fix(rbac): read hub client id from operator OIDC secret#157
Open
aktech wants to merge 2 commits into
Open
Conversation
Bootstrap job derived the id as jupyterhub-<release>-<chart>, but operator releases use other naming conventions, failing the job with "client not found". Read the client-id key from the operator-provisioned <fullname>-oidc-client Secret instead (the same source the hub mounts at /etc/oauth), polling while the operator is still provisioning. Explicit rbac.bootstrap.hubClientId still wins and skips the read. The job gets a ServiceAccount plus a get-one-secret Role in the release namespace since it runs in the keycloak namespace. Closes #135
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The RBAC bootstrap job derived the hub client id from the
jupyterhub-<release>-<chart>convention and failed with "client not found" on operators that name clients differently. The job now readsclient-idfrom the operator-provisioned<fullname>-oidc-clientSecret (via the K8s API, with a ServiceAccount + single-secret Role, polling while the operator provisions).rbac.bootstrap.hubClientIdstill overrides.Closes #135