feat: Remove OIDC and SSO support
Existing SSO accounts have no local password, so the migration deactivates them before dropping is_sso_user and the identity_provider_user table.
This commit is contained in:
Daniel Hiller
@@ -116,7 +116,6 @@ Any questions or concerns, [raise an issue](https://github.com/Chris-Greaves/pla
|
||||
|
||||
The Helm chart supports mounting arbitrary ConfigMaps, Secrets, and Volumes to the PLANKA deployment using the `extraMounts` configuration. This is especially useful for scenarios like:
|
||||
|
||||
- Mounting custom CA certificates for OIDC with self-hosted identity providers
|
||||
- Adding custom configuration files
|
||||
- Mounting TLS certificates from existing secrets
|
||||
- Adding temporary or persistent storage volumes
|
||||
@@ -173,44 +172,6 @@ extraMounts:
|
||||
path: /exports/planka
|
||||
```
|
||||
|
||||
### OIDC with Self-Hosted Keycloak
|
||||
|
||||
A common use case is configuring OIDC with a self-hosted Keycloak instance that uses custom CA certificates.
|
||||
|
||||
First, create the CA certificate ConfigMap:
|
||||
|
||||
```bash
|
||||
kubectl create configmap ca-certificates --from-file=ca.crt=/path/to/your/ca.crt
|
||||
```
|
||||
|
||||
Then configure the chart:
|
||||
|
||||
```yaml
|
||||
# Mount custom CA certificate from existing ConfigMap
|
||||
extraMounts:
|
||||
- name: keycloak-ca
|
||||
mountPath: /etc/ssl/certs/keycloak-ca.crt
|
||||
subPath: ca.crt
|
||||
readOnly: true
|
||||
configMap:
|
||||
name: ca-certificates
|
||||
|
||||
# Configure Node.js to trust the custom CA
|
||||
extraEnv:
|
||||
- name: NODE_EXTRA_CA_CERTS
|
||||
value: "/etc/ssl/certs/keycloak-ca.crt"
|
||||
|
||||
# Enable OIDC
|
||||
oidc:
|
||||
enabled: true
|
||||
clientId: "planka-client"
|
||||
clientSecret: "your-client-secret"
|
||||
issuerUrl: "https://keycloak.example.com/realms/master"
|
||||
admin:
|
||||
roles:
|
||||
- "planka-admin"
|
||||
```
|
||||
|
||||
### Environment Variables from Secrets
|
||||
|
||||
You can reference values from existing secrets in environment variables:
|
||||
@@ -310,7 +271,4 @@ image:
|
||||
- **Reproducibility**: Makes deployments fully reproducible across environments
|
||||
- **Audit Trail**: Provides clear image identity in deployment manifests
|
||||
|
||||
### Complete Example
|
||||
|
||||
See `values-example.yaml` for a comprehensive example that demonstrates all the advanced features including OIDC configuration with custom CA certificates.
|
||||
````
|
||||
|
||||
@@ -173,33 +173,6 @@ spec:
|
||||
- name: {{ $k | quote }}
|
||||
value: {{ $v | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.enabled }}
|
||||
{{- $secretName := default (printf "%s-oidc" (include "planka.fullname" .)) .Values.oidc.existingSecret }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: clientId
|
||||
name: {{ $secretName }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: clientSecret
|
||||
name: {{ $secretName }}
|
||||
- name: OIDC_ISSUER
|
||||
value: {{ required "issuerUrl is required when configuring OIDC" .Values.oidc.issuerUrl | quote }}
|
||||
- name: OIDC_SCOPES
|
||||
value: {{ join " " .Values.oidc.scopes | default "openid profile email" | quote }}
|
||||
{{- if .Values.oidc.admin.roles }}
|
||||
- name: OIDC_ADMIN_ROLES
|
||||
value: {{ join "," .Values.oidc.admin.roles | quote }}
|
||||
{{- end }}
|
||||
- name: OIDC_ROLES_ATTRIBUTE
|
||||
value: {{ .Values.oidc.admin.rolesAttribute | default "groups" | quote }}
|
||||
{{- if .Values.oidc.admin.ignoreRoles }}
|
||||
- name: OIDC_IGNORE_ROLES
|
||||
value: {{ .Values.oidc.admin.ignoreRoles | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraContainers -}}
|
||||
{{ toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
{{- if .Values.oidc.enabled }}
|
||||
{{- if eq (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (not (empty .Values.oidc.existingSecret)) -}}
|
||||
{{- fail "Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`" -}}
|
||||
{{- end }}
|
||||
{{- if (and (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (empty .Values.oidc.existingSecret)) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "planka.fullname" . }}-oidc
|
||||
labels:
|
||||
{{- include "planka.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
clientId: {{ .Values.oidc.clientId | b64enc | quote }}
|
||||
clientSecret: {{ .Values.oidc.clientSecret | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -151,71 +151,6 @@ persistence:
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
|
||||
## OpenID Identity Management configuration
|
||||
##
|
||||
## Example:
|
||||
## ---------------
|
||||
## oidc:
|
||||
## enabled: true
|
||||
## clientId: sxxaAIAxVXlCxTmc1YLHBbQr8NL8MqLI2DUbt42d
|
||||
## clientSecret: om4RTMRVHRszU7bqxB7RZNkHIzA8e4sGYWxeCwIMYQXPwEBWe4SY5a0wwCe9ltB3zrq5f0dnFnp34cEHD7QSMHsKvV9AiV5Z7eqDraMnv0I8IFivmuV5wovAECAYreSI
|
||||
## issuerUrl: https://auth.local/application/o/planka/
|
||||
## admin:
|
||||
## roles:
|
||||
## - planka-admin
|
||||
##
|
||||
## ---------------
|
||||
## NOTE: A minimal configuration requires setting `clientId`, `clientSecret` and `issuerUrl`. (plus `admin.roles` for administrators)
|
||||
## ref: https://docs.planka.cloud/docs/configuration/oidc/
|
||||
##
|
||||
oidc:
|
||||
## @param oidc.enabled Enable single sign-on (SSO) with OpenID Connect (OIDC)
|
||||
##
|
||||
enabled: false
|
||||
|
||||
## OIDC credentials
|
||||
## @param oidc.clientId A string unique to the provider that identifies your app.
|
||||
## @param oidc.clientSecret A secret string that the provider uses to confirm ownership of a client ID.
|
||||
##
|
||||
## NOTE: Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`
|
||||
##
|
||||
clientId: ""
|
||||
clientSecret: ""
|
||||
|
||||
## @param oidc.existingSecret Name of an existing secret containing OIDC credentials
|
||||
## NOTE: Must contain key `clientId` and `clientSecret`
|
||||
## NOTE: When it's set, the `clientId` and `clientSecret` parameters are ignored
|
||||
##
|
||||
existingSecret: ""
|
||||
|
||||
## @param oidc.issuerUrl The OpenID connect metadata document endpoint
|
||||
##
|
||||
issuerUrl: ""
|
||||
|
||||
## @param oidc.scopes A list of scopes required for OIDC client.
|
||||
## If empty will default to `openid`, `profile` and `email`
|
||||
## NOTE: PLANKA needs the email and name claims
|
||||
##
|
||||
scopes: []
|
||||
|
||||
## Admin permissions configuration
|
||||
admin:
|
||||
## @param oidc.admin.ignoreRoles If set to true, the admin roles will be ignored.
|
||||
## It is useful if you want to use OIDC for authentication but not for authorization.
|
||||
## If empty will default to `false`
|
||||
##
|
||||
ignoreRoles: false
|
||||
|
||||
## @param oidc.admin.rolesAttribute The name of a custom group claim that you have configured in your OIDC provider
|
||||
## If empty will default to `groups`
|
||||
##
|
||||
rolesAttribute: groups
|
||||
|
||||
## @param oidc.admin.roles The names of the admin groups
|
||||
##
|
||||
roles: []
|
||||
# - planka-admin
|
||||
|
||||
## Extra environment variables for planka deployment
|
||||
## Supports hard coded and getting values from a k8s secret
|
||||
## - name: test
|
||||
@@ -293,20 +228,6 @@ extraMounts: []
|
||||
## emptyDir:
|
||||
## sizeLimit: 1Gi
|
||||
|
||||
## Example configuration for OIDC with self-hosted Keycloak using custom CA
|
||||
## (Requires pre-existing ConfigMap "ca-certificates")
|
||||
## extraMounts:
|
||||
## - name: keycloak-ca
|
||||
## mountPath: /etc/ssl/certs/keycloak-ca.crt
|
||||
## subPath: ca.crt
|
||||
## readOnly: true
|
||||
## configMap:
|
||||
## name: ca-certificates
|
||||
##
|
||||
## extraEnv:
|
||||
## - name: NODE_EXTRA_CA_CERTS
|
||||
## value: "/etc/ssl/certs/keycloak-ca.crt"
|
||||
|
||||
extraContainers: []
|
||||
## Extra sidecar containers
|
||||
## Add additional containers to the PLANKA pod
|
||||
|
||||
Reference in New Issue
Block a user