From b85cefc3e23d896b7f1c522ef8d16ed317559ce5 Mon Sep 17 00:00:00 2001 From: Ivan Okhotnikov Date: Wed, 1 Jul 2026 11:28:46 +0300 Subject: [PATCH] fix(apps/kubernetes): extend --oidc-* guard to catch --authentication-config too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same class of upgrade regression: a customer who wired their own structured AuthenticationConfiguration by hand via `controlPlane.apiServer.extraArgs: [--authentication-config=...]` would hit a duplicate-flag scenario the moment they toggle `spec.oidc.mode` — kube-apiserver would receive two conflicting --authentication-config= arguments and the last-wins behaviour is undefined between apiserver versions. Add a second render-time guard that fails when a legacy --authentication-config= is present in the user-supplied extraArgs AND spec.oidc.mode is not None, pointing at the CustomConfig migration path (customConfig.config or customConfig.secretRef.name). Signed-off-by: Ivan Okhotnikov --- packages/apps/kubernetes/templates/cluster.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml index 44752a672..bf3594fe3 100644 --- a/packages/apps/kubernetes/templates/cluster.yaml +++ b/packages/apps/kubernetes/templates/cluster.yaml @@ -335,6 +335,9 @@ metadata: {{- if hasPrefix "--oidc-" $arg }} {{- fail (printf "controlPlane.apiServer.extraArgs contains %q while spec.oidc.mode is %q — the kube-apiserver refuses to boot with both --authentication-config (injected by spec.oidc) and legacy --oidc-* flags. Remove the --oidc-* flags from controlPlane.apiServer.extraArgs and use spec.oidc.mode: CustomConfig with a customConfig.config carrying the same issuer/audience if you need to override, or spec.oidc.mode: System for the platform cozy default." $arg $.Values.oidc.mode) }} {{- end }} +{{- if hasPrefix "--authentication-config" $arg }} +{{- fail (printf "controlPlane.apiServer.extraArgs contains %q while spec.oidc.mode is %q — the chart already injects --authentication-config= for OIDC. Drop your explicit flag and let spec.oidc.mode: CustomConfig own the AuthenticationConfiguration (customConfig.config or customConfig.secretRef.name), or leave spec.oidc.mode: None and keep managing the flag yourself." $arg $.Values.oidc.mode) }} +{{- end }} {{- end }} {{- end }} spec: