From 148e24eee741081a02215c2d98272c8d2c48f464 Mon Sep 17 00:00:00 2001 From: Nicolas Sagala Beaucage Date: Sat, 29 Aug 2026 23:27:57 -0400 Subject: [PATCH 1/2] feat(kellnr): configure additional OAuth2 audiences --- README.md | 15 +++++++++++++++ charts/kellnr/templates/_helpers.tpl | 4 +++- charts/kellnr/values.schema.json | 6 ++++++ charts/kellnr/values.yaml | 2 ++ 4 files changed, 26 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b345836..2d7bb20 100644 --- a/README.md +++ b/README.md @@ -136,6 +136,21 @@ via `envFrom`: To add your own variables or mount additional ConfigMaps/Secrets, see [Extra environment variables](#extra-environment-variables). +#### OAuth2 audience validation + +Set `kellnr.oauth2.allowAdditionalAudiences` to `true` when an ID token may +contain audiences in addition to Kellnr's configured client ID. The configured +client ID must still be present. The default is `false`. + +```yaml +kellnr: + oauth2: + allowAdditionalAudiences: true +``` + +The chart renders this as `KELLNR_OAUTH2__ALLOW_ADDITIONAL_AUDIENCES` in the +Kellnr ConfigMap. + #### Admin password and token These credentials can also be set in any other secret and then referenced from this chart. diff --git a/charts/kellnr/templates/_helpers.tpl b/charts/kellnr/templates/_helpers.tpl index ea18daa..efdaa34 100644 --- a/charts/kellnr/templates/_helpers.tpl +++ b/charts/kellnr/templates/_helpers.tpl @@ -236,6 +236,9 @@ KELLNR_OAUTH2__ISSUER_URL: {{ .Values.kellnr.oauth2.issuerUrl | quote }} {{ if .Values.kellnr.oauth2.clientId }} KELLNR_OAUTH2__CLIENT_ID: {{ .Values.kellnr.oauth2.clientId | quote }} {{ end }} +{{ if not (eq .Values.kellnr.oauth2.allowAdditionalAudiences nil) }} +KELLNR_OAUTH2__ALLOW_ADDITIONAL_AUDIENCES: {{ .Values.kellnr.oauth2.allowAdditionalAudiences | quote }} +{{ end }} {{ if not (eq .Values.kellnr.oauth2.scopes nil) }} KELLNR_OAUTH2__SCOPES: {{ .Values.kellnr.oauth2.scopes | quote }} {{ end }} @@ -314,4 +317,3 @@ Omits the port when it matches the default for the protocol (443 for https, 80 f {{- end -}} {{- end }} - diff --git a/charts/kellnr/values.schema.json b/charts/kellnr/values.schema.json index 1f93402..6fcf2e5 100644 --- a/charts/kellnr/values.schema.json +++ b/charts/kellnr/values.schema.json @@ -56,6 +56,12 @@ "port": { "type": ["integer", "null"] }, "protocol": { "type": ["string", "null"] } } + }, + "oauth2": { + "type": "object", + "properties": { + "allowAdditionalAudiences": { "type": ["boolean", "null"] } + } } } }, diff --git a/charts/kellnr/values.yaml b/charts/kellnr/values.yaml index f1002dc..c72a781 100644 --- a/charts/kellnr/values.yaml +++ b/charts/kellnr/values.yaml @@ -219,6 +219,8 @@ kellnr: clientId: "" # OAuth2 client secret - prefer using clientSecretRef for production clientSecret: "" + # Accept additional audiences when the configured client ID is also present + allowAdditionalAudiences: null # false # Reference to an existing Kubernetes secret containing the client secret # When set, this takes precedence over clientSecret clientSecretRef: From b0b782ffb559ad5bce95c0aa13ab42f9501eeb79 Mon Sep 17 00:00:00 2001 From: Nicolas Sagala Beaucage Date: Sun, 30 Aug 2026 14:13:26 -0400 Subject: [PATCH 2/2] feat(kellnr): configure OAuth2 audience allowlist --- README.md | 13 ++++++++----- charts/kellnr/templates/_helpers.tpl | 5 ++--- charts/kellnr/values.schema.json | 5 ++++- charts/kellnr/values.yaml | 4 ++-- 4 files changed, 16 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 2d7bb20..a4bba52 100644 --- a/README.md +++ b/README.md @@ -138,17 +138,20 @@ To add your own variables or mount additional ConfigMaps/Secrets, see #### OAuth2 audience validation -Set `kellnr.oauth2.allowAdditionalAudiences` to `true` when an ID token may -contain audiences in addition to Kellnr's configured client ID. The configured -client ID must still be present. The default is `false`. +Set `kellnr.oauth2.additionalAudiences` to a YAML list of trusted audiences +when an ID token may contain audiences in addition to Kellnr's configured +client ID. The configured client ID must still be present. The default is an +empty list. ```yaml kellnr: oauth2: - allowAdditionalAudiences: true + additionalAudiences: + - audience-one + - audience-two ``` -The chart renders this as `KELLNR_OAUTH2__ALLOW_ADDITIONAL_AUDIENCES` in the +The chart renders this as `KELLNR_OAUTH2__ADDITIONAL_AUDIENCES` in the Kellnr ConfigMap. #### Admin password and token diff --git a/charts/kellnr/templates/_helpers.tpl b/charts/kellnr/templates/_helpers.tpl index efdaa34..054b0f2 100644 --- a/charts/kellnr/templates/_helpers.tpl +++ b/charts/kellnr/templates/_helpers.tpl @@ -236,8 +236,8 @@ KELLNR_OAUTH2__ISSUER_URL: {{ .Values.kellnr.oauth2.issuerUrl | quote }} {{ if .Values.kellnr.oauth2.clientId }} KELLNR_OAUTH2__CLIENT_ID: {{ .Values.kellnr.oauth2.clientId | quote }} {{ end }} -{{ if not (eq .Values.kellnr.oauth2.allowAdditionalAudiences nil) }} -KELLNR_OAUTH2__ALLOW_ADDITIONAL_AUDIENCES: {{ .Values.kellnr.oauth2.allowAdditionalAudiences | quote }} +{{ if not (eq .Values.kellnr.oauth2.additionalAudiences nil) }} +KELLNR_OAUTH2__ADDITIONAL_AUDIENCES: {{ .Values.kellnr.oauth2.additionalAudiences | join "," | quote }} {{ end }} {{ if not (eq .Values.kellnr.oauth2.scopes nil) }} KELLNR_OAUTH2__SCOPES: {{ .Values.kellnr.oauth2.scopes | quote }} @@ -316,4 +316,3 @@ Omits the port when it matches the default for the protocol (443 for https, 80 f {{- printf "%s://%s:%d" $protocol .Values.kellnr.origin.hostname $port -}} {{- end -}} {{- end }} - diff --git a/charts/kellnr/values.schema.json b/charts/kellnr/values.schema.json index 6fcf2e5..d438c11 100644 --- a/charts/kellnr/values.schema.json +++ b/charts/kellnr/values.schema.json @@ -60,7 +60,10 @@ "oauth2": { "type": "object", "properties": { - "allowAdditionalAudiences": { "type": ["boolean", "null"] } + "additionalAudiences": { + "type": ["array", "null"], + "items": { "type": "string" } + } } } } diff --git a/charts/kellnr/values.yaml b/charts/kellnr/values.yaml index c72a781..1790a53 100644 --- a/charts/kellnr/values.yaml +++ b/charts/kellnr/values.yaml @@ -219,8 +219,8 @@ kellnr: clientId: "" # OAuth2 client secret - prefer using clientSecretRef for production clientSecret: "" - # Accept additional audiences when the configured client ID is also present - allowAdditionalAudiences: null # false + # Additional audiences accepted when the configured client ID is also present + additionalAudiences: null # ["audience-one", "audience-two"] # Reference to an existing Kubernetes secret containing the client secret # When set, this takes precedence over clientSecret clientSecretRef: