From 7cebafbafd138d45ae0413158a4060a53ace3ad7 Mon Sep 17 00:00:00 2001 From: Timofei Larkin Date: Mon, 26 Jan 2026 19:44:17 +0300 Subject: [PATCH] [dashboard] Improve dashboard session params ## What this PR does This patch enables the `offline_access` scope for the dashbord keycloak client, so that users get a refresh token which gatekeeper can use to automatically refresh an expiring access token. Also session timeouts were increased. ### Release note ```release-note [dashboard] Increase session timeouts, add the offline_access scope, enable refresh tokens to improve the overall user experience when working with the dashboard. ``` Signed-off-by: Timofei Larkin --- packages/system/dashboard/templates/gatekeeper.yaml | 1 + packages/system/dashboard/templates/keycloakclient.yaml | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/packages/system/dashboard/templates/gatekeeper.yaml b/packages/system/dashboard/templates/gatekeeper.yaml index 40f2565f..984ec03e 100644 --- a/packages/system/dashboard/templates/gatekeeper.yaml +++ b/packages/system/dashboard/templates/gatekeeper.yaml @@ -64,6 +64,7 @@ spec: - --cookie-secure=true - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET) - --skip-provider-button + - --scope=openid email profile offline_access env: - name: OAUTH2_PROXY_CLIENT_ID value: dashboard diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml index e1caea71..d8e47e8a 100644 --- a/packages/system/dashboard/templates/keycloakclient.yaml +++ b/packages/system/dashboard/templates/keycloakclient.yaml @@ -66,6 +66,12 @@ spec: defaultClientScopes: - groups - kubernetes-client + optionalClientScopes: + - offline_access + attributes: + post.logout.redirect.uris: "+" + client.session.idle.timeout: "86400" + client.session.max.lifespan: "604800" redirectUris: - "https://dashboard.{{ $host }}/oauth2/callback/*" {{- range $i, $v := $extraRedirectUris }}