From 3ab70fedae5fc6ea5d7d86b9d0199ff2702ec964 Mon Sep 17 00:00:00 2001 From: Erki Aas Date: Fri, 18 Sep 2026 12:29:05 +0300 Subject: [PATCH] Upgrade Passmower to 2.3.0 and migrate client compatibility --- argocd/oidc-auth.yaml | 2 + freescout/application.yaml | 132 ++++++++++++------------ gitea/application.yaml | 79 +++++++------- grafana/passmower.yaml | 3 + hackerspace/inventory-extras.yaml | 3 + harbor-operator/application-extras.yaml | 3 + nextcloud/application.yaml | 3 + passmower/kubelogin.yaml | 3 + passmower/kustomization.yaml | 2 +- passmower/proxmox.yaml | 3 + passmower/values.yaml | 30 +++--- wiki/application.yaml | 81 ++++++++------- wildduck/wildflock.yaml | 3 + 13 files changed, 186 insertions(+), 161 deletions(-) diff --git a/argocd/oidc-auth.yaml b/argocd/oidc-auth.yaml index 5f634db..71764e0 100644 --- a/argocd/oidc-auth.yaml +++ b/argocd/oidc-auth.yaml @@ -18,8 +18,10 @@ spec: responseTypes: - code availableScopes: + - email - openid - profile + - groups pkce: false secretMetadata: labels: diff --git a/freescout/application.yaml b/freescout/application.yaml index 8fba0c3..193c942 100644 --- a/freescout/application.yaml +++ b/freescout/application.yaml @@ -33,75 +33,77 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile pkce: false - secretRefreshPod: - apiVersion: v1 - kind: Pod - spec: - volumes: - - name: tmp - emptyDir: {} - initContainers: - - name: jq - image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730 - command: - - /bin/bash - - '-c' - - >- - rm -fv /tmp/update.sql; jq - '{"name":"oauth.client_id","value":$ENV.OIDC_CLIENT_ID} | "UPDATE - options SET value=\(.value|tostring|@sh) WHERE - name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq - '{"name":"oauth.client_secret","value":$ENV.OIDC_CLIENT_SECRET} | - "UPDATE options SET value=\(.value|tostring|@sh) WHERE - name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq - '{"name":"oauth.auth_url","value":$ENV.OIDC_IDP_AUTH_URI} | - "UPDATE options SET value=\(.value + "?scope=openid+profile" - |tostring|@sh) WHERE name=\(.name|tostring|@sh) LIMIT 1;"' -n -r - >> /tmp/update.sql; jq - '{"name":"oauth.token_url","value":$ENV.OIDC_IDP_TOKEN_URI} | - "UPDATE options SET value=\(.value|tostring|@sh) WHERE - name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq - '{"name":"oauth.user_url","value":$ENV.OIDC_IDP_USERINFO_URI} - | "UPDATE options SET value=\(.value|tostring|@sh) WHERE - name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; - cat /tmp/update.sql - envFrom: - - secretRef: - name: oidc-client-freescout-owner-secrets - resources: {} - volumeMounts: - - name: tmp - mountPath: /tmp - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - imagePullPolicy: IfNotPresent - containers: - - name: mysql - image: mirror.gcr.io/library/mysql:latest - command: - - /bin/bash - - '-c' - - >- - mysql -u freescout freescout -h mariadb - -p${MYSQL_PWD} < /tmp/update.sql - env: - - name: MYSQL_PWD - valueFrom: - secretKeyRef: - name: mariadb-secrets - key: MYSQL_PASSWORD - resources: {} - volumeMounts: - - name: tmp - mountPath: /tmp - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - imagePullPolicy: IfNotPresent - restartPolicy: OnFailure + secretRefreshJobSpec: + template: + spec: + volumes: + - name: tmp + emptyDir: {} + initContainers: + - name: jq + image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730 + command: + - /bin/bash + - '-c' + - >- + rm -fv /tmp/update.sql; jq + '{"name":"oauth.client_id","value":$ENV.OIDC_CLIENT_ID} | "UPDATE + options SET value=\(.value|tostring|@sh) WHERE + name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq + '{"name":"oauth.client_secret","value":$ENV.OIDC_CLIENT_SECRET} | + "UPDATE options SET value=\(.value|tostring|@sh) WHERE + name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq + '{"name":"oauth.auth_url","value":$ENV.OIDC_IDP_AUTH_URI} | + "UPDATE options SET value=\(.value + "?scope=openid+profile" + |tostring|@sh) WHERE name=\(.name|tostring|@sh) LIMIT 1;"' -n -r + >> /tmp/update.sql; jq + '{"name":"oauth.token_url","value":$ENV.OIDC_IDP_TOKEN_URI} | + "UPDATE options SET value=\(.value|tostring|@sh) WHERE + name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq + '{"name":"oauth.user_url","value":$ENV.OIDC_IDP_USERINFO_URI} + | "UPDATE options SET value=\(.value|tostring|@sh) WHERE + name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; + cat /tmp/update.sql + envFrom: + - secretRef: + name: oidc-client-freescout-owner-secrets + resources: {} + volumeMounts: + - name: tmp + mountPath: /tmp + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + imagePullPolicy: IfNotPresent + containers: + - name: mysql + image: mirror.gcr.io/library/mysql:latest + command: + - /bin/bash + - '-c' + - >- + mysql -u freescout freescout -h mariadb + -p${MYSQL_PWD} < /tmp/update.sql + env: + - name: MYSQL_PWD + valueFrom: + secretKeyRef: + name: mariadb-secrets + key: MYSQL_PASSWORD + resources: {} + volumeMounts: + - name: tmp + mountPath: /tmp + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + imagePullPolicy: IfNotPresent + restartPolicy: OnFailure --- apiVersion: networking.k8s.io/v1 kind: Ingress diff --git a/gitea/application.yaml b/gitea/application.yaml index 3ba78da..99b724f 100644 --- a/gitea/application.yaml +++ b/gitea/application.yaml @@ -76,50 +76,49 @@ spec: responseTypes: - code availableScopes: + - email - openid - profile overrideIncomingScopes: true pkce: false - secretRefreshPod: - apiVersion: v1 - kind: Pod - metadata: - name: reset-oidc-config - spec: - volumes: - - name: tmp - emptyDir: {} - initContainers: - - name: jq - image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730 - imagePullPolicy: IfNotPresent - volumeMounts: - - mountPath: /tmp - name: tmp - envFrom: - - secretRef: - name: oidc-client-gitea-owner-secrets - command: - - /bin/bash - - -c - - jq '{"strategyKey":"OpenID","config":{"Provider":"openidConnect","ClientID":$ENV.OIDC_CLIENT_ID,"ClientSecret":$ENV.OIDC_CLIENT_SECRET,"OpenIDConnectAutoDiscoveryURL":"https://auth.k-space.ee/.well-known/openid-configuration","CustomURLMapping":null,"IconURL":"","Scopes":null,"RequiredClaimName":"","RequiredClaimValue":"","GroupClaimName":"","AdminGroup":"","GroupTeamMap":"","GroupTeamMapRemoval":false,"RestrictedGroup":""}} | "UPDATE login_source SET cfg=\(.config|tostring|@sh) WHERE name=\(.strategyKey|tostring|@sh) LIMIT 1"' -n -r > /tmp/update.sql - containers: - - name: mysql - image: mirror.gcr.io/library/mysql:latest - imagePullPolicy: IfNotPresent - volumeMounts: - - mountPath: /tmp - name: tmp - env: - - name: MYSQL_PWD - valueFrom: - secretKeyRef: - name: mariadb-secrets - key: MYSQL_PASSWORD - command: - - /bin/bash - - -c - - mysql -u gitea gitea -h mariadb -p${MYSQL_PWD} < /tmp/update.sql + secretRefreshJobSpec: + template: + spec: + restartPolicy: OnFailure + volumes: + - name: tmp + emptyDir: {} + initContainers: + - name: jq + image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /tmp + name: tmp + envFrom: + - secretRef: + name: oidc-client-gitea-owner-secrets + command: + - /bin/bash + - -c + - jq '{"strategyKey":"OpenID","config":{"Provider":"openidConnect","ClientID":$ENV.OIDC_CLIENT_ID,"ClientSecret":$ENV.OIDC_CLIENT_SECRET,"OpenIDConnectAutoDiscoveryURL":"https://auth.k-space.ee/.well-known/openid-configuration","CustomURLMapping":null,"IconURL":"","Scopes":null,"RequiredClaimName":"","RequiredClaimValue":"","GroupClaimName":"","AdminGroup":"","GroupTeamMap":"","GroupTeamMapRemoval":false,"RestrictedGroup":""}} | "UPDATE login_source SET cfg=\(.config|tostring|@sh) WHERE name=\(.strategyKey|tostring|@sh) LIMIT 1"' -n -r > /tmp/update.sql + containers: + - name: mysql + image: mirror.gcr.io/library/mysql:latest + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /tmp + name: tmp + env: + - name: MYSQL_PWD + valueFrom: + secretKeyRef: + name: mariadb-secrets + key: MYSQL_PASSWORD + command: + - /bin/bash + - -c + - mysql -u gitea gitea -h mariadb -p${MYSQL_PWD} < /tmp/update.sql --- apiVersion: apps/v1 kind: StatefulSet diff --git a/grafana/passmower.yaml b/grafana/passmower.yaml index 929e66c..2c95e1b 100644 --- a/grafana/passmower.yaml +++ b/grafana/passmower.yaml @@ -15,7 +15,10 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile - groups diff --git a/hackerspace/inventory-extras.yaml b/hackerspace/inventory-extras.yaml index b8f91f7..0b762b5 100644 --- a/hackerspace/inventory-extras.yaml +++ b/hackerspace/inventory-extras.yaml @@ -12,7 +12,10 @@ spec: - 'refresh_token' responseTypes: - 'code' + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - 'openid' - 'profile' - 'groups' diff --git a/harbor-operator/application-extras.yaml b/harbor-operator/application-extras.yaml index 8bb8a66..0003b66 100644 --- a/harbor-operator/application-extras.yaml +++ b/harbor-operator/application-extras.yaml @@ -16,7 +16,10 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile pkce: false diff --git a/nextcloud/application.yaml b/nextcloud/application.yaml index 5556f7b..77636e2 100644 --- a/nextcloud/application.yaml +++ b/nextcloud/application.yaml @@ -54,7 +54,10 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile pkce: false diff --git a/passmower/kubelogin.yaml b/passmower/kubelogin.yaml index 46a5655..f06b611 100644 --- a/passmower/kubelogin.yaml +++ b/passmower/kubelogin.yaml @@ -15,7 +15,10 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile tokenEndpointAuthMethod: none diff --git a/passmower/kustomization.yaml b/passmower/kustomization.yaml index 3f7d2fa..9550885 100644 --- a/passmower/kustomization.yaml +++ b/passmower/kustomization.yaml @@ -11,7 +11,7 @@ helmCharts: releaseName: *name repo: oci://ghcr.io/passmower/charts valuesFile: values.yaml - version: 1.3.0 + version: 2.3.0 resources: - ssh://git@git.k-space.ee/secretspace/kube/passmower # secrets: email-credentials, github-client, slack-client diff --git a/passmower/proxmox.yaml b/passmower/proxmox.yaml index c9827a0..6901d11 100644 --- a/passmower/proxmox.yaml +++ b/passmower/proxmox.yaml @@ -28,7 +28,10 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile --- diff --git a/passmower/values.yaml b/passmower/values.yaml index 07e6cc3..606e354 100644 --- a/passmower/values.yaml +++ b/passmower/values.yaml @@ -6,34 +6,34 @@ passmower: # Hostname on which Passmower will be deployed to. Will be used as ingress host. host: "auth.k-space.ee" # Local groups will be created with given prefix. - group_prefix: 'k-space' + groupPrefix: 'k-space' # Local or remote group which members will automatically become admins. - admin_group: 'k-space:onboarding' + adminGroup: 'k-space:onboarding' # If set, require all users to be member of the given local or remote group. # required_group: "" # GitHub organization to pull groups from. Set to keep users other organizations private from Passmower. - github_organization: "codemowers" + githubOrganization: "codemowers" # Allow enrolling new users automatically. Actual access will be based on required_group parameter. Disable to only manually provision users. - enroll_users: false + enrollUsers: false # Disable making changes to users on their profile or via admin panel - use for enforcing GitOps practices via OIDCUser spec. - disable_frontend_edit: true + disableFrontendEdit: true # Comma-separated, wildcard enabled namespace selector to select, in which namespaces Passmower looks for client CRDs. - namespace_selector: "*" + namespaceSelector: "*" # Domain which will be preferred for determining primary emails. - preferred_email_domain: 'k-space.ee' + preferredEmailDomain: 'k-space.ee' # Require users to set a custom username instead of system generated one. Will be used as OIDCUser CRD name and OIDC username claim. - require_custom_username: true + usernameSource: prompt # Normalize incoming email addresses by removing aliases (e.g. username+alias@gmail.com) etc. - normalize_email_addresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere. + normalizeEmailAddresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere. # Email credentials secret name. Secret must contain EMAIL_HOST, EMAIL_PASSWORD, EMAIL_PORT, EMAIL_SSL and EMAIL_USERNAME - email_credentials_secretRef: "email-credentials" + emailCredentialsSecretRef: "email-credentials" # GitHub OAuth client secret name. Secret must contain GH_CLIENT_ID and GH_CLIENT_SECRET - github_client_secretRef: "github-client" + githubClientSecretRef: "github-client" # Generic OIDC upstream login providers. Each provider's credentials secret must # contain _CLIENT_ID and _CLIENT_SECRET. Callback path is # /interaction/callback/. Provider appears once its secret is present. oidcProviders: - - key: codeberg + codeberg: displayName: Codeberg issuer: https://codeberg.org # Secret must contain CODEBERG_CLIENT_ID and CODEBERG_CLIENT_SECRET @@ -41,7 +41,7 @@ passmower: groupsClaim: groups icon: '' # Slack API client secret name. Secret must contain SLACK_TOKEN - slack_client_secretRef: "slack-client" + slackClientSecretRef: "slack-client" # Different texts displayed and sent to the user texts: approval: @@ -50,10 +50,10 @@ passmower: emails: configMapRef: name: passmower-email-templates - terms_of_service: + termsOfService: configMapRef: name: passmower-tos - disable_frontend_edit: + disableFrontendEdit: content: "Edit users via [the members repo](https://git.k-space.ee/k-space/members). The repository is automatically synced to cluster via [ArgoCD](https://argocd.k-space.ee/applications/argocd/members?view=tree&resource=)" diff --git a/wiki/application.yaml b/wiki/application.yaml index fbe9608..ab236bc 100644 --- a/wiki/application.yaml +++ b/wiki/application.yaml @@ -15,52 +15,53 @@ spec: - refresh_token responseTypes: - code + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - openid - profile - groups tokenEndpointAuthMethod: client_secret_post pkce: false - secretRefreshPod: - apiVersion: v1 - kind: Pod - metadata: - name: reset-oidc-config - spec: - volumes: - - name: tmp - emptyDir: {} - initContainers: - - name: jq - image: mirror.gcr.io/alpine/k8s:1.35.0 - imagePullPolicy: IfNotPresent - volumeMounts: - - mountPath: /tmp - name: tmp - envFrom: - - secretRef: - name: oidc-client-wiki-owner-secrets - command: - - /bin/sh - - -c - - jq '{"strategyKey":"oidc","config":{"clientId":$ENV.OIDC_CLIENT_ID,"clientSecret":$ENV.OIDC_CLIENT_SECRET,"authorizationURL":$ENV.OIDC_IDP_AUTH_URI,"tokenURL":$ENV.OIDC_IDP_TOKEN_URI,"userInfoURL":$ENV.OIDC_IDP_USERINFO_URI,"skipUserProfile":false,"issuer":$ENV.OIDC_IDP_URI,"emailClaim":"email","displayNameClaim":"name","mapGroups":true,"groupsClaim":"groups","logoutURL":$ENV.OIDC_IDP_URI,"acrValues":""}} | "UPDATE authentication SET config=\(.config|tostring|@sh) WHERE \"strategyKey\"=\(.strategyKey|tostring|@sh)"' -n -r > /tmp/update.sql - containers: - - name: psql - image: mirror.gcr.io/alpine/psql - imagePullPolicy: IfNotPresent - volumeMounts: - - mountPath: /tmp - name: tmp - env: - - name: PGPASSWORD - valueFrom: - secretKeyRef: - name: postgres-appuser-password - key: password - command: - - /bin/sh - - -c - - psql -U kspace_wiki -d wiki -h postgres < /tmp/update.sql + secretRefreshJobSpec: + template: + spec: + restartPolicy: OnFailure + volumes: + - name: tmp + emptyDir: {} + initContainers: + - name: jq + image: mirror.gcr.io/alpine/k8s:1.35.0 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /tmp + name: tmp + envFrom: + - secretRef: + name: oidc-client-wiki-owner-secrets + command: + - /bin/sh + - -c + - jq '{"strategyKey":"oidc","config":{"clientId":$ENV.OIDC_CLIENT_ID,"clientSecret":$ENV.OIDC_CLIENT_SECRET,"authorizationURL":$ENV.OIDC_IDP_AUTH_URI,"tokenURL":$ENV.OIDC_IDP_TOKEN_URI,"userInfoURL":$ENV.OIDC_IDP_USERINFO_URI,"skipUserProfile":false,"issuer":$ENV.OIDC_IDP_URI,"emailClaim":"email","displayNameClaim":"name","mapGroups":true,"groupsClaim":"groups","logoutURL":$ENV.OIDC_IDP_URI,"acrValues":""}} | "UPDATE authentication SET config=\(.config|tostring|@sh) WHERE \"strategyKey\"=\(.strategyKey|tostring|@sh)"' -n -r > /tmp/update.sql + containers: + - name: psql + image: mirror.gcr.io/alpine/psql + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /tmp + name: tmp + env: + - name: PGPASSWORD + valueFrom: + secretKeyRef: + name: postgres-appuser-password + key: password + command: + - /bin/sh + - -c + - psql -U kspace_wiki -d wiki -h postgres < /tmp/update.sql --- apiVersion: apps/v1 kind: StatefulSet diff --git a/wildduck/wildflock.yaml b/wildduck/wildflock.yaml index 4f48ee3..e57b89f 100644 --- a/wildduck/wildflock.yaml +++ b/wildduck/wildflock.yaml @@ -26,7 +26,10 @@ spec: - "refresh_token" responseTypes: - "code" + # Preserve 1.x email claims for clients whose requests only include profile. + overrideIncomingScopes: true availableScopes: + - email - "openid" - "profile" - "offline_access"