deploy/server/oidc.yaml

Ref: Size: 2.0 KiB History
# The bundled issuer, for a plane with no external identity provider. Applied
# only where LOCAL_OIDC=1 — prod signs in against Google and never starts it.
#
# It gets its own hostname rather than a path on the console's, because the
# login form posts back to the absolute path /authorize: mounted under a prefix,
# the browser's POST would land on the console host's catch-all rule instead of
# the issuer. An issuer only works at the root of its own origin.
#
# Its state is NOT disposable. users.json holds each identity's subject, and the
# server derives a tenant from that subject — lose the file and the operator
# signs in to a brand-new tenant while the old one still owns the plane's hosts,
# with no error anywhere to say so. Hence a PVC, pinned like the server's.
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ${OIDC_PVC_NAME}
  namespace: ${NAMESPACE}
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: local-path
  resources:
    requests:
      storage: ${OIDC_PVC_SIZE}
---
apiVersion: v1
kind: Service
metadata:
  name: eitri-oidc
  namespace: ${NAMESPACE}
spec:
  selector: {app: eitri-oidc}
  ports:
    - {name: http, port: ${OIDC_PORT}, targetPort: ${OIDC_PORT}}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ${OIDC_TLS_SECRET}
  namespace: ${NAMESPACE}
spec:
  secretName: ${OIDC_TLS_SECRET}
  dnsNames: [${OIDC_HOST}]
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: oidc-https
  namespace: ${NAMESPACE}
spec:
  entryPoints: [websecure]
  routes:
    - match: Host(`${OIDC_HOST}`)
      kind: Rule
      services:
        - {name: eitri-oidc, port: ${OIDC_PORT}}
  tls:
    secretName: ${OIDC_TLS_SECRET}
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: oidc-http
  namespace: ${NAMESPACE}
spec:
  entryPoints: [web]
  routes:
    - match: Host(`${OIDC_HOST}`)
      kind: Rule
      middlewares:
        - name: redirect-https
      services:
        - {name: eitri-oidc, port: ${OIDC_PORT}}