From 6c591ab78edef18274245481838d98a4c7f1fd9f Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:01:38 +0000 Subject: [PATCH 01/10] fix(saml): IdP-initiated forwards SP RelayState (AWS WorkSpaces per-session state code) WorkSpaces euc-sso appends a per-session state code via ?RelayState= to the IdP-initiated init URL; without round-tripping it, the auth code cannot be bound to the client session and the native client loops back. idp_initiated now prefers a passed relay_state over the static default_relay_state. --- .../providers/saml/processors/authn_request_parser.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/authentik/providers/saml/processors/authn_request_parser.py b/authentik/providers/saml/processors/authn_request_parser.py index 13dbcade6ade..0aa2baf9867f 100644 --- a/authentik/providers/saml/processors/authn_request_parser.py +++ b/authentik/providers/saml/processors/authn_request_parser.py @@ -174,10 +174,16 @@ def parse_detached( except ParseError as exc: raise CannotHandleAssertion(ERROR_FAILED_TO_VERIFY) from exc - def idp_initiated(self) -> AuthNRequest: + def idp_initiated(self, relay_state: str | None = None) -> AuthNRequest: """Create IdP Initiated AuthNRequest""" request = AuthNRequest(relay_state=None) - if self.provider.default_relay_state != "": + # Buzzvil patch: prefer a RelayState supplied by the SP over the static + # default_relay_state. AWS WorkSpaces IdP-initiated SSO appends a per-session + # state code via ?RelayState= to the init URL; it must round-trip back to AWS + # or the euc-sso auth code cannot be bound to the client session (loop-back). + if relay_state: + request.relay_state = relay_state + elif self.provider.default_relay_state != "": request.relay_state = self.provider.default_relay_state if self.provider.default_name_id_policy != SAMLNameIDPolicy.UNSPECIFIED: request.name_id_policy = self.provider.default_name_id_policy From 5b992718dad42df92e25434493e68f7bc49af1e5 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:02:08 +0000 Subject: [PATCH 02/10] fix(saml): pass query RelayState into IdP-initiated AuthNRequest SAMLSSOBindingInitView now forwards request.GET[RelayState] to idp_initiated so the AWS WorkSpaces euc-sso per-session state code round-trips back to AWS. --- authentik/providers/saml/views/sso.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/authentik/providers/saml/views/sso.py b/authentik/providers/saml/views/sso.py index 076fb68706ce..5508a577aabb 100644 --- a/authentik/providers/saml/views/sso.py +++ b/authentik/providers/saml/views/sso.py @@ -155,5 +155,9 @@ class SAMLSSOBindingInitView(SAMLSSOView): def check_saml_request(self) -> HttpRequest | None: """Create SAML Response from scratch""" LOGGER.debug("No SAML Request, using IdP-initiated flow.") - auth_n_request = AuthNRequestParser(self.provider).idp_initiated() + # Buzzvil patch: forward the SP-supplied RelayState (AWS WorkSpaces euc-sso + # per-session state code) into the IdP-initiated AuthNRequest so it round-trips. + auth_n_request = AuthNRequestParser(self.provider).idp_initiated( + relay_state=self.request.GET.get(REQUEST_KEY_RELAY_STATE), + ) self.plan_context[PLAN_CONTEXT_SAML_AUTH_N_REQUEST] = auth_n_request From 97cf6ea2ce201cc8662dfbfe05ee6a809d24b9f1 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:01:11 +0000 Subject: [PATCH 03/10] ci: overlay Dockerfile for patched authentik image (WorkSpaces SAML) --- .buzzvil/Dockerfile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .buzzvil/Dockerfile diff --git a/.buzzvil/Dockerfile b/.buzzvil/Dockerfile new file mode 100644 index 000000000000..46577ef4707f --- /dev/null +++ b/.buzzvil/Dockerfile @@ -0,0 +1,14 @@ +# Buzzvil patched authentik image (overlay on the official server image). +# +# Replaces two SAML provider files so that IdP-initiated SSO forwards the +# SP-supplied RelayState (AWS WorkSpaces appends a per-session state code via +# ?RelayState= to the init URL) instead of only using the static +# default_relay_state. Without this, the WorkSpaces native client loops back to +# sign-in because euc-sso cannot bind the auth code to the client session. +# +# Patch source of truth: this repo's authentik/ tree (see PR #1). File paths below +# match the official image layout (/authentik/...). +FROM ghcr.io/goauthentik/server:2026.2.1 + +COPY --chown=authentik:authentik authentik/providers/saml/processors/authn_request_parser.py /authentik/providers/saml/processors/authn_request_parser.py +COPY --chown=authentik:authentik authentik/providers/saml/views/sso.py /authentik/providers/saml/views/sso.py From 9f33d835677aafc11c565f62da1d9ebb2a3d64c2 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:01:13 +0000 Subject: [PATCH 04/10] ci: build patched image and push to authentik ECR (reusable build-ecr) --- .github/workflows/build-patched-ecr.yaml | 25 ++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/workflows/build-patched-ecr.yaml diff --git a/.github/workflows/build-patched-ecr.yaml b/.github/workflows/build-patched-ecr.yaml new file mode 100644 index 000000000000..5f5b8102c994 --- /dev/null +++ b/.github/workflows/build-patched-ecr.yaml @@ -0,0 +1,25 @@ +name: build-patched-ecr + +# Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to the +# `authentik` ECR repo (terraform-resource aws/devops/ecr, ap-northeast-1) via the +# shared reusable build workflow. +# +# Prerequisites: +# - `authentik` ECR repo exists (terraform-resource #4890 applied). +# - This repo can use the org self-hosted runners. +on: + push: + branches: + - buzzvil/workspaces-relaystate-2026.2.1 + workflow_dispatch: + +jobs: + build: + uses: Buzzvil/workflows/.github/workflows/build-ecr.yaml@main + secrets: inherit + with: + repository: authentik + region: ap-northeast-1 + context: . + dockerfile: .buzzvil/Dockerfile + tags: 2026.2.1-relaystate-${{ github.sha }},2026.2.1-relaystate From 099901729cb74b495547efd6ff46f8eaf13e42c8 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:28:28 +0000 Subject: [PATCH 05/10] ci: self-contained build (inline steps, drop reusable workflow + dockerhub/datadog secrets) --- .github/workflows/build-patched-ecr.yaml | 54 ++++++++++++++++++------ 1 file changed, 41 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build-patched-ecr.yaml b/.github/workflows/build-patched-ecr.yaml index 5f5b8102c994..b874bc7c7dbc 100644 --- a/.github/workflows/build-patched-ecr.yaml +++ b/.github/workflows/build-patched-ecr.yaml @@ -1,12 +1,15 @@ name: build-patched-ecr # Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to the -# `authentik` ECR repo (terraform-resource aws/devops/ecr, ap-northeast-1) via the -# shared reusable build workflow. +# `authentik` ECR repo (terraform-resource aws/devops/ecr, ap-northeast-1). # -# Prerequisites: -# - `authentik` ECR repo exists (terraform-resource #4890 applied). -# - This repo can use the org self-hosted runners. +# Self-contained (build steps inlined from Buzzvil/workflows' build-ecr action) so it +# does NOT depend on the private reusable workflow or DOCKERHUB/DATADOG org secrets — +# our base image is ghcr.io, and AWS auth comes from the self-hosted runner's ambient +# IAM role. +# +# Prereqs: `authentik` ECR repo exists (terraform-resource #4890 applied) and this repo +# can use the org self-hosted runners. on: push: branches: @@ -15,11 +18,36 @@ on: jobs: build: - uses: Buzzvil/workflows/.github/workflows/build-ecr.yaml@main - secrets: inherit - with: - repository: authentik - region: ap-northeast-1 - context: . - dockerfile: .buzzvil/Dockerfile - tags: 2026.2.1-relaystate-${{ github.sha }},2026.2.1-relaystate + runs-on: self-hosted + permissions: + contents: read + steps: + - name: Checkout (patch files only) + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + sparse-checkout: | + .buzzvil + authentik/providers/saml/processors/authn_request_parser.py + authentik/providers/saml/views/sso.py + sparse-checkout-cone-mode: false + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6 + with: + aws-region: ap-northeast-1 + + - name: Login to Amazon ECR + id: ecr + uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2 + + - name: Build and push + run: | + docker buildx build \ + --push \ + --file .buzzvil/Dockerfile \ + --tag "${{ steps.ecr.outputs.registry }}/authentik:2026.2.1-relaystate-${{ github.sha }}" \ + --tag "${{ steps.ecr.outputs.registry }}/authentik:2026.2.1-relaystate" \ + . From c75e814b00fdb0c3476488ae59583c37045d8ac1 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:50:24 +0000 Subject: [PATCH 06/10] ci: github-hosted runner + GHCR public push (drop self-hosted/ECR) --- .github/workflows/build-patched-ecr.yaml | 50 +++++++++++------------- 1 file changed, 22 insertions(+), 28 deletions(-) diff --git a/.github/workflows/build-patched-ecr.yaml b/.github/workflows/build-patched-ecr.yaml index b874bc7c7dbc..f80cdfb0034a 100644 --- a/.github/workflows/build-patched-ecr.yaml +++ b/.github/workflows/build-patched-ecr.yaml @@ -1,15 +1,9 @@ -name: build-patched-ecr +name: build-patched-ghcr -# Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to the -# `authentik` ECR repo (terraform-resource aws/devops/ecr, ap-northeast-1). -# -# Self-contained (build steps inlined from Buzzvil/workflows' build-ecr action) so it -# does NOT depend on the private reusable workflow or DOCKERHUB/DATADOG org secrets — -# our base image is ghcr.io, and AWS auth comes from the self-hosted runner's ambient -# IAM role. -# -# Prereqs: `authentik` ECR repo exists (terraform-resource #4890 applied) and this repo -# can use the org self-hosted runners. +# Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to GHCR +# (ghcr.io/buzzvil/authentik). GitHub-hosted runner + GITHUB_TOKEN — no self-hosted +# runner, no AWS/ECR, no org secrets. Package is made public so the cluster pulls +# anonymously (no imagePullSecret). on: push: branches: @@ -18,12 +12,13 @@ on: jobs: build: - runs-on: self-hosted + runs-on: ubuntu-latest permissions: contents: read + packages: write steps: - name: Checkout (patch files only) - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@v4 with: sparse-checkout: | .buzzvil @@ -32,22 +27,21 @@ jobs: sparse-checkout-cone-mode: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + uses: docker/setup-buildx-action@v3 - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6 + - name: Log in to GHCR + uses: docker/login-action@v3 with: - aws-region: ap-northeast-1 - - - name: Login to Amazon ECR - id: ecr - uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2 + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - run: | - docker buildx build \ - --push \ - --file .buzzvil/Dockerfile \ - --tag "${{ steps.ecr.outputs.registry }}/authentik:2026.2.1-relaystate-${{ github.sha }}" \ - --tag "${{ steps.ecr.outputs.registry }}/authentik:2026.2.1-relaystate" \ - . + uses: docker/build-push-action@v6 + with: + context: . + file: .buzzvil/Dockerfile + push: true + tags: | + ghcr.io/buzzvil/authentik:2026.2.1-relaystate-${{ github.sha }} + ghcr.io/buzzvil/authentik:2026.2.1-relaystate From ec1c95a79762a0f6854aca61ed7e36471b1b422f Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 01:04:15 +0000 Subject: [PATCH 07/10] ci: multi-arch build (amd64+arm64) for Karpenter node arch safety --- .github/workflows/build-patched-ecr.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-patched-ecr.yaml b/.github/workflows/build-patched-ecr.yaml index f80cdfb0034a..98880853e821 100644 --- a/.github/workflows/build-patched-ecr.yaml +++ b/.github/workflows/build-patched-ecr.yaml @@ -2,8 +2,9 @@ name: build-patched-ghcr # Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to GHCR # (ghcr.io/buzzvil/authentik). GitHub-hosted runner + GITHUB_TOKEN — no self-hosted -# runner, no AWS/ECR, no org secrets. Package is made public so the cluster pulls -# anonymously (no imagePullSecret). +# runner, no AWS/ECR, no org secrets. Package is public so the cluster pulls anonymously. +# Multi-arch (amd64 + arm64) so it runs on either Karpenter node architecture. The +# overlay only COPYs two files, so the arm64 variant needs no cross-compilation. on: push: branches: @@ -26,6 +27,9 @@ jobs: authentik/providers/saml/views/sso.py sparse-checkout-cone-mode: false + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 @@ -41,6 +45,7 @@ jobs: with: context: . file: .buzzvil/Dockerfile + platforms: linux/amd64,linux/arm64 push: true tags: | ghcr.io/buzzvil/authentik:2026.2.1-relaystate-${{ github.sha }} From 2fd10135913decd803d662a5bea1ca09134713fb Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:03:11 +0000 Subject: [PATCH 08/10] =?UTF-8?q?docs:=20Buzzvil=20fork=20=EC=95=88?= =?UTF-8?q?=EB=82=B4=20=E2=80=94=20WorkSpaces=20SAML=20RelayState=20?= =?UTF-8?q?=ED=8C=A8=EC=B9=98=20=EB=82=B4=EC=9A=A9/=EB=B9=8C=EB=93=9C/?= =?UTF-8?q?=EC=A0=9C=EA=B1=B0=20=EC=A1=B0=EA=B1=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/README.md b/README.md index 2356706e58c7..6eaf7608fb1e 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,59 @@ +# ⚠️ Buzzvil fork of goauthentik/authentik + +이 저장소는 **upstream [goauthentik/authentik](https://github.com/goauthentik/authentik) 의 포크**이며, +AWS WorkSpaces SAML SSO 를 위한 **2 파일 패치**만 얹은 것이다. 그 외 코드는 upstream 과 동일하다. + +빌드 이미지: **`ghcr.io/buzzvil/authentik:2026.2.1-relaystate`** (multi-arch amd64/arm64, public) +소비처: `Buzzvil/buzz-k8s-resources` → `argo-cd/buzzvil-eks-ops/apps/authentik.yaml` 의 `global.image` override +(ops 클러스터 `ops-k8s-authentik`). base: `ghcr.io/goauthentik/server:2026.2.1`. + +## 무슨 패치인가 + +**IdP-initiated SAML 로그인이 SP 가 넘긴 `RelayState` 를 그대로 forward** 하도록 수정. + +| 파일 | 변경 | +|------|------| +| `authentik/providers/saml/views/sso.py` | `SAMLSSOBindingInitView` 가 `request.GET["RelayState"]` 를 `idp_initiated()` 로 전달 | +| `authentik/providers/saml/processors/authn_request_parser.py` | `idp_initiated(relay_state=None)` — 전달된 relay_state 를 provider 의 정적 `default_relay_state` 보다 우선 사용 | + +### 왜 필요한가 +AWS WorkSpaces native client 로그인은 euc-sso 가 IdP init URL 에 **per-session state code 를 +`?RelayState=` 로 붙여** 보내고, IdP 가 그 값을 SAML Response 에 echo 해야 euc-sso 가 auth code 를 +그 client 세션에 바인딩한다. **upstream Authentik 의 IdP-initiated init 엔드포인트는 요청의 `RelayState` +쿼리를 무시하고 provider 의 정적 `default_relay_state` 만** 쓰기 때문에(SP-initiated redirect/POST +뷰와 달리), state code 가 유실되어 native client 가 sign-in 으로 loop-back 한다. +(upstream 동일 이슈: goauthentik/authentik#17542) + +## 빌드 + +`.buzzvil/Dockerfile` 이 공식 이미지 위에 위 2 파일만 COPY 하는 overlay 이고, +`.github/workflows/build-patched-ecr.yaml` 가 GitHub-hosted 러너에서 multi-arch 빌드해 GHCR 로 push 한다. +(별도 self-hosted 러너·AWS·org secret 불필요.) + +## 언제 내릴 수 있나 (이 포크 제거 조건) + +이 포크는 **임시**이며, 아래 중 하나가 충족되면 제거하고 공식 이미지로 되돌린다. + +1. **(우선) upstream 이 고칠 때** — goauthentik/authentik 가 IdP-initiated init 뷰에서 요청 `RelayState` + 를 forward 하도록 반영한 릴리스가 나오면(이슈 #17542 에 upstream PR 기여 권장), ops 의 `global.image` + override 를 제거해 `ghcr.io/goauthentik/server` 정식 이미지로 복귀하고 이 포크를 archive. +2. **WorkSpaces SAML 경로가 사라질 때** — adfit VDI 폐기 또는 인증 방식 변경 시. + +**제거 전 검증**: 대상 버전으로 올린 뒤 WorkSpaces native client 로그인을 end-to-end(auth code 발급 → +데스크톱 연결)로 확인하고 나서 포크를 내린다. + +## 유지보수 (upstream 이 고치기 전까지) + +authentik 을 새 버전으로 올릴 때마다 이 2 파일 패치를 새 버전 태그 기준으로 다시 적용해야 한다: +1. 새 태그(`version/`)에서 브랜치 `buzzvil/workspaces-relaystate-` 생성 +2. 위 2 파일 패치 재적용(작고 self-contained) +3. `.buzzvil/Dockerfile` 의 `FROM ... :` 갱신, 이미지 태그도 `-relaystate` +4. 빌드 → ops `global.image` tag 갱신 → WorkSpaces 로그인 재검증 + +--- + +> 아래는 upstream authentik README 원문. +

authentik logo

From 4b843147afe01f7e826b9d28eaee357bfdd76dfb Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:15:42 +0000 Subject: [PATCH 09/10] =?UTF-8?q?ci:=20=ED=83=9C=EA=B7=B8(*-relaystate)=20?= =?UTF-8?q?=ED=8A=B8=EB=A6=AC=EA=B1=B0=20+=20=EB=B9=8C=EB=93=9C=20?= =?UTF-8?q?=EC=8B=9C=20GitHub=20Release=20=EC=83=9D=EC=84=B1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/build-patched-ecr.yaml | 48 +++++++++++++++++------- 1 file changed, 35 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build-patched-ecr.yaml b/.github/workflows/build-patched-ecr.yaml index 98880853e821..b2667b105f44 100644 --- a/.github/workflows/build-patched-ecr.yaml +++ b/.github/workflows/build-patched-ecr.yaml @@ -1,22 +1,34 @@ name: build-patched-ghcr -# Buzzvil fork: build the WorkSpaces-SAML-patched authentik image and push it to GHCR -# (ghcr.io/buzzvil/authentik). GitHub-hosted runner + GITHUB_TOKEN — no self-hosted -# runner, no AWS/ECR, no org secrets. Package is public so the cluster pulls anonymously. -# Multi-arch (amd64 + arm64) so it runs on either Karpenter node architecture. The -# overlay only COPYs two files, so the arm64 variant needs no cross-compilation. +# authentik 패치 이미지 빌드 + GitHub Release 를 함께 생성. +# +# 트리거: '-relaystate' 형태의 태그 push (예: 2026.2.1-relaystate). +# 태그명 = 이미지 태그 = release 태그 → 빌드와 release 가 항상 한 쌍으로 생성된다. +# +# 새 authentik 버전 릴리스 절차: +# 1) 새 브랜치(buzzvil/workspaces-relaystate-)에서 .buzzvil/Dockerfile 의 FROM 을 +# 그 버전으로 바꾸고 SAML 2 파일 패치를 재적용. +# 2) 그 커밋에 태그 '-relaystate' 를 push → 이 워크플로우가 이미지 빌드 + release 생성. +# 3) ops(buzz-k8s-resources) 의 global.image tag 를 갱신하고 WorkSpaces 로그인 재검증. on: push: - branches: - - buzzvil/workspaces-relaystate-2026.2.1 + tags: + - '*-relaystate' workflow_dispatch: + inputs: + image_tag: + description: "이미지 태그 (예: 2026.2.1-relaystate). 이미지만 rebuild (release 미생성)." + required: true + +permissions: + contents: write # release 생성 + packages: write # GHCR push jobs: build: runs-on: ubuntu-latest - permissions: - contents: read - packages: write + env: + IMAGE_TAG: ${{ github.event.inputs.image_tag || github.ref_name }} steps: - name: Checkout (patch files only) uses: actions/checkout@v4 @@ -47,6 +59,16 @@ jobs: file: .buzzvil/Dockerfile platforms: linux/amd64,linux/arm64 push: true - tags: | - ghcr.io/buzzvil/authentik:2026.2.1-relaystate-${{ github.sha }} - ghcr.io/buzzvil/authentik:2026.2.1-relaystate + tags: ghcr.io/buzzvil/authentik:${{ env.IMAGE_TAG }} + + - name: Create GitHub Release + if: startsWith(github.ref, 'refs/tags/') + env: + GH_TOKEN: ${{ github.token }} + run: | + gh release create "${{ github.ref_name }}" \ + --repo "${{ github.repository }}" \ + --title "${{ github.ref_name }} — WorkSpaces SAML RelayState patch" \ + --notes "패치 이미지: \`ghcr.io/buzzvil/authentik:${{ github.ref_name }}\` (multi-arch amd64/arm64, public). 패치 내용·빌드·제거 조건은 저장소 README 참고." \ + --verify-tag \ + || echo "release for ${{ github.ref_name }} already exists — skipping" From 8efa7397f509227c1b689a76223799d73ddaf275 Mon Sep 17 00:00:00 2001 From: silas <39251873+dlddu@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:17:04 +0000 Subject: [PATCH 10/10] =?UTF-8?q?docs:=20=EB=B9=8C=EB=93=9C/=EC=9C=A0?= =?UTF-8?q?=EC=A7=80=EB=B3=B4=EC=88=98=20=EC=84=B9=EC=85=98=20=ED=83=9C?= =?UTF-8?q?=EA=B7=B8(*-relaystate)=20=ED=8A=B8=EB=A6=AC=EA=B1=B0=20+=20?= =?UTF-8?q?=EB=B9=8C=EB=93=9C=EC=8B=9C=20Release=20=EB=B0=98=EC=98=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 6eaf7608fb1e..210ed033d8d5 100644 --- a/README.md +++ b/README.md @@ -24,11 +24,12 @@ AWS WorkSpaces native client 로그인은 euc-sso 가 IdP init URL 에 **per-ses 뷰와 달리), state code 가 유실되어 native client 가 sign-in 으로 loop-back 한다. (upstream 동일 이슈: goauthentik/authentik#17542) -## 빌드 +## 빌드 / 릴리스 -`.buzzvil/Dockerfile` 이 공식 이미지 위에 위 2 파일만 COPY 하는 overlay 이고, -`.github/workflows/build-patched-ecr.yaml` 가 GitHub-hosted 러너에서 multi-arch 빌드해 GHCR 로 push 한다. -(별도 self-hosted 러너·AWS·org secret 불필요.) +`.buzzvil/Dockerfile` 이 공식 이미지 위에 위 2 파일만 COPY 하는 overlay 이고, 빌드 워크플로우 +(`build-patched-ghcr`)가 **`-relaystate` 태그 push** 시 GitHub-hosted 러너에서 multi-arch(amd64/arm64) +빌드해 GHCR 로 push 하고 **동일 태그로 GitHub Release 를 함께 생성**한다. +(별도 self-hosted 러너·AWS·org secret 불필요. 이미지만 재빌드하려면 workflow_dispatch.) ## 언제 내릴 수 있나 (이 포크 제거 조건) @@ -44,11 +45,11 @@ AWS WorkSpaces native client 로그인은 euc-sso 가 IdP init URL 에 **per-ses ## 유지보수 (upstream 이 고치기 전까지) -authentik 을 새 버전으로 올릴 때마다 이 2 파일 패치를 새 버전 태그 기준으로 다시 적용해야 한다: -1. 새 태그(`version/`)에서 브랜치 `buzzvil/workspaces-relaystate-` 생성 -2. 위 2 파일 패치 재적용(작고 self-contained) -3. `.buzzvil/Dockerfile` 의 `FROM ... :` 갱신, 이미지 태그도 `-relaystate` -4. 빌드 → ops `global.image` tag 갱신 → WorkSpaces 로그인 재검증 +authentik 을 새 버전으로 올릴 때마다 이 2 파일 패치를 새 버전 기준으로 다시 적용한다: +1. upstream 태그(`version/`)에서 브랜치 `buzzvil/workspaces-relaystate-` 생성 +2. 위 2 파일 패치 재적용(작고 self-contained), `.buzzvil/Dockerfile` 의 `FROM ...:` 갱신 +3. 그 커밋에 태그 **`-relaystate`** push → 워크플로우가 멀티아치 이미지 빌드 + 동일 태그 Release 생성 +4. ops(buzz-k8s-resources) 의 `global.image` tag 를 `-relaystate` 로 갱신 → WorkSpaces 로그인 재검증 ---