Upgrade Passmower to 2.3.0 and migrate client compatibility

2026-09-18 12:29:05 +03:00
parent 4634d25320
commit 3ab70fedae
13 changed files with 186 additions and 161 deletions
@@ -33,75 +33,77 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
  pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
-    spec:
-      volumes:
-        - name: tmp
-          emptyDir: {}
-      initContainers:
-        - name: jq
-          image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730
-          command:
-            - /bin/bash
-            - '-c'
-            - >-
-              rm -fv /tmp/update.sql; jq
-              '{"name":"oauth.client_id","value":$ENV.OIDC_CLIENT_ID} | "UPDATE
-              options SET value=\(.value|tostring|@sh) WHERE
-              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
-              '{"name":"oauth.client_secret","value":$ENV.OIDC_CLIENT_SECRET} |
-              "UPDATE options SET value=\(.value|tostring|@sh) WHERE
-              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
-              '{"name":"oauth.auth_url","value":$ENV.OIDC_IDP_AUTH_URI} |
-              "UPDATE options SET value=\(.value + "?scope=openid+profile"
-              |tostring|@sh) WHERE name=\(.name|tostring|@sh) LIMIT 1;"' -n -r
-              >> /tmp/update.sql; jq
-              '{"name":"oauth.token_url","value":$ENV.OIDC_IDP_TOKEN_URI} |
-              "UPDATE options SET value=\(.value|tostring|@sh) WHERE
-              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
-              '{"name":"oauth.user_url","value":$ENV.OIDC_IDP_USERINFO_URI}
-              | "UPDATE options SET value=\(.value|tostring|@sh) WHERE
-              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql;
-              cat /tmp/update.sql
-          envFrom:
-            - secretRef:
-                name: oidc-client-freescout-owner-secrets
-          resources: {}
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          imagePullPolicy: IfNotPresent
-      containers:
-        - name: mysql
-          image: mirror.gcr.io/library/mysql:latest
-          command:
-            - /bin/bash
-            - '-c'
-            - >-
-              mysql -u freescout freescout -h mariadb
-              -p${MYSQL_PWD} < /tmp/update.sql
-          env:
-            - name: MYSQL_PWD
-              valueFrom:
-                secretKeyRef:
-                  name: mariadb-secrets
-                  key: MYSQL_PASSWORD
-          resources: {}
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          imagePullPolicy: IfNotPresent
-      restartPolicy: OnFailure
+  secretRefreshJobSpec:
+    template:
+      spec:
+        volumes:
+          - name: tmp
+            emptyDir: {}
+        initContainers:
+          - name: jq
+            image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730
+            command:
+              - /bin/bash
+              - '-c'
+              - >-
+                rm -fv /tmp/update.sql; jq
+                '{"name":"oauth.client_id","value":$ENV.OIDC_CLIENT_ID} | "UPDATE
+                options SET value=\(.value|tostring|@sh) WHERE
+                name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+                '{"name":"oauth.client_secret","value":$ENV.OIDC_CLIENT_SECRET} |
+                "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+                name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+                '{"name":"oauth.auth_url","value":$ENV.OIDC_IDP_AUTH_URI} |
+                "UPDATE options SET value=\(.value + "?scope=openid+profile"
+                |tostring|@sh) WHERE name=\(.name|tostring|@sh) LIMIT 1;"' -n -r
+                >> /tmp/update.sql; jq
+                '{"name":"oauth.token_url","value":$ENV.OIDC_IDP_TOKEN_URI} |
+                "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+                name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+                '{"name":"oauth.user_url","value":$ENV.OIDC_IDP_USERINFO_URI}
+                | "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+                name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql;
+                cat /tmp/update.sql
+            envFrom:
+              - secretRef:
+                  name: oidc-client-freescout-owner-secrets
+            resources: {}
+            volumeMounts:
+              - name: tmp
+                mountPath: /tmp
+            terminationMessagePath: /dev/termination-log
+            terminationMessagePolicy: File
+            imagePullPolicy: IfNotPresent
+        containers:
+          - name: mysql
+            image: mirror.gcr.io/library/mysql:latest
+            command:
+              - /bin/bash
+              - '-c'
+              - >-
+                mysql -u freescout freescout -h mariadb
+                -p${MYSQL_PWD} < /tmp/update.sql
+            env:
+              - name: MYSQL_PWD
+                valueFrom:
+                  secretKeyRef:
+                    name: mariadb-secrets
+                    key: MYSQL_PASSWORD
+            resources: {}
+            volumeMounts:
+              - name: tmp
+                mountPath: /tmp
+            terminationMessagePath: /dev/termination-log
+            terminationMessagePolicy: File
+            imagePullPolicy: IfNotPresent
+        restartPolicy: OnFailure
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress