nicolas-georger/deepseek-kubernetes-sandbox
1
0
Fork 0
mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00
Code Projects Releases Activity

fix(gateway-api): correct oauth2-proxy cookie-secret generation (#14)

Browse Source 
oauth2-proxy base64-decodes cookie_secret and requires it to decode to 16/24/32
bytes. Plain 'openssl rand -base64 32' yields 44 chars of standard base64
(padding + possibly '+/'), which it cannot decode and treats as 44 raw bytes,
failing with 'cookie_secret must be 16, 24, or 32 bytes ... but is 44 bytes'.

Use URL-safe, unpadded base64 instead (secrets.token_urlsafe(32) or the
openssl|tr variant).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
This commit is contained in:
SREDevOps.org Agent
2026-10-25 04:12:56 -03:00
committed by GitHub
parent 3f46279b39
commit 73a65d98d2
2 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
gateway-api/dsh-demo/README.md
View File

@@ -34,8 +34,9 @@ Browser ──▶ Gateway dsh-gateway (HTTPS, TLS-terminate)
(replace `dsh-demo.example.com` with the actual public FQDN). Note the client
ID and client secret.
2. **oauth2-proxy Secret** — `kubectl -n dsh-demo create secret generic oauth2-proxy`
with `client-id`, `client-secret`, and a `cookie-secret`
(`openssl rand -base64 32`). See `oauth2-proxy-secret.yaml.example`.
with `client-id`, `client-secret`, and a `cookie-secret` (URL-safe, unpadded
base64 of 32 bytes: `python3 -c 'import secrets; print(secrets.token_urlsafe(32))'`).
See `oauth2-proxy-secret.yaml.example`.
3. **TLS secret** — create `dsh-demo-tls` in `dsh-demo` (see `tls-secret.yaml.example`).
4. **Gateway app env** — the `dsh-gateway` Deployment must run the SSO-capable
image with `AUTH_PROXY_HEADER=X-Forwarded-User` and `COOKIE_SECURE=true`