Upgrade Passmower to 2.3.0 and migrate client compatibility

2026-09-18 12:29:05 +03:00
parent 4634d25320
commit 3ab70fedae
13 changed files with 186 additions and 161 deletions
@@ -18,8 +18,10 @@ spec:
  responseTypes:
    - code
  availableScopes:
+    - email
    - openid
    - profile
+    - groups
  pkce: false
  secretMetadata:
    labels:
@@ -33,13 +33,15 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
  pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
+  secretRefreshJobSpec:
+    template:
      spec:
        volumes:
          - name: tmp
@@ -76,16 +76,15 @@ spec:
  responseTypes:
    - code
  availableScopes:
+    - email
    - openid
    - profile
  overrideIncomingScopes: true
  pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
+  secretRefreshJobSpec:
+    template:
      spec:
+        restartPolicy: OnFailure
        volumes:
          - name: tmp
            emptyDir: {}
@@ -15,7 +15,10 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
    - groups
@@ -12,7 +12,10 @@ spec:
    - 'refresh_token'
  responseTypes:
    - 'code'
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - 'openid'
    - 'profile'
    - 'groups'
@@ -16,7 +16,10 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
  pkce: false
@@ -54,7 +54,10 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
  pkce: false
@@ -15,7 +15,10 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
  tokenEndpointAuthMethod: none
@@ -11,7 +11,7 @@ helmCharts:
  releaseName: *name
  repo: oci://ghcr.io/passmower/charts
  valuesFile: values.yaml
-  version: 1.3.0
+  version: 2.3.0

 resources:
 - ssh://git@git.k-space.ee/secretspace/kube/passmower # secrets: email-credentials, github-client, slack-client
@@ -28,7 +28,10 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
 ---
@@ -6,34 +6,34 @@ passmower:
  # Hostname on which Passmower will be deployed to. Will be used as ingress host.
  host: "auth.k-space.ee"
  # Local groups will be created with given prefix.
-  group_prefix: 'k-space'
+  groupPrefix: 'k-space'
  # Local or remote group which members will automatically become admins.
-  admin_group: 'k-space:onboarding'
+  adminGroup: 'k-space:onboarding'
  # If set, require all users to be member of the given local or remote group.
  # required_group: ""
  # GitHub organization to pull groups from. Set to keep users other organizations private from Passmower.
-  github_organization: "codemowers"
+  githubOrganization: "codemowers"
  # Allow enrolling new users automatically. Actual access will be based on required_group parameter. Disable to only manually provision users.
-  enroll_users: false
+  enrollUsers: false
  # Disable making changes to users on their profile or via admin panel - use for enforcing GitOps practices via OIDCUser spec.
-  disable_frontend_edit: true
+  disableFrontendEdit: true
  # Comma-separated, wildcard enabled namespace selector to select, in which namespaces Passmower looks for client CRDs.
-  namespace_selector: "*"
+  namespaceSelector: "*"
  # Domain which will be preferred for determining primary emails.
-  preferred_email_domain: 'k-space.ee'
+  preferredEmailDomain: 'k-space.ee'
  # Require users to set a custom username instead of system generated one. Will be used as OIDCUser CRD name and OIDC username claim.
-  require_custom_username: true
+  usernameSource: prompt
  # Normalize incoming email addresses by removing aliases (e.g. username+alias@gmail.com) etc.
-  normalize_email_addresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere.
+  normalizeEmailAddresses: false # makes members unable to login due to e-mail being stored unnormalized in user oidc crd. Normalizing it by force has had regressions elsewhere.
  # Email credentials secret name. Secret must contain EMAIL_HOST, EMAIL_PASSWORD, EMAIL_PORT, EMAIL_SSL and EMAIL_USERNAME
-  email_credentials_secretRef: "email-credentials"
+  emailCredentialsSecretRef: "email-credentials"
  # GitHub OAuth client secret name. Secret must contain GH_CLIENT_ID and GH_CLIENT_SECRET
-  github_client_secretRef: "github-client"
+  githubClientSecretRef: "github-client"
  # Generic OIDC upstream login providers. Each provider's credentials secret must
  # contain <KEY>_CLIENT_ID and <KEY>_CLIENT_SECRET. Callback path is
  # /interaction/callback/<key>. Provider appears once its secret is present.
  oidcProviders:
-    - key: codeberg
+    codeberg:
      displayName: Codeberg
      issuer: https://codeberg.org
      # Secret must contain CODEBERG_CLIENT_ID and CODEBERG_CLIENT_SECRET
@@ -41,7 +41,7 @@ passmower:
      groupsClaim: groups
      icon: '<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="#2185D0" d="M11.955.49A12 12 0 0 0 0 12.49a12 12 0 0 0 1.832 6.373L11.838 5.928a.187.14 0 0 1 .324 0l10.006 12.935A12 12 0 0 0 24 12.49a12 12 0 0 0-12-12 12 12 0 0 0-.045 0zm.375 6.467 4.416 17.043a12 12 0 0 0 5.137-4.213L12.516 7.008a.187.14 0 0 0-.186-.05z"/></svg>'
  # Slack API client secret name. Secret must contain SLACK_TOKEN
-  slack_client_secretRef: "slack-client"
+  slackClientSecretRef: "slack-client"
  # Different texts displayed and sent to the user
  texts:
    approval:
@@ -50,10 +50,10 @@ passmower:
    emails:
      configMapRef:
        name: passmower-email-templates
-    terms_of_service:
+    termsOfService:
      configMapRef:
        name: passmower-tos
-    disable_frontend_edit:
+    disableFrontendEdit:
        content: "Edit users via [the members repo](https://git.k-space.ee/k-space/members). The repository is automatically synced to cluster via [ArgoCD](https://argocd.k-space.ee/applications/argocd/members?view=tree&resource=)"


@@ -15,18 +15,19 @@ spec:
    - refresh_token
  responseTypes:
    - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - openid
    - profile
    - groups
  tokenEndpointAuthMethod: client_secret_post
  pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
+  secretRefreshJobSpec:
+    template:
      spec:
+        restartPolicy: OnFailure
        volumes:
          - name: tmp
            emptyDir: {}
@@ -26,7 +26,10 @@ spec:
    - "refresh_token"
  responseTypes:
    - "code"
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
  availableScopes:
+    - email
    - "openid"
    - "profile"
    - "offline_access"