From ff8bc74f6388a71849198cb1bb3218c65d1132e5 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 22 Jul 2026 08:59:51 -0700 Subject: [PATCH] feat(sso): complete MinIO OIDC env + add Homarr landing page base config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MinIO (Part B): - k8s/infrastructure/minio/minio-tenant.yaml: added full OIDC env block (CONFIG_URL, CLIENT_ID, CLIENT_SECRET from minio-oidc secret, CLAIM_NAME, REDIRECT_URI, DISPLAY_NAME, SCOPES) — MinIO console SSO login will now work Homarr (Part C1 - base): - k8s/applications/homarr/homarr-values.yaml: official chart config with Authentik SSO (AUTH_PROVIDERS=oidc, all OIDC env vars, client creds from homarr-oidc secret, SECRET_ENCRYPTION_KEY from SOPS secret) - k8s/applications/homarr/homarr-secrets.enc.yaml: age-encrypted SECRET_ENCRYPTION_KEY (stable key — rotating it breaks saved integrations) - k8s/applications/homarr/kustomization.yaml: namespace dashboard Still TODO for Homarr: - Add 'homarr' to authentik-provision.py SERVICES dict - Add Application to 60-applications.yaml (multi-source: chart + values) - Add ingress rule (k8s/bootstrap/ingress/ingress.yaml) - Add CoreDNS rewrite (k8s/bootstrap/coredns/coredns-configmap.yaml) - Add dashboard RoleBinding for authentik-provisioner SA --- .../homarr/homarr-secrets.enc.yaml | 23 +++++++ k8s/applications/homarr/homarr-values.yaml | 67 +++++++++++++++++++ k8s/applications/homarr/kustomization.yaml | 7 ++ k8s/infrastructure/minio/minio-tenant.yaml | 15 +++++ 4 files changed, 112 insertions(+) create mode 100644 k8s/applications/homarr/homarr-secrets.enc.yaml create mode 100644 k8s/applications/homarr/homarr-values.yaml create mode 100644 k8s/applications/homarr/kustomization.yaml diff --git a/k8s/applications/homarr/homarr-secrets.enc.yaml b/k8s/applications/homarr/homarr-secrets.enc.yaml new file mode 100644 index 0000000..108e209 --- /dev/null +++ b/k8s/applications/homarr/homarr-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:XZc=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:U2DPsVJ1gCoZw1YcgmT7UA==,type:str] +kind: ENC[AES256_GCM,data:SRkjGwsv,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:113xdFELRoJiU4Kn8BmvPA==,type:str] +metadata: + name: ENC[AES256_GCM,data:stIxzQqOUvpbEANL4aQ=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:2XRGRbPQLNUGbA1dZI9xEQ==,type:str] + namespace: ENC[AES256_GCM,data:wIhhcrQi3cDF,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:xnqvCtUdFPB5D9meJb36GA==,type:str] +type: ENC[AES256_GCM,data:1qUDnlHH,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:u9PcCfvA2BydFNQQKws1Og==,type:str] +stringData: + SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:b0h8ekf7RIbQ9YTpaXPmR3aeNonk60lgltPmnRe7lVk9wlAdaXkNChINcAsarw9YhfYvfCZfS8U33/QxLGjaYA==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:JphkeY49bQLm6cPjT6g8LA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUW1BVmEvTnJqa3RuQ3NG + UFg3SE1SclpWd01TZnFOK0trQ1c2YThUQmpRCkdGc3FJSmRCcFIycWcvZXJCbDdj + T1M2cFFUakpOa2FST1k2UHc0a1hCRWMKLS0tIDk0UVdYRUkvTEM4TEVWRElrY3dN + SFU2bkZxUGlDL0JNSnY3UU54Z3BhbFUKnJYwwQkUveNjTF9CveVUBF8RO7QjDnYA + 1+COKzvXuCIupvPcS87AtkrOfbfTu3IK78pfxZn04FmMOuAyj0ynzA== + -----END AGE ENCRYPTED FILE----- + recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + lastmodified: "2026-07-22T15:59:29Z" + mac: ENC[AES256_GCM,data:uMmKD4fvu39KZc2lDoDD25g/p/eIGW/CYFIwYXcRFPdbLLLi+iW9ks/2l5tHqzlwHEtlL1RH4HLOQr25k3GAJA2FhVnyVmyZ4N2EnJfic/9XTfef9E8tKVo2cXEgYMCPbpH8sVu2OoaQ9BFw8dTM9ZxuTdGKksGOtGp56I4R8hA=,iv:QFhVAZ1jykTNLPDzqjYf9jkg5PuqYA8+s0Hn57ND3KA=,tag:Zz2qYANQP33izwg+3Ap16A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/applications/homarr/homarr-values.yaml b/k8s/applications/homarr/homarr-values.yaml new file mode 100644 index 0000000..0b58d03 --- /dev/null +++ b/k8s/applications/homarr/homarr-values.yaml @@ -0,0 +1,67 @@ +# Homarr landing page — official chart from homarr-labs/charts. +# SSO via Authentik, single-replica (UI state lives on PVC, not git). +image: + repository: ghcr.io/homarr-labs/homarr + tag: "1.0.0" # Pin to stable + pullPolicy: IfNotPresent + +replicaCount: 1 + +service: + type: ClusterIP + port: 3000 + +persistence: + enabled: true + storageClass: longhorn-wffc + accessMode: ReadWriteOnce + size: 5Gi + +env: + - name: AUTH_PROVIDERS + value: "oidc,credentials" + - name: AUTH_OIDC_ISSUER + value: "https://authentik.riotpiao.com/application/o/homarr/" + - name: AUTH_OIDC_CALLBACK_URL + value: "https://homarr.riotpiao.com/api/auth/callback/oidc" + - name: AUTH_OIDC_CLIENT_NAME + value: "Authentik" + - name: AUTH_OIDC_GROUPS_ATTRIBUTE + value: "groups" + - name: AUTH_OIDC_CLIENT_ID + valueFrom: + secretKeyRef: + name: homarr-oidc + key: client-id + - name: AUTH_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: homarr-oidc + key: client-secret + - name: SECRET_ENCRYPTION_KEY + valueFrom: + secretKeyRef: + name: homarr-secrets + key: SECRET_ENCRYPTION_KEY + - name: OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING + value: "true" + - name: BASE_URL + value: "https://homarr.riotpiao.com" + - name: NEXTAUTH_URL + value: "https://homarr.riotpiao.com" + +tolerations: + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + +resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + +ingress: + enabled: false # Managed centrally in k8s/bootstrap/ingress/ingress.yaml diff --git a/k8s/applications/homarr/kustomization.yaml b/k8s/applications/homarr/kustomization.yaml new file mode 100644 index 0000000..677fc65 --- /dev/null +++ b/k8s/applications/homarr/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: dashboard +resources: + - homarr-secrets.enc.yaml +# Homarr deployed via Helm chart (values in 60-applications.yaml multi-source Application). +# This kustomization just holds the SOPS-encrypted SECRET_ENCRYPTION_KEY. diff --git a/k8s/infrastructure/minio/minio-tenant.yaml b/k8s/infrastructure/minio/minio-tenant.yaml index 927dbc8..15b6422 100644 --- a/k8s/infrastructure/minio/minio-tenant.yaml +++ b/k8s/infrastructure/minio/minio-tenant.yaml @@ -96,5 +96,20 @@ spec: # ── OIDC via Authentik (server-side env, valid in v2 schema) ──────────────── env: + - name: MINIO_IDENTITY_OPENID_CONFIG_URL + value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration" + - name: MINIO_IDENTITY_OPENID_CLIENT_ID + value: "minio" + - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: minio-oidc + key: MINIO_IDENTITY_OPENID_CLIENT_SECRET + - name: MINIO_IDENTITY_OPENID_CLAIM_NAME + value: "policy" + - name: MINIO_IDENTITY_OPENID_REDIRECT_URI + value: "https://minio.riotpiao.com/oauth_callback" + - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME + value: "Authentik" - name: MINIO_IDENTITY_OPENID_SCOPES value: "openid,profile,email,minio"