fix(authentik): label argocd oidc-secret part-of=argocd — argocd's $secret substitution only reads labelled Secrets; without it OIDC login failed with oauth2 invalid_client (empty client_secret to IdP)

k8s/infra/iam/scripts/authentik-provision.py

@@ -88,7 +88,7 @@ def kubectl_get_secret_key(namespace, name, key):
     return base64.b64decode(p.stdout).decode()
 
 
-def kubectl_create_secret(namespace, name, literals: dict):
+def kubectl_create_secret(namespace, name, literals: dict, labels: dict = None):
     """Idempotent: create-or-update via dry-run|apply, same pattern used
     elsewhere in this repo (setup_vault.sh, apply-vault-secrets.sh)."""
     args = ["kubectl", "-n", namespace, "create", "secret", "generic", name]
@@ -103,6 +103,13 @@ def kubectl_create_secret(namespace, name, literals: dict):
     if apply.returncode != 0:
         die(f"applying secret {namespace}/{name}: {apply.stderr}")
     print(f"  secret {namespace}/{name}: {apply.stdout.strip()}")
+    if labels:
+        # argocd's `$secret:key` substitution only reads Secrets carrying
+        # app.kubernetes.io/part-of: argocd — without it OIDC login fails with
+        # oauth2 "invalid_client" (empty client_secret sent to the IdP).
+        label_args = ["kubectl", "-n", namespace, "label", "secret", name,
+                      "--overwrite"] + [f"{k}={v}" for k, v in labels.items()]
+        subprocess.run(label_args, capture_output=True, text=True)
 
 
 def get_or_create(list_path, create_path, query, payload, patch_existing=None):
@@ -269,6 +276,8 @@ SERVICES = {
         "client_secret_source": ("argocd", "oidc-secret", "client-secret"),
         "generate_if_missing": True,
         "extra_secret_literals": {"client-id": "argocd"},
+        # argocd only reads $secret refs from Secrets labelled part-of: argocd.
+        "secret_labels": {"app.kubernetes.io/part-of": "argocd"},
         "redirect_uris": ["https://argocd.riotpiao.com/auth/callback"],
         "launch_url": "https://argocd.riotpiao.com",
         "display_name": "Argo CD",
@@ -299,7 +308,8 @@ for name, cfg in SERVICES.items():
         client_secret = gen_secret(40)
         literals = {key: client_secret}
         literals.update(cfg.get("extra_secret_literals", {}))
-        kubectl_create_secret(ns, secret_name, literals)
+        kubectl_create_secret(ns, secret_name, literals,
+                              labels=cfg.get("secret_labels"))
         print(f"  {name}: generated new client secret -> {ns}/{secret_name}")
     else:
         print(f"  {name}: using existing client secret from {ns}/{secret_name}")