From 74aefdc28f6580cc3247fc93c627c231c3b5fc6f Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 24 Apr 2026 18:04:17 +0200 Subject: [PATCH] fix(coder): trust LE staging roots for OIDC to Authentik Coder's OIDC init was crashlooping with "x509: certificate signed by unknown authority" when fetching auth.renner.uno's OpenID discovery document, because every ingress in this cluster uses the letsencrypt-staging ClusterIssuer today. Mount the staging roots (Pretend Pear X1 + Bogus Broccoli X2) via coder.certs.secrets; the chart drops them at /etc/ssl/certs/ where Go's crypto/x509 picks them up on Linux. Remove once the cluster migrates to letsencrypt-prod. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/coder/helmrelease.yaml | 8 ++++ kubernetes/apps/coder/kustomization.yaml | 1 + kubernetes/apps/coder/le-staging-ca.yaml | 60 ++++++++++++++++++++++++ 3 files changed, 69 insertions(+) create mode 100644 kubernetes/apps/coder/le-staging-ca.yaml diff --git a/kubernetes/apps/coder/helmrelease.yaml b/kubernetes/apps/coder/helmrelease.yaml index 84236646..2d428816 100644 --- a/kubernetes/apps/coder/helmrelease.yaml +++ b/kubernetes/apps/coder/helmrelease.yaml @@ -55,6 +55,14 @@ spec: memory: 512Mi limits: memory: 2Gi + # Trust the LE staging roots so Coder can validate auth.renner.uno + # during OIDC discovery. Every ingress in this cluster uses the + # letsencrypt-staging ClusterIssuer today; remove this once the + # cluster migrates to letsencrypt-prod. + certs: + secrets: + - name: le-staging-ca + key: ca.crt env: - name: CODER_ACCESS_URL value: "https://coder.renner.uno" diff --git a/kubernetes/apps/coder/kustomization.yaml b/kubernetes/apps/coder/kustomization.yaml index 29b1c11e..40438ba8 100644 --- a/kubernetes/apps/coder/kustomization.yaml +++ b/kubernetes/apps/coder/kustomization.yaml @@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - secret.sops.yaml + - le-staging-ca.yaml - postgres.yaml - helmrelease.yaml diff --git a/kubernetes/apps/coder/le-staging-ca.yaml b/kubernetes/apps/coder/le-staging-ca.yaml new file mode 100644 index 00000000..1cdacbff --- /dev/null +++ b/kubernetes/apps/coder/le-staging-ca.yaml @@ -0,0 +1,60 @@ +# Lets Encrypt staging roots (Pretend Pear X1 + Bogus Broccoli X2). +# Coder needs these in its trust store to validate auth.renner.uno during +# OIDC discovery, since Authentik is served with a cert-manager +# letsencrypt-staging certificate. Drop this secret once the cluster moves +# ingress cert issuance to letsencrypt-prod. +apiVersion: v1 +kind: Secret +metadata: + name: le-staging-ca + namespace: coder +type: Opaque +stringData: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIFmDCCA4CgAwIBAgIQU9C87nMpOIFKYpfvOHFHFDANBgkqhkiG9w0BAQsFADBm + MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy + aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ + ZWFyIFgxMB4XDTE1MDYwNDExMDQzOFoXDTM1MDYwNDExMDQzOFowZjELMAkGA1UE + BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl + YXJjaCBHcm91cDEiMCAGA1UEAxMZKFNUQUdJTkcpIFByZXRlbmQgUGVhciBYMTCC + AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbagEdDTa1QgGBWSYkyMhsc + ZXENOBaVRTMX1hceJENgsL0Ma49D3MilI4KS38mtkmdF6cPWnL++fgehT0FbRHZg + jOEr8UAN4jH6omjrbTD++VZneTsMVaGamQmDdFl5g1gYaigkkmx8OiCO68a4QXg4 + wSyn6iDipKP8utsE+x1E28SA75HOYqpdrk4HGxuULvlr03wZGTIf/oRt2/c+dYmD + oaJhge+GOrLAEQByO7+8+vzOwpNAPEx6LW+crEEZ7eBXih6VP19sTGy3yfqK5tPt + TdXXCOQMKAp+gCj/VByhmIr+0iNDC540gtvV303WpcbwnkkLYC0Ft2cYUyHtkstO + fRcRO+K2cZozoSwVPyB8/J9RpcRK3jgnX9lujfwA/pAbP0J2UPQFxmWFRQnFjaq6 + rkqbNEBgLy+kFL1NEsRbvFbKrRi5bYy2lNms2NJPZvdNQbT/2dBZKmJqxHkxCuOQ + FjhJQNeO+Njm1Z1iATS/3rts2yZlqXKsxQUzN6vNbD8KnXRMEeOXUYvbV4lqfCf8 + mS14WEbSiMy87GB5S9ucSV1XUrlTG5UGcMSZOBcEUpisRPEmQWUOTWIoDQ5FOia/ + GI+Ki523r2ruEmbmG37EBSBXdxIdndqrjy+QVAmCebyDx9eVEGOIpn26bW5LKeru + mJxa/CFBaKi4bRvmdJRLAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB + Af8EBTADAQH/MB0GA1UdDgQWBBS182Xy/rAKkh/7PH3zRKCsYyXDFDANBgkqhkiG + 9w0BAQsFAAOCAgEAncDZNytDbrrVe68UT6py1lfF2h6Tm2p8ro42i87WWyP2LK8Y + nLHC0hvNfWeWmjZQYBQfGC5c7aQRezak+tHLdmrNKHkn5kn+9E9LCjCaEsyIIn2j + qdHlAkepu/C3KnNtVx5tW07e5bvIjJScwkCDbP3akWQixPpRFAsnP+ULx7k0aO1x + qAeaAhQ2rgo1F58hcflgqKTXnpPM02intVfiVVkX5GXpJjK5EoQtLceyGOrkxlM/ + sTPq4UrnypmsqSagWV3HcUlYtDinc+nukFk6eR4XkzXBbwKajl0YjztfrCIHOn5Q + CJL6TERVDbM/aAPly8kJ1sWGLuvvWYzMYgLzDul//rUF10gEMWaXVZV51KpS9DY/ + 5CunuvCXmEQJHo7kGcViT7sETn6Jz9KOhvYcXkJ7po6d93A/jy4GKPIPnsKKNEmR + xUuXY4xRdh45tMJnLTUDdC9FIU0flTeO9/vNpVA8OPU1i14vCz+MU8KX1bV3GXm/ + fxlB7VBBjX9v5oUep0o/j68R/iDlCOM4VVfRa8gX6T2FU7fNdatvGro7uQzIvWof + gN9WUwCbEMBy/YhBSrXycKA8crgGg3x1mIsopn88JKwmMBa68oS7EHM9w7C4y71M + 7DiA+/9Qdp9RBWJpTS9i/mDnJg1xvo8Xz49mrrgfmcAXTCJqXi24NatI3Oc= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIICTjCCAdSgAwIBAgIRAIPgc3k5LlLVLtUUvs4K/QcwCgYIKoZIzj0EAwMwaDEL + MAkGA1UEBhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0 + eSBSZXNlYXJjaCBHcm91cDEkMCIGA1UEAxMbKFNUQUdJTkcpIEJvZ3VzIEJyb2Nj + b2xpIFgyMB4XDTIwMDkwNDAwMDAwMFoXDTQwMDkxNzE2MDAwMFowaDELMAkGA1UE + BhMCVVMxMzAxBgNVBAoTKihTVEFHSU5HKSBJbnRlcm5ldCBTZWN1cml0eSBSZXNl + YXJjaCBHcm91cDEkMCIGA1UEAxMbKFNUQUdJTkcpIEJvZ3VzIEJyb2Njb2xpIFgy + MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOvS+w1kCzAxYOJbA06Aw0HFP2tLBLKPo + FQqR9AMskl1nC2975eQqycR+ACvYelA8rfwFXObMHYXJ23XLB+dAjPJVOJ2OcsjT + VqO4dcDWu+rQ2VILdnJRYypnV1MMThVxo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD + VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3tGjWWQOwZo2o0busBB2766XlWYwCgYI + KoZIzj0EAwMDaAAwZQIwRcp4ZKBsq9XkUuN8wfX+GEbY1N5nmCRc8e80kUkuAefo + uc2j3cICeXo1cOybQ1iWAjEA3Ooawl8eQyR4wrjCofUE8h44p0j7Yl/kBlJZT8+9 + vbtH7QiVzeKCOTQPINyRql6P + -----END CERTIFICATE----- -- 2.54.0