feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring
Adds permissions claim + per-service admin groups in Authentik, scoped Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.
This commit is contained in:
Story Crater Bot
@@ -155,6 +155,44 @@ groups_mapping = get_or_create(
|
||||
)
|
||||
GROUPS_MAPPING_PK = groups_mapping["pk"]
|
||||
|
||||
# Generic "permissions" claim, computed from group membership - lets each app
|
||||
# (and eventually k8s RBAC via --oidc-groups-claim) check a permission string
|
||||
# like "paperless:write" instead of hardcoding a group name. homelab-admins
|
||||
# gets "*" (everything); every other admin group gets its own read+write pair.
|
||||
# k8s-devops-admin is declared but has no k8s Role/RoleBinding target yet -
|
||||
# foundation for a future short-lived federated-operator credential.
|
||||
_PERMISSIONS_EXPR = """
|
||||
GROUP_PERMISSIONS = {
|
||||
"homelab-admins": ["*"],
|
||||
"grafana-admins": ["grafana:read", "grafana:write"],
|
||||
"minio-admins": ["minio:read", "minio:write"],
|
||||
"forgejo-admins": ["forgejo:read", "forgejo:write"],
|
||||
"homarr-admins": ["homarr:read", "homarr:write"],
|
||||
"portainer-admins": ["portainer:read", "portainer:write"],
|
||||
"kmsvc-admins": ["kmsvc:read", "kmsvc:write"],
|
||||
"temporal-admins": ["temporal:read", "temporal:write"],
|
||||
"llm-admins": ["llm:read", "llm:write"],
|
||||
"paperless-admins": ["paperless:read", "paperless:write"],
|
||||
"k8s-devops-admin": ["k8s:devops"],
|
||||
}
|
||||
perms = set()
|
||||
for group in request.user.groups.all():
|
||||
perms.update(GROUP_PERMISSIONS.get(group.name, []))
|
||||
return {"permissions": sorted(perms)}
|
||||
""".strip()
|
||||
permissions_mapping = get_or_create(
|
||||
"/api/v3/propertymappings/provider/scope/",
|
||||
"/api/v3/propertymappings/provider/scope/",
|
||||
"scope_name=permissions",
|
||||
{
|
||||
"name": "homelab: permissions claim",
|
||||
"scope_name": "permissions",
|
||||
"expression": _PERMISSIONS_EXPR,
|
||||
},
|
||||
patch_existing={"expression": _PERMISSIONS_EXPR},
|
||||
)
|
||||
PERMISSIONS_MAPPING_PK = permissions_mapping["pk"]
|
||||
|
||||
# MinIO maps OIDC users to a MinIO policy via a "policy" claim
|
||||
# (MINIO_IDENTITY_OPENID_CLAIM_NAME=policy). Emit consoleAdmin (full admin) for
|
||||
# homelab-admins members, readonly for everyone else. Without this claim MinIO
|
||||
@@ -180,7 +218,7 @@ POLICY_MAPPING_PK = policy_mapping["pk"]
|
||||
# Fetch the standard openid/email/profile mapping pks (shipped by default).
|
||||
status, res = api("GET", "/api/v3/propertymappings/provider/scope/")
|
||||
by_scope = {m["scope_name"]: m["pk"] for m in res["results"]}
|
||||
SCOPE_PKS = [by_scope["openid"], by_scope["email"], by_scope["profile"], GROUPS_MAPPING_PK]
|
||||
SCOPE_PKS = [by_scope["openid"], by_scope["email"], by_scope["profile"], GROUPS_MAPPING_PK, PERMISSIONS_MAPPING_PK]
|
||||
|
||||
status, res = api("GET", "/api/v3/flows/instances/?slug=default-provider-authorization-implicit-consent")
|
||||
AUTHORIZATION_FLOW_PK = res["results"][0]["pk"]
|
||||
@@ -190,17 +228,31 @@ status, res = api("GET", "/api/v3/crypto/certificatekeypairs/?has_key=true")
|
||||
SIGNING_KEY_PK = res["results"][0]["pk"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
print("[2/5] Ensuring groups homelab-admins / grafana-admins exist...")
|
||||
print("[2/5] Ensuring homelab-admins + per-service admin groups exist...")
|
||||
homelab_admins = get_or_create(
|
||||
"/api/v3/core/groups/", "/api/v3/core/groups/",
|
||||
"name=homelab-admins",
|
||||
{"name": "homelab-admins", "is_superuser": True},
|
||||
)
|
||||
grafana_admins = get_or_create(
|
||||
"/api/v3/core/groups/", "/api/v3/core/groups/",
|
||||
"name=grafana-admins",
|
||||
{"name": "grafana-admins", "is_superuser": False},
|
||||
)
|
||||
# App-scoped, not Authentik superusers (unlike homelab-admins) - each maps to
|
||||
# read+write in its own service via the "permissions" claim above (k8s Role/
|
||||
# RoleBinding in k8s/infra/rbac/, or an app's own adapter e.g. paperless's).
|
||||
# k8s-devops-admin is declared with no target yet - foundation for a future
|
||||
# short-lived federated-operator credential.
|
||||
SERVICE_ADMIN_GROUP_NAMES = [
|
||||
"grafana-admins", "minio-admins", "forgejo-admins", "homarr-admins",
|
||||
"portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
|
||||
"paperless-admins", "k8s-devops-admin",
|
||||
]
|
||||
service_admin_groups = {}
|
||||
for group_name in SERVICE_ADMIN_GROUP_NAMES:
|
||||
service_admin_groups[group_name] = get_or_create(
|
||||
"/api/v3/core/groups/", "/api/v3/core/groups/",
|
||||
f"name={group_name}",
|
||||
{"name": group_name, "is_superuser": False},
|
||||
)
|
||||
grafana_admins = service_admin_groups["grafana-admins"]
|
||||
paperless_admins = service_admin_groups["paperless-admins"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
print("[3/5] Ensuring user 'rock' exists with admin group membership...")
|
||||
@@ -209,7 +261,7 @@ rock_password = None
|
||||
if res.get("results"):
|
||||
rock = res["results"][0]
|
||||
status, rock = api("PATCH", f"/api/v3/core/users/{rock['pk']}/", {
|
||||
"groups": [homelab_admins["pk"], grafana_admins["pk"]],
|
||||
"groups": [homelab_admins["pk"]] + [g["pk"] for g in service_admin_groups.values()],
|
||||
"is_active": True,
|
||||
# email is REQUIRED: Grafana's OIDC login reads the email claim from
|
||||
# userinfo; an empty email makes Grafana fall back to a GitHub-style
|
||||
@@ -227,7 +279,7 @@ else:
|
||||
"is_active": True,
|
||||
# Required for Grafana OIDC (see PATCH branch above).
|
||||
"email": "[email protected]",
|
||||
"groups": [homelab_admins["pk"], grafana_admins["pk"]],
|
||||
"groups": [homelab_admins["pk"]] + [g["pk"] for g in service_admin_groups.values()],
|
||||
"path": "users",
|
||||
"type": "internal",
|
||||
})
|
||||
@@ -342,6 +394,12 @@ for name, cfg in SERVICES.items():
|
||||
"secret": client_secret,
|
||||
"settings": {
|
||||
"server_url": "https://authentik.riotpiao.com/application/o/paperless/.well-known/openid-configuration",
|
||||
# "groups"/"permissions" aren't default OIDC scopes -
|
||||
# must be requested explicitly for Authentik's scope
|
||||
# mappings above to actually be returned. paperless's
|
||||
# adapter.py ConfigMap reads the "permissions" claim
|
||||
# to grant is_staff+is_superuser.
|
||||
"scope": ["openid", "profile", "email", "groups", "permissions"],
|
||||
},
|
||||
}],
|
||||
},
|
||||
@@ -413,6 +471,53 @@ for name, cfg in SERVICES.items():
|
||||
app_pks_for_binding.append((name, application["pk"]))
|
||||
print(f" {name}: provider pk={provider['pk']} application pk={application['pk']}")
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Separate from the SERVICES loop above: this is a PUBLIC client (PKCE, no
|
||||
# client_secret) for `kubectl` OIDC login, not a confidential-client app
|
||||
# login. Foundation for k8s/infra/rbac/ - kube-apiserver's --oidc-* flags
|
||||
# (controlplane.tftpl) validate tokens issued against this provider.
|
||||
# Redirect URI matches kubelogin's (int128/kubelogin) documented default;
|
||||
# adjust here if a different kubectl OIDC plugin/port is actually used.
|
||||
print("Ensuring public OAuth2 client 'kubernetes' for kubectl OIDC login...")
|
||||
k8s_provider = get_or_create(
|
||||
"/api/v3/providers/oauth2/", "/api/v3/providers/oauth2/",
|
||||
"name=kubernetes",
|
||||
{
|
||||
"name": "kubernetes",
|
||||
"client_id": "kubernetes",
|
||||
"client_type": "public",
|
||||
"authorization_flow": AUTHORIZATION_FLOW_PK,
|
||||
"invalidation_flow": INVALIDATION_FLOW_PK,
|
||||
"signing_key": SIGNING_KEY_PK,
|
||||
"property_mappings": SCOPE_PKS,
|
||||
"sub_mode": "hashed_user_id",
|
||||
"include_claims_in_id_token": True,
|
||||
"grant_types": ["authorization_code", "refresh_token"],
|
||||
"redirect_uris": [
|
||||
{"matching_mode": "strict", "url": "http://localhost:8000"},
|
||||
],
|
||||
},
|
||||
patch_existing={
|
||||
"property_mappings": SCOPE_PKS,
|
||||
"grant_types": ["authorization_code", "refresh_token"],
|
||||
"redirect_uris": [
|
||||
{"matching_mode": "strict", "url": "http://localhost:8000"},
|
||||
],
|
||||
},
|
||||
)
|
||||
k8s_application = get_or_create(
|
||||
"/api/v3/core/applications/", "/api/v3/core/applications/",
|
||||
"slug=kubernetes&superuser_full_list=true",
|
||||
{
|
||||
"name": "Kubernetes",
|
||||
"slug": "kubernetes",
|
||||
"provider": k8s_provider["pk"],
|
||||
"meta_launch_url": "https://authentik.riotpiao.com",
|
||||
},
|
||||
)
|
||||
app_pks_for_binding.append(("kubernetes", k8s_application["pk"]))
|
||||
print(f" kubernetes: provider pk={k8s_provider['pk']} application pk={k8s_application['pk']}")
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
print("[5/5] Binding homelab-admins to every application (guaranteed access for rock)...")
|
||||
for name, app_pk in app_pks_for_binding:
|
||||
@@ -428,9 +533,38 @@ for name, app_pk in app_pks_for_binding:
|
||||
)
|
||||
print(f" {name}: homelab-admins bound")
|
||||
|
||||
# Per-service admin groups are app-scoped (unlike homelab-admins' blanket
|
||||
# binding above) - only grants visibility/access to that one application.
|
||||
# portainer/kmsvc/temporal/llm-serving have no Authentik Application (no OIDC
|
||||
# login integration), so their groups exist for the "permissions" claim /
|
||||
# future k8s RBAC only - nothing to bind here.
|
||||
SERVICE_GROUP_TO_APP_SLUG = {
|
||||
"grafana-admins": "grafana",
|
||||
"minio-admins": "minio",
|
||||
"forgejo-admins": "forgejo",
|
||||
"homarr-admins": "homarr",
|
||||
"paperless-admins": "paperless",
|
||||
}
|
||||
for group_name, app_slug in SERVICE_GROUP_TO_APP_SLUG.items():
|
||||
app_pk = next((pk for n, pk in app_pks_for_binding if n == app_slug), None)
|
||||
if not app_pk:
|
||||
continue
|
||||
group_pk = service_admin_groups[group_name]["pk"]
|
||||
get_or_create(
|
||||
"/api/v3/policies/bindings/", "/api/v3/policies/bindings/",
|
||||
f"target={app_pk}&group={group_pk}",
|
||||
{
|
||||
"target": app_pk,
|
||||
"group": group_pk,
|
||||
"order": 0,
|
||||
"enabled": True,
|
||||
},
|
||||
)
|
||||
print(f" {app_slug}: {group_name} bound")
|
||||
|
||||
print("\nDone. Summary:")
|
||||
print(" groups: homelab-admins (superuser), grafana-admins")
|
||||
print(" user: rock -> homelab-admins + grafana-admins")
|
||||
print(" groups: homelab-admins (superuser) + " + ", ".join(SERVICE_ADMIN_GROUP_NAMES))
|
||||
print(" user: rock -> homelab-admins + all service admin groups")
|
||||
print(f" apps: {', '.join(n for n, _ in app_pks_for_binding)}")
|
||||
if rock_password:
|
||||
print(" NOTE: rock's password was generated this run - see")
|
||||
|
||||
Reference in New Issue
Block a user