nicolas-georger/deepseek-kubernetes-sandbox
1
0
Fork 0
mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00
Code Projects Releases Activity

fix(gateway-api): correct oauth2-proxy cookie-secret generation (#14)

Browse Source 
oauth2-proxy base64-decodes cookie_secret and requires it to decode to 16/24/32
bytes. Plain 'openssl rand -base64 32' yields 44 chars of standard base64
(padding + possibly '+/'), which it cannot decode and treats as 44 raw bytes,
failing with 'cookie_secret must be 16, 24, or 32 bytes ... but is 44 bytes'.

Use URL-safe, unpadded base64 instead (secrets.token_urlsafe(32) or the
openssl|tr variant).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
This commit is contained in:
SREDevOps.org Agent
2026-10-25 04:12:56 -03:00
committed by GitHub
parent 3f46279b39
commit 73a65d98d2
2 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
gateway-api/dsh-demo/README.md
View File

@@ -34,8 +34,9 @@ Browser ──▶ Gateway dsh-gateway (HTTPS, TLS-terminate)
(replace `dsh-demo.example.com` with the actual public FQDN). Note the client
ID and client secret.
2. **oauth2-proxy Secret** — `kubectl -n dsh-demo create secret generic oauth2-proxy`
with `client-id`, `client-secret`, and a `cookie-secret`
(`openssl rand -base64 32`). See `oauth2-proxy-secret.yaml.example`.
with `client-id`, `client-secret`, and a `cookie-secret` (URL-safe, unpadded
base64 of 32 bytes: `python3 -c 'import secrets; print(secrets.token_urlsafe(32))'`).
See `oauth2-proxy-secret.yaml.example`.
3. **TLS secret** — create `dsh-demo-tls` in `dsh-demo` (see `tls-secret.yaml.example`).
4. **Gateway app env** — the `dsh-gateway` Deployment must run the SSO-capable
image with `AUTH_PROXY_HEADER=X-Forwarded-User` and `COOKIE_SECURE=true`

21
gateway-api/dsh-demo/oauth2-proxy-secret.yaml.example
View File

@@ -6,18 +6,27 @@
# kubectl -n dsh-demo create secret generic oauth2-proxy \
# --from-literal=client-id='<GitHub OAuth App client ID>' \
# --from-literal=client-secret='<GitHub OAuth App client secret>' \
# --from-literal=cookie-secret="$(openssl rand -base64 32)"
# --from-literal=cookie-secret="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
#
# The cookie secret must be a strong random value (16/24/32 bytes, base64).
# Generate it with: openssl rand -base64 32
# The cookie secret must decode (base64) to exactly 16, 24, or 32 bytes.
# oauth2-proxy base64-decodes it, so it must be URL-safe, unpadded base64.
# Generate it with either of:
#
# python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
# openssl rand -base64 32 | tr -- '+/' '-_' | tr -d '='
#
# Do NOT use plain `openssl rand -base64 32`: that yields 44 characters of
# standard base64 (with "=" and possibly "+"/"/"), which oauth2-proxy cannot
# decode and therefore treats as 44 raw bytes, failing with "cookie_secret must
# be 16, 24, or 32 bytes ... but is 44 bytes".
#
# GitHub OAuth App (https://github.com/settings/developers):
# Homepage URL https://dsh-demo.example.com
# Authorization callback https://dsh-demo.example.com/oauth2/callback
# (replace dsh-demo.example.com with the actual public FQDN)
#
# NOTE: the cookie secret should NOT be base64-encoded again when passed via
# --from-literal (kubectl stores it as-is and the Secret encodes it for you).
# NOTE: pass the base64 value as-is via --from-literal (kubectl stores the
# literal; it does not base64-encode it a second time).
apiVersion: v1
kind: Secret
metadata:
@@ -27,4 +36,4 @@ type: Opaque
stringData:
client-id: "<github-oauth-app-client-id>"
client-secret: "<github-oauth-app-client-secret>"
cookie-secret: "<openssl-rand-base64-32>"
cookie-secret: "<urlsafe-unpadded-base64-of-32-random-bytes>"