Upgrade Passmower to 2.3.0 and migrate client compatibility

argocd/oidc-auth.yaml

@@ -18,8 +18,10 @@ spec:
   responseTypes:
     - code
   availableScopes:
+    - email
     - openid
     - profile
+    - groups
   pkce: false
   secretMetadata:
     labels:

freescout/application.yaml

@@ -33,13 +33,15 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
   pkce: false
-  secretRefreshPod:
+  secretRefreshJobSpec:
-    apiVersion: v1
+    template:
-    kind: Pod
       spec:
         volumes:
           - name: tmp

gitea/application.yaml

@@ -76,16 +76,15 @@ spec:
   responseTypes:
     - code
   availableScopes:
+    - email
     - openid
     - profile
   overrideIncomingScopes: true
   pkce: false
-  secretRefreshPod:
+  secretRefreshJobSpec:
-    apiVersion: v1
+    template:
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
       spec:
+        restartPolicy: OnFailure
         volumes:
           - name: tmp
             emptyDir: {}

grafana/passmower.yaml

@@ -15,7 +15,10 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
     - groups

hackerspace/inventory-extras.yaml

@@ -12,7 +12,10 @@ spec:
     - 'refresh_token'
   responseTypes:
     - 'code'
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - 'openid'
     - 'profile'
     - 'groups'

harbor-operator/application-extras.yaml

@@ -16,7 +16,10 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
   pkce: false

nextcloud/application.yaml

@@ -54,7 +54,10 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
   pkce: false

passmower/kubelogin.yaml

@@ -15,7 +15,10 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
   tokenEndpointAuthMethod: none

passmower/kustomization.yaml

@@ -11,7 +11,7 @@ helmCharts:
   releaseName: *name
   repo: oci://ghcr.io/passmower/charts
   valuesFile: values.yaml
-  version: 1.3.0
+  version: 2.3.0
 
 resources:
 - ssh://git@git.k-space.ee/secretspace/kube/passmower # secrets: email-credentials, github-client, slack-client

passmower/proxmox.yaml

@@ -28,7 +28,10 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
 ---

passmower/values.yaml

@@ -6,34 +6,34 @@ passmower:
   # Hostname on which Passmower will be deployed to. Will be used as ingress host.
   host: "auth.k-space.ee"
   # Local groups will be created with given prefix.
-  group_prefix: 'k-space'
+  groupPrefix: 'k-space'
   # Local or remote group which members will automatically become admins.
-  admin_group: 'k-space:onboarding'
+  adminGroup: 'k-space:onboarding'
   # If set, require all users to be member of the given local or remote group.
   # required_group: ""
   # GitHub organization to pull groups from. Set to keep users other organizations private from Passmower.
-  github_organization: "codemowers"
+  githubOrganization: "codemowers"
   # Allow enrolling new users automatically. Actual access will be based on required_group parameter. Disable to only manually provision users.
-  enroll_users: false
+  enrollUsers: false
   # Disable making changes to users on their profile or via admin panel - use for enforcing GitOps practices via OIDCUser spec.
-  disable_frontend_edit: true
+  disableFrontendEdit: true
   # Comma-separated, wildcard enabled namespace selector to select, in which namespaces Passmower looks for client CRDs.
-  namespace_selector: "*"
+  namespaceSelector: "*"
   # Domain which will be preferred for determining primary emails.
-  preferred_email_domain: 'k-space.ee'
+  preferredEmailDomain: 'k-space.ee'
   # Require users to set a custom username instead of system generated one. Will be used as OIDCUser CRD name and OIDC username claim.
-  require_custom_username: true
+  usernameSource: prompt
   # Normalize incoming email addresses by removing aliases (e.g. username+alias@gmail.com) etc.
-  normalize_email_addresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere.
+  normalizeEmailAddresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere.
   # Email credentials secret name. Secret must contain EMAIL_HOST, EMAIL_PASSWORD, EMAIL_PORT, EMAIL_SSL and EMAIL_USERNAME
-  email_credentials_secretRef: "email-credentials"
+  emailCredentialsSecretRef: "email-credentials"
   # GitHub OAuth client secret name. Secret must contain GH_CLIENT_ID and GH_CLIENT_SECRET
-  github_client_secretRef: "github-client"
+  githubClientSecretRef: "github-client"
   # Generic OIDC upstream login providers. Each provider's credentials secret must
   # contain <KEY>_CLIENT_ID and <KEY>_CLIENT_SECRET. Callback path is
   # /interaction/callback/<key>. Provider appears once its secret is present.
   oidcProviders:
-    - key: codeberg
+    codeberg:
       displayName: Codeberg
       issuer: https://codeberg.org
       # Secret must contain CODEBERG_CLIENT_ID and CODEBERG_CLIENT_SECRET
@@ -41,7 +41,7 @@ passmower:
       groupsClaim: groups
       icon: '<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="#2185D0" d="M11.955.49A12 12 0 0 0 0 12.49a12 12 0 0 0 1.832 6.373L11.838 5.928a.187.14 0 0 1 .324 0l10.006 12.935A12 12 0 0 0 24 12.49a12 12 0 0 0-12-12 12 12 0 0 0-.045 0zm.375 6.467 4.416 17.043a12 12 0 0 0 5.137-4.213L12.516 7.008a.187.14 0 0 0-.186-.05z"/></svg>'
   # Slack API client secret name. Secret must contain SLACK_TOKEN
-  slack_client_secretRef: "slack-client"
+  slackClientSecretRef: "slack-client"
   # Different texts displayed and sent to the user
   texts:
     approval:
@@ -50,10 +50,10 @@ passmower:
     emails:
       configMapRef:
         name: passmower-email-templates
-    terms_of_service:
+    termsOfService:
       configMapRef:
         name: passmower-tos
-    disable_frontend_edit:
+    disableFrontendEdit:
         content: "Edit users via [the members repo](https://git.k-space.ee/k-space/members). The repository is automatically synced to cluster via [ArgoCD](https://argocd.k-space.ee/applications/argocd/members?view=tree&resource=)"
 
 

wiki/application.yaml

@@ -15,18 +15,19 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
     - groups
   tokenEndpointAuthMethod: client_secret_post
   pkce: false
-  secretRefreshPod:
+  secretRefreshJobSpec:
-    apiVersion: v1
+    template:
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
       spec:
+        restartPolicy: OnFailure
         volumes:
           - name: tmp
             emptyDir: {}

wildduck/wildflock.yaml

@@ -26,7 +26,10 @@ spec:
     - "refresh_token"
   responseTypes:
     - "code"
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - "openid"
     - "profile"
     - "offline_access"