From 8c4a900b40e60229e17d3be0654e73dffe7437b7 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 26 Oct 2026 00:28:19 -0700
Subject: [PATCH] feat(vault): wire Zitadel OIDC login via postStart auth/oidc
 config

---
 k8s/infra/iam/vault-values.yaml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/k8s/infra/iam/vault-values.yaml b/k8s/infra/iam/vault-values.yaml
index f357c1b..98bd2c5 100644
--- a/k8s/infra/iam/vault-values.yaml
+++ b/k8s/infra/iam/vault-values.yaml
@@ -81,6 +81,15 @@ server:
     - envName: VAULT_UNSEAL_KEY_3
       secretName: vault-unseal-keys
       secretKey: key3
+    # Zitadel OIDC client credentials for the Vault UI login method. Consumed by
+    # the postStart hook below, which enables auth/oidc via the Vault API after
+    # unsealing. Vault auth methods cannot be declared in HCL, only via API/CLI.
+    - envName: OIDC_CLIENT_ID
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_ID
+    - envName: OIDC_CLIENT_SECRET
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_SECRET
 
   # ── Auto-unseal ─────────────────────────────────────────────────────────────
   # Vault starts sealed after every pod restart and can't serve requests until
@@ -97,6 +106,28 @@ server:
       vault operator unseal "$VAULT_UNSEAL_KEY_2" || true
       vault operator unseal "$VAULT_UNSEAL_KEY_3" || true
 
+      # ── Zitadel OIDC login method ────────────────────────────────────────
+      # Vault auth methods are API-driven: they cannot be declared in HCL.
+      # Enable auth/oidc and write its config on every pod start. Both calls
+      # are idempotent (auth enable returns 400 "already enabled", which we
+      # tolerate; the config write always succeeds and overwrites).
+      vault auth enable oidc 2>/dev/null || true
+      vault write auth/oidc/config \
+        oidc_discovery_url="https://zitadel.riotpiao.com" \
+        oidc_client_id="$OIDC_CLIENT_ID" \
+        oidc_client_secret="$OIDC_CLIENT_SECRET" \
+        default_role="default" 2>/dev/null || true
+      # The role binds the Zitadel client_id as audience and whitelists the UI
+      # callback URL. Policy `default` gives a logged-in operator standard
+      # read access; admin actions still require a token with root/sudo.
+      vault write auth/oidc/role/default \
+        bound_audiences="$OIDC_CLIENT_ID" \
+        allowed_redirect_uris="https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback" \
+        allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback" \
+        user_claim="preferred_username" \
+        oidc_scopes="openid,profile,email,groups" \
+        policies="default" 2>/dev/null || true
+
   # ── Vault config (HCL) ──────────────────────────────────────────────────────
   standalone:
     enabled: true