Repository navigation
OIDC access fails for sub-tenant clusters due to missing Cilium egress rule #3486
Description
Bug: OIDC access fails for sub-tenant clusters due to missing Cilium egress rule
OIDC authentication does not work for sub-tenant clusters because the generated CiliumClusterwideNetworkPolicy does not include the required egress rule to the root tenant ingress.
Environment
- Cozystack version: v1.6
- Provider OnPrem
- CNI: Cilium
- Authentication provider: Keycloak via ingress-nginx in
tenant-root
Description
OIDC works correctly for regular tenants, but fails for sub-tenant clusters.
The failing traffic is blocked by Cilium:
Policy verdict log:
local EP ID 3825, remote ID 34520,
egress, action deny, match none
10.0.9.72:42279 -> 10.0.0.179:443 TCP SYN
The destination identity is the central ingress-nginx service:
k8s:io.kubernetes.pod.namespace=tenant-root
k8s:cozystack.io/service=ingress
k8s:app.kubernetes.io/name=ingress-nginx
The generated egress policy for a sub-tenant does not contain an allow rule for this endpoint.
Example:
Working tenant:
- toEndpoints:
- matchLabels:
cozystack.io/service: ingress
k8s:io.kubernetes.pod.namespace: tenant-rootSub-tenant:
- toEndpoints:
- matchLabels:
cozystack.io/service: ingress
k8s:io.kubernetes.pod.namespace: tenant-kube3As a result, traffic to the root ingress is denied by Cilium.
Root cause
The tenant egress policy template derives parent tenants from the namespace name:
$parts := splitList "-" .Release.Namespace
This does not match the actual Cozystack tenant hierarchy.
Example:
tenant-root
└── tenant-kube3
└── tenant-kube3-tenant3
The parent relationship is stored in the Tenant CR, not encoded completely in the namespace name.
For tenant-kube3-tenant3, the template generates rules for:
tenant-kube3
tenant-kube3-tenant3
but misses:
tenant-root
even though tenant-root provides the inherited ingress service.
Expected behavior
Sub-tenant clusters should receive the same inherited ingress egress permissions as regular tenants, including access to the root tenant ingress when it is used for shared services such as Keycloak/OIDC.
Suggested fix
Generate the egress rules based on the actual Tenant parent relationship instead of deriving parents from the namespace string. The generated policy should include inherited service namespaces up to tenant-root.
Activity
dosubot commentedon Jul 29, 2026
Hi overhovnik! I'm Dosu and I'm helping the Cozystack team.
This is a known problem tracked in #2171, and a closely related duplicate was also filed as #2810 [1]. The root cause is the same
splitList "-"logic you identified — it cannot reconstruct the full ancestor chain when tenant names don't encode the hierarchy.PR #2912 was merged to fix the namespace labeling side of this bug by replacing the split logic in
namespace.yamlwith a propertenant.ancestorTenantLabelshelper [2] [3]. However, the network policy template (packages/apps/tenant/templates/networkpolicy.yaml) still uses the oldsplitList "-"pattern in multiple places for computing ancestor namespaces in egress rules [4] — which is exactly the gap causing your OIDC failure.So the namespace labels are now correctly propagated, but
networkpolicy.yamlwas not updated with the same fix, leaving the egress rules incomplete for sub-tenants. This likely needs the sametenant.ancestorTenantLabelshelper (or equivalent lookup-based approach) applied to the network policy template as well.A backport of #2912 to
release-1.5is also open as PR #3191 [5].Workaround: You can manually label the sub-tenant namespace with the missing ancestor label and, if needed, manually patch the
CiliumClusterwideNetworkPolicyto include the root ingress endpoint:kubectl label namespace tenant-kube3-tenant3 tenant.cozystack.io/tenant-root=""To reply, just mention @dosu.
Docs are dead. Just use Dosu.