Skip to content

Commit 65ce407

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(info): use root-host for Keycloak OIDC issuer URL in tenant kubeconfig
The kubeconfig generated for non-root tenants pointed `--oidc-issuer-url` at `keycloak.<TENANT>.<ROOT-DOMAIN>` because `$host` was sourced from `_namespace.host` (tenant-specific subdomain). Keycloak's ingress and cert live at `keycloak.<ROOT-DOMAIN>` (built from `_cluster.root-host`), so `kubectl oidc-login` failed TLS verification against the nginx-ingress default fake cert. The existing lookup-based override that tried to read `tenant-root`'s `spec.values.host` no longer triggers since PR #1787 migrated tenant-root to `valuesFrom` (Secret-backed), leaving `spec.values` empty. Use `_cluster.root-host` directly, matching what the dashboard gatekeeper template already does for the same Keycloak realm. Assisted-By: Claude <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent ce8e738 commit 65ce407

1 file changed

Lines changed: 1 addition & 7 deletions

File tree

‎packages/extra/info/templates/kubeconfig.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- $host := .Values._namespace.host | default (index .Values._cluster "root-host") }}
1+
{{- $host := index .Values._cluster "root-host" }}
22
{{- $oidcEnabled := index .Values._cluster "oidc-enabled" }}
33
{{- if $oidcEnabled }}
44
{{- $apiServerEndpoint := index .Values._cluster "api-server-endpoint" }}
@@ -7,12 +7,6 @@
77
{{- $apiServerEndpoint = $managementKubeconfigEndpoint }}
88
{{- end }}
99
{{- $k8sCa := index .Values._cluster "kube-root-ca" }}
10-
{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
11-
{{- $tenantRoot := lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
12-
{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
13-
{{- $host = $tenantRoot.spec.values.host }}
14-
{{- end }}
15-
{{- end }}
1610
---
1711
apiVersion: v1
1812
kind: Secret

0 commit comments

Comments
 (0)