From b4972112789ad3443b265ff9dc17c1952314c686 Mon Sep 17 00:00:00 2001 From: mnemonic Date: Sun, 14 Jun 2026 16:55:43 +0000 Subject: [PATCH] add OIDC auth to state-docs-vmcp VirtualMCPServer Switch incomingAuth from anonymous to oidc, wiring Keycloak (home-lab realm at cloak.olb42.com) as the provider with clientId state-docs-vmcp. Secret ref (state-docs-vmcp-secret, key: client-secret) is added to kustomization as a TODO comment pending the sealed secret creation. Co-Authored-By: Claude Sonnet 4.6 --- manifest/overlays/production/kustomization.yaml | 1 + .../overlays/production/vmcp-servers/state-docs-vmcp.yaml | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/manifest/overlays/production/kustomization.yaml b/manifest/overlays/production/kustomization.yaml index 05085c9..bfc9c6a 100644 --- a/manifest/overlays/production/kustomization.yaml +++ b/manifest/overlays/production/kustomization.yaml @@ -11,6 +11,7 @@ resources: - ingressroute.yaml - secrets/gitea-mcp-secret.sealed.secret.yaml - secrets/argocd-mcp-secret.sealed.secret.yaml + # TODO: add after sealing — secrets/state-docs-vmcp-secret.sealed.secret.yaml - mcp-tool-config-state-docs.yaml - mcp-tool-config-ops.yaml - mcp-tool-config-dev.yaml diff --git a/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml b/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml index 5c31c44..2ee87ab 100644 --- a/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml +++ b/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml @@ -14,7 +14,13 @@ spec: embeddingServerRef: name: homelab-embedding incomingAuth: - type: anonymous + type: oidc + oidc: + issuerUrl: https://cloak.olb42.com/realms/home-lab + clientId: state-docs-vmcp + clientSecretRef: + name: state-docs-vmcp-secret + key: client-secret config: aggregation: conflictResolution: prefix