riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 3 Actions Packages Projects 1 Releases Wiki Activity

fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned #85

Merged
rock merged 2 commits from fix/zitadel-oidc-iac into main 2026-10-31 20:53:57 +00:00
Conversation 0 Commits 2 Files Changed 9
+10 -2
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 506f618b8a - Show all commits
k8s/infra/minio/minio-tenant.yaml
+10 -2
View File
@@ -107,6 +107,13 @@ spec:
# Use external URL for config fetch (hairpins through ingress-nginx); browser # Use external URL for config fetch (hairpins through ingress-nginx); browser
# redirects use public URLs embedded in the OIDC metadata response. # redirects use public URLs embedded in the OIDC metadata response.
env: env:
# MinIO ships identity_openid DISABLED by default, whatever else is set.
# Without this key every other MINIO_IDENTITY_OPENID_* value below is
# inert and the console advertises password login only — it answers
# /api/v1/login with {"loginStrategy":"form"} and never renders an SSO
# button, which is exactly the symptom this tenant showed.
- name: MINIO_IDENTITY_OPENID_ENABLE
value: "on"
- name: MINIO_IDENTITY_OPENID_CONFIG_URL - name: MINIO_IDENTITY_OPENID_CONFIG_URL
# Must use external URL — well-known response contains external issuer/jwks_uri. # Must use external URL — well-known response contains external issuer/jwks_uri.
# MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch. # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
@@ -121,8 +128,9 @@ spec:
key: MINIO_IDENTITY_OPENID_CLIENT_SECRET key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
- name: MINIO_IDENTITY_OPENID_CLAIM_NAME - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
value: "groups" value: "groups"
- name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX # An empty claim prefix is worse than no key: it makes the claim resolver
value: "" # prepend nothing and then look for a nested property that cannot exist.
# Omit the key entirely unless a real prefix is needed.
- name: MINIO_IDENTITY_OPENID_REDIRECT_URI - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
value: "https://minio.riotpiao.com/oauth_callback" value: "https://minio.riotpiao.com/oauth_callback"
- name: MINIO_IDENTITY_OPENID_DISPLAY_NAME - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME