feat(crossplane/genmachine): Authentik OIDC SSO for crossview

[ixxeL2097]

Summary

Adds Authentik OIDC SSO to crossview on genmachine, with the Authentik provider created declaratively via blueprint.

Changes

authentik/genmachine/blueprints/130-oidc-crossview.yaml (new)

Blueprint Authentik qui crée le provider OAuth2/OIDC genmachine-crossview :

• Confidential client, redirect URI strict vers /api/auth/oidc/callback
• Application slug : fullstack-crossview (correspond à l'issuer URL configurée)
• Groupe : Infrastructure
• Enregistré dans kustomization.yaml → intégré au ConfigMap authentik-blueprints

crossplane/genmachine/templates/externalsecret.yaml

ExternalSecret crossview-oidc complété avec client-id (en plus de client-secret), les deux tirés depuis Vault à crossview/oidc/genmachine.

crossplane/genmachine/genmachine-values.yaml

• config.sso.oidc : OIDC activé, issuer/callbackURL/scope/attributs configurés — sans clientId hardcodé
• app.extraEnv : injecte OIDC_CLIENT_ID depuis le secret crossview-oidc — le chart route clientId uniquement via ConfigMap, extraEnv est positionné en dernier dans la spec du container et override la valeur au runtime
• secrets.OIDCClientSecret : toujours via secretKeyRef → crossview-oidc

Flux d'auth

User → "Sign in with OIDC" → authentik.talos-genmachine.fredcorp.com
     → flow default-provider-authorization-implicit-consent
     → redirect → crossview.talos-genmachine.fredcorp.com/api/auth/oidc/callback
     → user auto-créé dans crossview DB (premier SSO user = admin)

Steps before syncing

1. Laisser ArgoCD syncer le blueprint Authentik
Le blueprint crée le provider automatiquement avec un client_id et client_secret générés.

2. Récupérer les credentials dans Authentik UI
authentik.talos-genmachine.fredcorp.com → Applications → genmachine-crossview → copier client_id et client_secret.

3. Provisionner Vault

vault kv put secret/crossview/oidc/genmachine \
  CLIENT_ID=<client_id> \
  CLIENT_SECRET=<client_secret>

4. ArgoCD sync crossplane → ESO crée crossview-oidc secret → crossview démarre avec OIDC activé.

🤖 Generated with Claude Code

[ixxel-bot]

--- main/crossplane_gitops_manifests_crossplane_genmachine_manifest_main.yaml	2026-05-13 11:24:25.855353317 +0000
+++ pr/crossplane_gitops_manifests_crossplane_genmachine_manifest_pr.yaml	2026-05-13 11:24:24.768358884 +0000
@@ -113,27 +113,27 @@
   DB_SSL_ROOT_CERT: ""
   DB_SSL_CERT: ""
   DB_SSL_KEY: ""
   PORT: "3001"
   AUTH_MODE: "session"
   AUTH_TRUSTED_HEADER: "X-Auth-User"
   AUTH_CREATE_USERS: "true"
   AUTH_DEFAULT_ROLE: "viewer"
   LOG_LEVEL: "info"
   CORS_ORIGIN: "https://crossview.talos-genmachine.fredcorp.com"
-  OIDC_ENABLED: "false"
-  OIDC_ISSUER: "http://localhost:8080/realms/crossview"
+  OIDC_ENABLED: "true"
+  OIDC_ISSUER: "https://authentik.talos-genmachine.fredcorp.com/application/o/fullstack-crossview/"
   OIDC_CLIENT_ID: "crossview-client"
   OIDC_AUTHORIZATION_URL: ""
   OIDC_TOKEN_URL: ""
   OIDC_USERINFO_URL: ""
-  OIDC_CALLBACK_URL: "http://localhost:3001/api/auth/oidc/callback"
+  OIDC_CALLBACK_URL: "https://crossview.talos-genmachine.fredcorp.com/api/auth/oidc/callback"
   OIDC_SCOPE: "openid profile email"
   OIDC_USERNAME_ATTRIBUTE: "preferred_username"
   OIDC_EMAIL_ATTRIBUTE: "email"
   OIDC_FIRSTNAME_ATTRIBUTE: "given_name"
   OIDC_LASTNAME_ATTRIBUTE: "family_name"
   SAML_ENABLED: "false"
   SAML_ENTRY_POINT: "http://localhost:8080/realms/crossview/protocol/saml"
   SAML_ISSUER: "crossview"
   SAML_CALLBACK_URL: "http://localhost:3001/api/auth/saml/callback"
   SAML_USERNAME_ATTRIBUTE: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
@@ -1437,20 +1437,26 @@
             - name: OIDC_ISSUER
               valueFrom:
                 configMapKeyRef:
                   name: crossplane-crossview-config
                   key: OIDC_ISSUER
             - name: OIDC_CLIENT_ID
               valueFrom:
                 configMapKeyRef:
                   name: crossplane-crossview-config
                   key: OIDC_CLIENT_ID
+            - name: OIDC_CLIENT_SECRET
+              
+              valueFrom:
+                secretKeyRef:
+                  name: "crossview-oidc"
+                  key:  "client-secret"
             - name: OIDC_AUTHORIZATION_URL
               valueFrom:
                 configMapKeyRef:
                   name: crossplane-crossview-config
                   key: OIDC_AUTHORIZATION_URL
             - name: OIDC_TOKEN_URL
               valueFrom:
                 configMapKeyRef:
                   name: crossplane-crossview-config
                   key: OIDC_TOKEN_URL
@@ -1546,20 +1552,25 @@
               valueFrom:
                 secretKeyRef:
                   name: "crossview-credentials"
                   key:  "admin-password"
             - name: SESSION_SECRET
               
               valueFrom:
                 secretKeyRef:
                   name: "crossview-credentials"
                   key:  "session-secret"
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  key: client-id
+                  name: crossview-oidc
           livenessProbe:
             failureThreshold: 3
             httpGet:
               path: /api/health
               port: 3001
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
           readinessProbe:
             failureThreshold: 3
@@ -1862,20 +1873,45 @@
         property: ADMIN_PASSWORD
     - secretKey: db-password
       remoteRef:
         key: crossview/credentials/genmachine
         property: DB_PASSWORD
     - secretKey: session-secret
       remoteRef:
         key: crossview/credentials/genmachine
         property: SESSION_SECRET
 ---
+# Source: crossplane/templates/externalsecret.yaml
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: crossview-oidc
+  namespace: crossplane
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: admin
+  target:
+    name: crossview-oidc
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: crossview/oidc/genmachine
+        property: CLIENT_ID
+    - secretKey: client-secret
+      remoteRef:
+        key: crossview/oidc/genmachine
+        property: CLIENT_SECRET
+---
 # Source: crossplane/charts/crossview/templates/tests/test-connection.yaml
 apiVersion: v1
 kind: Pod
 metadata:
   name: "crossplane-crossview-test-connection"
   labels:
     helm.sh/chart: crossview-4.3.0
     app.kubernetes.io/name: crossview
     app.kubernetes.io/instance: crossplane
     app.kubernetes.io/version: "v4.3.0"