P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment #11

New Issue

2026-09-08T03:56:59Z

rock commented

2026-09-08 03:56:59 +00:00

Summary

Add tokenUrl, clientId to ConfigMap and clientSecret to SOPS-encrypted Secret. Gateway reads these at startup for /auth/token, /auth/refresh, and /auth/exchange endpoints.

Changes

`k8s/configmap.yaml` (plaintext)

auth:
  enabled: true
  issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
  audience: "api-gw"
  jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
  requiredCapability: "llm:inference"
  # NEW:
  tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
  clientId: "local-llm"

`k8s/gateway-config-secret.enc.yaml` (SOPS-encrypted)

# Add:
CLIENT_SECRET: <local-llm client secret from llm-serving/local-llm-jwt k8s Secret>

`k8s/deployment.yaml`

env:
  - name: AUTH_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: gateway-config-secret
        key: CLIENT_SECRET

`internal/config/config.go`

type AuthConfig struct {
    // existing...
    TokenURL     string `yaml:"tokenUrl"`
    ClientID     string `yaml:"clientId"`
    ClientSecret string // from env AUTH_CLIENT_SECRET
}

Acceptance Criteria

Config loads tokenUrl and clientId from ConfigMap
ClientSecret loaded from env (not ConfigMap)
Startup fails with clear error if auth.enabled + tokenUrl missing
Secret encrypted with SOPS before commit

Review checklist

ClientSecret NEVER in ConfigMap (only in encrypted Secret)
SOPS key/age recipient matches existing secrets
No hardcoded fallback for ClientSecret

## Summary Add `tokenUrl`, `clientId` to ConfigMap and `clientSecret` to SOPS-encrypted Secret. Gateway reads these at startup for `/auth/token`, `/auth/refresh`, and `/auth/exchange` endpoints. ## Changes ### `k8s/configmap.yaml` (plaintext) ```yaml auth: enabled: true issuer: "https://authentik.riotpiao.com/application/o/api-gw/" audience: "api-gw" jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/" requiredCapability: "llm:inference" # NEW: tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/" clientId: "local-llm" ``` ### `k8s/gateway-config-secret.enc.yaml` (SOPS-encrypted) ```yaml # Add: CLIENT_SECRET: <local-llm client secret from llm-serving/local-llm-jwt k8s Secret> ``` ### `k8s/deployment.yaml` ```yaml env: - name: AUTH_CLIENT_SECRET valueFrom: secretKeyRef: name: gateway-config-secret key: CLIENT_SECRET ``` ### `internal/config/config.go` ```go type AuthConfig struct { // existing... TokenURL string `yaml:"tokenUrl"` ClientID string `yaml:"clientId"` ClientSecret string // from env AUTH_CLIENT_SECRET } ``` ## Acceptance Criteria - [ ] Config loads tokenUrl and clientId from ConfigMap - [ ] ClientSecret loaded from env (not ConfigMap) - [ ] Startup fails with clear error if auth.enabled + tokenUrl missing - [ ] Secret encrypted with SOPS before commit ## Review checklist - [ ] ClientSecret NEVER in ConfigMap (only in encrypted Secret) - [ ] SOPS key/age recipient matches existing secrets - [ ] No hardcoded fallback for ClientSecret

rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 03:56:59 +00:00

rock added the type/infra priority/high area/gateway status/todo labels 2026-09-08 03:57:00 +00:00

rock self-assigned this 2026-09-08 03:57:02 +00:00

rock added this to the (deleted) project 2026-09-08 04:37:13 +00:00

rock closed this issue

2026-09-08 04:45:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#11

P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment #11

Summary

Changes

k8s/configmap.yaml (plaintext)

k8s/gateway-config-secret.enc.yaml (SOPS-encrypted)

k8s/deployment.yaml

internal/config/config.go