mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
73a65d98d2
oauth2-proxy base64-decodes cookie_secret and requires it to decode to 16/24/32 bytes. Plain 'openssl rand -base64 32' yields 44 chars of standard base64 (padding + possibly '+/'), which it cannot decode and treats as 44 raw bytes, failing with 'cookie_secret must be 16, 24, or 32 bytes ... but is 44 bytes'. Use URL-safe, unpadded base64 instead (secrets.token_urlsafe(32) or the openssl|tr variant). Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
40 lines
1.7 KiB
Plaintext
40 lines
1.7 KiB
Plaintext
# EXAMPLE ONLY — do not apply as-is.
|
|
#
|
|
# oauth2-proxy reads its GitHub OAuth credentials and cookie-signing secret from
|
|
# this Secret. Populate real values and apply:
|
|
#
|
|
# kubectl -n dsh-demo create secret generic oauth2-proxy \
|
|
# --from-literal=client-id='<GitHub OAuth App client ID>' \
|
|
# --from-literal=client-secret='<GitHub OAuth App client secret>' \
|
|
# --from-literal=cookie-secret="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
|
|
#
|
|
# The cookie secret must decode (base64) to exactly 16, 24, or 32 bytes.
|
|
# oauth2-proxy base64-decodes it, so it must be URL-safe, unpadded base64.
|
|
# Generate it with either of:
|
|
#
|
|
# python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
|
|
# openssl rand -base64 32 | tr -- '+/' '-_' | tr -d '='
|
|
#
|
|
# Do NOT use plain `openssl rand -base64 32`: that yields 44 characters of
|
|
# standard base64 (with "=" and possibly "+"/"/"), which oauth2-proxy cannot
|
|
# decode and therefore treats as 44 raw bytes, failing with "cookie_secret must
|
|
# be 16, 24, or 32 bytes ... but is 44 bytes".
|
|
#
|
|
# GitHub OAuth App (https://github.com/settings/developers):
|
|
# Homepage URL https://dsh-demo.example.com
|
|
# Authorization callback https://dsh-demo.example.com/oauth2/callback
|
|
# (replace dsh-demo.example.com with the actual public FQDN)
|
|
#
|
|
# NOTE: pass the base64 value as-is via --from-literal (kubectl stores the
|
|
# literal; it does not base64-encode it a second time).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: dsh-demo
|
|
type: Opaque
|
|
stringData:
|
|
client-id: "<github-oauth-app-client-id>"
|
|
client-secret: "<github-oauth-app-client-secret>"
|
|
cookie-secret: "<urlsafe-unpadded-base64-of-32-random-bytes>"
|