mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
135bca4a83
Adds Scouts Online 3 (login.scouting.nl) as an OIDC source. Its userinfo has the member's roles within the group; a property mapping puts every member in "MBG leden" and those with an active Kaderlid role also in "MBG kader", on every login. Members become external users. Family members can share an email address and immich needs a unique one, so those get a plus address with their member number. The immich provider now authenticates through a flow whose only stage is an identification stage with this one source and no fields, which sends people straight on to Scouts Online. The source's own flows only run through the source.
199 lines
4.4 KiB
YAML
199 lines
4.4 KiB
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-secrets
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: authentik-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: secret_key
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: secret_key
|
|
- secretKey: bootstrap_password
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: bootstrap_password
|
|
- secretKey: bootstrap_token
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: bootstrap_token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-postgres-credentials
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: authentik-postgres-credentials
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: postgres_user
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: postgres_password
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: vault-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: vault-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/vault-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: stalwart-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: stalwart-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/stalwart-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: argocd-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: argocd-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/argocd-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: freshrss-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: freshrss-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/freshrss-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: actualbudget-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: actualbudget-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/actualbudget-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: longhorn-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: longhorn-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/longhorn-oidc
|
|
property: client_secret
|
|
---
|
|
# Mounted as a file for blueprint-scouting.yaml, not as an env variable.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: immich-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/immich-oidc
|
|
property: client_secret
|
|
---
|
|
# The Scouts Online connection (login.scouting.nl, "Beheerde websites"),
|
|
# mounted as files for blueprint-scouting.yaml.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: scouts-online-client
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: scouts-online-client
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_id
|
|
remoteRef:
|
|
key: kv/scouts-online
|
|
property: client_id
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/scouts-online
|
|
property: client_secret
|