lab/machine-configs
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

001 — R2: OIDC apiserver flags in kubeApiserverArg #1

New issue
Closed
opened 2026-08-14 01:30:04 +00:00 by ginjiruu · 1 comment
ginjiruu commented 2026-08-14 01:30:04 +00:00
Owner
Copy link

001 — R2: OIDC apiserver flags in kubeApiserverArg

Status: OPEN (unticketed — awaiting this repo's first commit + Forgejo remote)

Part of the hub architecture plan (flux-clusters / clusters#1532, decision D4). Implements R2 in docs/architecture-requirements.md.

What to do

Add the Kanidm OIDC flags to every cluster's apiserver in this repo:

kubeApiserverArg = [
  # ...existing args from modules/rke2.nix defaults...
  "--oidc-issuer-url=https://auth.animeteamspeak.moe/oauth2/openid/kubernetes"
  "--oidc-client-id=kubernetes"
  "--oidc-groups-claim=groups"
  "--oidc-username-claim=preferred_username"
];

Not secrets — plain Nix. Put them in clusters/<name>.nix (or a shared OIDC module, e.g. modules/oidc.nix) as cluster defaults, overridable per cluster. Note the existing clusters/think.nix only sets identity/network; the rke2 baseline args live in modules/rke2.nix defaults.

Acceptance criteria

  • OIDC flags present in kube-apiserver-arg for every cluster
  • kubelogin exec can authenticate a Kanidm identity to k8s (matches clusters#1522)
  • Groups claim wired so capability groups map to k8s RBAC (iac#2 / ADR-0006)

Linked

  • clusters#1522 (OIDC flags), clusters#1532 (plan D4), iac#2 (capability groups)
# 001 — R2: OIDC apiserver flags in kubeApiserverArg Status: OPEN (unticketed — awaiting this repo's first commit + Forgejo remote) Part of the hub architecture plan (flux-clusters / clusters#1532, decision D4). Implements `R2` in `docs/architecture-requirements.md`. ## What to do Add the Kanidm OIDC flags to every cluster's apiserver in this repo: ```nix kubeApiserverArg = [ # ...existing args from modules/rke2.nix defaults... "--oidc-issuer-url=https://auth.animeteamspeak.moe/oauth2/openid/kubernetes" "--oidc-client-id=kubernetes" "--oidc-groups-claim=groups" "--oidc-username-claim=preferred_username" ]; ``` Not secrets — plain Nix. Put them in `clusters/<name>.nix` (or a shared OIDC module, e.g. `modules/oidc.nix`) as cluster defaults, overridable per cluster. Note the existing `clusters/think.nix` only sets identity/network; the rke2 baseline args live in `modules/rke2.nix` defaults. ## Acceptance criteria - [ ] OIDC flags present in `kube-apiserver-arg` for every cluster - [ ] kubelogin exec can authenticate a Kanidm identity to k8s (matches clusters#1522) - [ ] Groups claim wired so capability groups map to k8s RBAC (iac#2 / ADR-0006) ## Linked - clusters#1522 (OIDC flags), clusters#1532 (plan D4), iac#2 (capability groups)
ginjiruu commented 2026-08-14 01:31:22 +00:00
Author
Owner
Copy link

LOE estimate: 0.5–1 day

Smallest of the three tickets, and the only one with zero external dependencies.

Implementation sketch

  • Add the four flags (--oidc-issuer-url, --oidc-client-id, --oidc-groups-claim, --oidc-username-claim) to kubeApiserverArg.
  • Cleanest home is a small shared modules/oidc.nix that sets cluster-level defaults, overridable per cluster — mirrors how the existing baseline args live as option defaults in modules/rke2.nix (kubeApiserverArg at rke2.nix:108) rather than in clusters/<name>.nix. Keeps clusters/think.nix identity/network-only.
  • Config renders automatically: modules/rke2.nix already flattens cl.kubeApiserverArg into kube-apiserver-arg: in config.yaml (rke2.nix:29).

Acceptance notes

  • "kubelogin exec can authenticate" is a runtime verification only possible after a cluster is up — so this ticket's code can land and eval-check, but the acceptance box can't be ticked until a node is running. Same for the groups→RBAC mapping (that's iac-side, not this repo).
  • No secrets involved; plain Nix.

Related small item

R3 (tls-san for the agentgateway-dialed address) is a ~0.25 day sibling but its value depends on the #1533 address decision, so it's worth parking until 002 is unblocked.

Recommendation: start now — it's independent and unblocks the OIDC portion of the plan.

## LOE estimate: 0.5–1 day Smallest of the three tickets, and the only one with zero external dependencies. ### Implementation sketch - Add the four flags (`--oidc-issuer-url`, `--oidc-client-id`, `--oidc-groups-claim`, `--oidc-username-claim`) to `kubeApiserverArg`. - Cleanest home is a small shared `modules/oidc.nix` that sets cluster-level defaults, overridable per cluster — mirrors how the existing baseline args live as option defaults in `modules/rke2.nix` (`kubeApiserverArg` at rke2.nix:108) rather than in `clusters/<name>.nix`. Keeps `clusters/think.nix` identity/network-only. - Config renders automatically: `modules/rke2.nix` already flattens `cl.kubeApiserverArg` into `kube-apiserver-arg:` in `config.yaml` (rke2.nix:29). ### Acceptance notes - "kubelogin exec can authenticate" is a **runtime** verification only possible after a cluster is up — so this ticket's code can land and eval-check, but the acceptance box can't be ticked until a node is running. Same for the groups→RBAC mapping (that's iac-side, not this repo). - No secrets involved; plain Nix. ### Related small item R3 (tls-san for the agentgateway-dialed address) is a ~0.25 day sibling but its value depends on the #1533 address decision, so it's worth parking until 002 is unblocked. **Recommendation:** start now — it's independent and unblocks the OIDC portion of the plan.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
needs-triage
New issue, awaiting triage

No labels
needs-triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/machine-configs#1
No description provided.