mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 20:04:30 +00:00
620bdd25eb
Add complete GKE deployment stack: - deploy/gcp/gke/: namespace, CloudNativePG cluster (premium-rwo, 100Gi), GCS barman-cloud backup with Workload Identity SA, ArgoCD OIDC ConfigMap, GitLab OmniAuth secret template, knoe-auth Google OIDC secret template - etc/init_cnpg_gke.sh: provision GCS buckets, GCP SA, WI binding, CNPG operator - etc/init_argocd.sh: apply argocd-oidc-cm.yaml when PLATFORM_DOMAIN/FRONTDOOR_HOST set - etc/init_gitlab.sh: inject OmniAuth openid_connect block when FRONTDOOR_HOST set - prole-auth-deployment.yaml: add GOOGLE_OIDC_ENABLED env vars (all optional) - supabase/helm/prole-supabase/values-gke.yaml: GoTrue Google OAuth overlay - knoe/core/prod_config.py: add backupProvider, workloadIdentitySA, googleClientId/Secret/HostedDomain Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
31 lines
941 B
YAML
31 lines
941 B
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitlab-google-oidc
|
|
namespace: gitlab
|
|
labels:
|
|
app.kubernetes.io/managed-by: prole-installer
|
|
# GitLab OmniAuth provider config for OpenID Connect via knoe-auth.
|
|
# See: https://docs.gitlab.com/ee/administration/auth/oidc.html
|
|
# Applied by etc/init_gitlab.sh --mode k8s
|
|
stringData:
|
|
provider: |
|
|
name: openid_connect
|
|
label: "Google Workspace"
|
|
icon: "https://www.google.com/favicon.ico"
|
|
args:
|
|
name: openid_connect
|
|
scope:
|
|
- openid
|
|
- profile
|
|
- email
|
|
response_type: code
|
|
issuer: "https://${FRONTDOOR_HOST}/auth"
|
|
client_auth_method: query
|
|
uid_field: email
|
|
send_scope_to_token_endpoint: false
|
|
client_options:
|
|
identifier: "" # set to OIDC client_id
|
|
secret: "" # set to OIDC client_secret
|
|
redirect_uri: "https://git.${PLATFORM_DOMAIN}/users/auth/openid_connect/callback"
|