details

CI / CI (push) Successful in 3m26s

Details

The public host resolves through the CoreDNS rewrite to ingress-nginx and the
fetch timed out, so the validator answered 403 with a context-deadline error on
every caller. Point jwksUrl at zitadel.iam.svc.cluster.local:8080, which the
NetworkPolicy already allows.

2026-10-27 01:28:10 -07:00

Admin Bot

ba8800d565

fix(gateway): set jwksUrl so the dispatcher builds a validator

CI / CI (pull_request) Successful in 2m9s

Details

CI / CI (push) Successful in 3m29s

Details

cmd/gateway/main.go:144 constructs the adapter validator only when both
cfg.Auth.Enabled and cfg.Auth.JWKSURL are set. The config left jwksUrl unset on
purpose, so jwtValidator stayed nil and every adapter request passed with one
warning line:

  auth required but jwtValidator nil; request unauthenticated

That made auth.required cosmetic: sqs, workflow, memory, s3 and iam all answered
unauthenticated calls. Set the JWKS URL to the ZITADEL key endpoint.

2026-10-27 01:17:09 -07:00

1 changed files with 1 additions and 1 deletions

k8s/gateway-config-secret.yaml

+1 -1

View File

File diff suppressed because one or more lines are too long

Compare commits