fix(k8s): use the env names the app actually reads - #46
Merged
Conversation
The manifests and Helm chart predate the NextAuth v5 migration and inject env verbatim (envFrom), so a deploy from these templates got: - broken sign-in: they set NEXTAUTH_SECRET, but @auth/core reads only AUTH_SECRET (verified in @auth/core/lib/utils/env.js — no legacy fallback); v5 in production throws MissingSecret - dead OAuth credentials: GOOGLE_CLIENT_* / GITHUB_CLIENT_* instead of the AUTH_GOOGLE_* / AUTH_GITHUB_* names v5 infers for bare provider imports - a silently disabled audit trail: MONGODB_URI, while the app reads MONGODB_URL (isMongoAvailable() false -> deferAudit no-ops) - no AUDIT_HMAC_SECRET or TOTP_ENCRYPTION_KEY, both of which fail closed in production - UntrustedHost behind the ingress: nothing set AUTH_TRUST_HOST and auth.ts does not set trustHost Rename every key to what src/ actually consumes, add the two fail-closed secrets, AUTH_TRUST_HOST, and an optional commented CRON_SECRET; drop the unread MONGO_DB_NAME; NEXTAUTH_URL becomes AUTH_URL (the legacy name still works for the URL, unlike the secret — kept consistent anyway). k8s/README examples updated to match. YAML validated by parse; key sets in the raw manifests and the Helm values are identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
MikkoNumminen
added a commit
that referenced
this pull request
Jul 24, 2026
Merging #46 — pure k8s manifests and Helm chart — triggered a full Vercel production rebuild of identical app code, because k8s/ was in scope for the ignore command. Kubernetes is a different deployment target entirely; nothing under k8s/ can affect what Vercel builds. Verified against real history: the #46 merge diff now skips, the #45 (app code) diff still builds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mutation TestingScore: 70.73% (break threshold 60% — ✅ pass). 319 detected / 451 valid mutants (killed 194, timeout 125, survived 31, no-coverage 101). Full report. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last thread from the #45 review: I kept
NEXTAUTH_SECRETin the TOTP fallback chain "because the k8s templates still set it" — and then checked what else those templates set. They predate the NextAuth v5 migration entirely, and since both deployment paths inject env verbatim (envFrom), a fresh k8s deploy from them is broken in five distinct ways:NEXTAUTH_SECRETAUTH_SECRETMissingSecret—@auth/core/lib/utils/env.jsreads onlyAUTH_SECRET, no legacy fallbackGOOGLE_CLIENT_*,GITHUB_CLIENT_*AUTH_GOOGLE_*,AUTH_GITHUB_*(v5 inference for bare provider imports,src/auth.ts:78)MONGODB_URIMONGODB_URL(src/mongoDb.ts:28)AUDIT_HMAC_SECRETTOTP_ENCRYPTION_KEYPlus
AUTH_TRUST_HOSTwas never set —auth.tsdoesn't settrustHost, so v5 behind the ingress rejects proxied Host headers withUntrustedHost(docker-compose already sets it; k8s didn't).Changes
k8s/manifests/secret.yaml+ Helmvalues.yamlsecrets.data: renamed to the consumed names; addedAUDIT_HMAC_SECRET,TOTP_ENCRYPTION_KEY;CRON_SECRETincluded as an optional commented entry (there's no CronJob manifest — whether to add one or use an external scheduler is a separate decision)k8s/manifests/configmap.yaml+ Helmvalues.yamlconfig:NEXTAUTH_URL→AUTH_URL(the URL, unlike the secret, does have a legacy fallback — renamed for consistency), addedAUTH_TRUST_HOST: "true", droppedMONGO_DB_NAME(read by nothing)k8s/README.md: both documented example blocks updated to matchVerification
grepoverk8s/finds zero remaining stale names outside explanatory commentshelmCLI not on this machine) — the templates themselves are untouched; onlyvalues.yamldata changed, and theenvFrom/stringDatarange loops are name-agnosticNote the deliberate asymmetry with #45: the app keeps honoring
NEXTAUTH_SECRETfor TOTP decryption so existing deployments don't lose 2FA secrets, while the templates stop recommending it for new deployments.🤖 Generated with Claude Code