hedgedoc: manage the scout-hedgedoc OIDC client with the kanidm-operator (#19 step 1) #20

Merged

sophie merged 1 commit from hedgedoc-kanidm-operator into main

2026-10-19 23:34:53 +11:00

myagent commented

2026-10-19 23:30:53 +11:00

Collaborator

Step 1 of #19: hedgedoc's Kanidm OIDC client moves onto the kanidm-operator.

What changes

argo/hedgedoc/kanidm.yaml (new): a Group for scout_hedgedoc_users and an OAuth2Client for scout-hedgedoc, both adopted from the hand-made objects. The spec was copied from the live state on 2026-10-19 (one redirect URL https://notes.m.ac.nz/auth/oauth2/callback, landing https://notes.m.ac.nz/, scope map scout_hedgedoc_users → openid email profile groups, no claim maps, strict redirect already on, member sophie), so adoption rewrites nothing in Kanidm. preferShortUsername stays at its default (false), matching the live client, so preferred_username and therefore hedgedoc identities are unchanged.
argo/hedgedoc/deployment.yaml: CMD_OAUTH2_CLIENT_SECRET now reads Secret scout-hedgedoc-oidc, key client_secret, which the operator writes with the adopted client's existing basic secret.

Not in this PR: the OnePasswordItem hedgedoc-oidc-idmacnz stays, so reverting this PR is a clean rollback. Removing it is step 2 of #19.

After merge

k() { kubectl --context scout-tailscale-operator.tuatara-puffin.ts.net \"$@\"; }
k -n hedgedoc get oauth2clients.kanidm.m.ac.nz,groups.kanidm.m.ac.nz   # Ready=True
k -n hedgedoc get oauth2client scout-hedgedoc -o jsonpath=\"{.status.adopted}\"   # true
k -n hedgedoc get secret scout-hedgedoc-oidc
k -n hedgedoc rollout status deploy/hedgedoc

then log in at https://notes.m.ac.nz. The new hedgedoc pod will sit in CreateContainerConfigError for a few seconds until the operator has written the Secret; the old pod keeps serving meanwhile.

Rollback: revert this PR. Do not delete the OAuth2Client CR by hand unless you mean to delete the Kanidm client (finalizer).

🤖 Generated with Claude Code

Step 1 of #19: hedgedoc's Kanidm OIDC client moves onto the kanidm-operator. **What changes** - `argo/hedgedoc/kanidm.yaml` (new): a `Group` for `scout_hedgedoc_users` and an `OAuth2Client` for `scout-hedgedoc`, both adopted from the hand-made objects. The spec was copied from the live state on 2026-10-19 (one redirect URL `https://notes.m.ac.nz/auth/oauth2/callback`, landing `https://notes.m.ac.nz/`, scope map `scout_hedgedoc_users` → `openid email profile groups`, no claim maps, strict redirect already on, member `sophie`), so adoption rewrites nothing in Kanidm. `preferShortUsername` stays at its default (false), matching the live client, so `preferred_username` and therefore hedgedoc identities are unchanged. - `argo/hedgedoc/deployment.yaml`: `CMD_OAUTH2_CLIENT_SECRET` now reads Secret `scout-hedgedoc-oidc`, key `client_secret`, which the operator writes with the adopted client's existing basic secret. **Not in this PR**: the `OnePasswordItem` `hedgedoc-oidc-idmacnz` stays, so reverting this PR is a clean rollback. Removing it is step 2 of #19. **After merge** ```sh k() { kubectl --context scout-tailscale-operator.tuatara-puffin.ts.net \"$@\"; } k -n hedgedoc get oauth2clients.kanidm.m.ac.nz,groups.kanidm.m.ac.nz # Ready=True k -n hedgedoc get oauth2client scout-hedgedoc -o jsonpath=\"{.status.adopted}\" # true k -n hedgedoc get secret scout-hedgedoc-oidc k -n hedgedoc rollout status deploy/hedgedoc ``` then log in at https://notes.m.ac.nz. The new hedgedoc pod will sit in `CreateContainerConfigError` for a few seconds until the operator has written the Secret; the old pod keeps serving meanwhile. **Rollback**: revert this PR. Do not delete the `OAuth2Client` CR by hand unless you mean to delete the Kanidm client (finalizer). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

myagent added 1 commit

2026-10-19 23:30:53 +11:00

hedgedoc: manage the scout-hedgedoc OIDC client with the kanidm-operator 960183a5cf

Step 1 of #19. Adds a Group (scout_hedgedoc_users) and an OAuth2Client
(scout-hedgedoc) in argo/hedgedoc/, copied from the live Kanidm state so
adoption changes nothing there, and points CMD_OAUTH2_CLIENT_SECRET at the
operator-written Secret scout-hedgedoc-oidc (key client_secret).

The OnePasswordItem hedgedoc-oidc-idmacnz stays for now so a revert of this
commit is a clean rollback. Removing it is step 2.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

myagent referenced this pull request

2026-10-19 23:31:18 +11:00

hedgedoc: move the scout-hedgedoc OIDC client onto kanidm-operator #19