viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

revert(k8s-dashboard): restore forward-auth ingress (apiserver OIDC unresolved)

Browse source 
Dashboard back to the working forward-auth + kong-proxy state. The
oauth2-proxy SSO path is blocked by a deeper issue: the apiserver rejects
ALL valid Authentik OIDC tokens (both legacy --oidc-* flags and structured
AuthenticationConfiguration), despite verified signature, issuer, audience,
email_verified, synced clock, and reachable+trusted JWKS. Needs dedicated
apiserver-OIDC investigation. oauth2-proxy + k8s-dashboard Authentik app
left deployed (idle, harmless) pending that.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-04 03:59:43 +00:00
parent c958f6a589
commit ea1e4f793b
1 changed files with 9 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

24
stacks/k8s-dashboard/main.tf
View file

@ -91,21 +91,15 @@ resource "helm_release" "kubernetes-dashboard" {
module "ingress" {
source = "../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.k8s-dashboard.metadata[0].name
name = "kubernetes-dashboard"
service_name = "oauth2-proxy"
host = "k8s"
dns_type = "proxied"
tls_secret_name = var.tls_secret_name
# auth = "none": oauth2-proxy is the gate — it runs the Authentik OIDC
# code-flow and injects the user's id_token as Bearer for dashboard->apiserver
# auth. The apiserver trusts the k8s-dashboard issuer (rbac stack structured
# AuthenticationConfiguration), so per-user RBAC applies. A group policy on
# the Authentik app restricts login to the kubernetes-* RBAC groups.
# See docs/plans/2026-06-04-k8s-dashboard-sso-design.md.
auth = "none"
backend_protocol = "HTTP"
port = 4180
namespace = kubernetes_namespace.k8s-dashboard.metadata[0].name
name = "kubernetes-dashboard"
service_name = "kubernetes-dashboard-kong-proxy"
host = "k8s"
dns_type = "proxied"
tls_secret_name = var.tls_secret_name
auth = "required"
backend_protocol = "HTTPS"
port = 443
extra_annotations = {
"gethomepage.dev/enabled" = "true"
"gethomepage.dev/name" = "Kubernetes Dashboard"