fix oauth2-proxy

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: kklinch0 <kklinch0@gmail.com>

packages/system/dashboard-config/rbac.yaml

@@ -0,0 +1,25 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: front-readonly
+rules:
+- apiGroups:
+  - front.in-cloud.io
+  resources: ['*']
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: front-readonly-authenticated
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: front-readonly
+subjects:
+- kind: Group
+  name: system:authenticated
+  apiGroup: rbac.authorization.k8s.io

packages/system/dashboard/images/openapi-ui/patches/oauth2_proxy.diff

@@ -0,0 +1,35 @@
+diff --git a/src/api/auth.ts b/src/api/auth.ts
+index 6ee752d..14f07cf 100644
+--- a/src/api/auth.ts
++++ b/src/api/auth.ts
+@@ -6,7 +6,7 @@ export const login = async (): Promise<TAuthResponse | undefined> => {
+   let response: AxiosResponse<TAuthResponse> | undefined
+ 
+   try {
+-    response = await axios.get<TAuthResponse>('/oauth/token', { withCredentials: true })
++    response = await axios.get<TAuthResponse>('/oauth2/userinfo', { withCredentials: true })
+   } catch (error) {
+     handleError(error)
+   }
+@@ -18,7 +18,7 @@ export const logout = async (): Promise<TAuthResponse | undefined> => {
+   let response: AxiosResponse<TAuthResponse> | undefined
+ 
+   try {
+-    response = await axios.get<TAuthResponse>('/oauth/logout', { withCredentials: true })
++    response = await axios.get<TAuthResponse>('/oauth2/sign_out', { withCredentials: true })
+   } catch (error) {
+     handleError(error)
+   } finally {
+diff --git a/src/api/handleResponse.ts b/src/api/handleResponse.ts
+index e538965..c420908 100644
+--- a/src/api/handleResponse.ts
++++ b/src/api/handleResponse.ts
+@@ -5,7 +5,7 @@ export const handleError = (error: any) => {
+   if (isAxiosError(error)) {
+     if (error.status === 401) {
+       try {
+-        axios.get('/oauth/logout', {
++        axios.get('/oauth2/sign_out', {
+           method: 'GET',
+           withCredentials: true,
+         })

packages/system/dashboard/templates/incloud-web-gatekeeper.yaml

@@ -61,6 +61,7 @@ spec:
             - --pass-access-token=true
             - --pass-authorization-header=true
             - --cookie-refresh=1h
+            - --cookie-name=kc-access
             - --cookie-secure=true
             - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
           env:

packages/system/dashboard/templates/incloud-web-web.yaml

@@ -123,7 +123,7 @@ spec:
             - name: MARKETPLACE_VERSION
               value: v1alpha1
             - name: NAVIGATE_FROM_CLUSTERLIST
-              value: /openapi-ui/~recordValue~/api-table/apps.cozystack.io/v1alpha1/tenantnamespaces
+              value: /openapi-ui/~recordValue~/api-table/core.cozystack.io/v1alpha1/tenantnamespaces
             - name: PROJECTS_API_GROUP
               value: in-cloud.io
             - name: PROJECTS_RESOURCE_NAME

packages/system/dashboard/templates/keycloakclient.yaml

@@ -70,7 +70,6 @@ spec:
     - groups
     - kubernetes-client
   redirectUris:
-    - "https://dashboard.{{ $host }}/oauth/callback/*"
     - "https://dashboard.{{ $host }}/oauth2/callback/*"
     {{- range $i, $v := $extraRedirectUris }}
     - "{{ $v }}"

packages/system/dashboard/values.yaml

@@ -1,4 +1,4 @@
 openapiUI:
-  image: "ghcr.io/cozystack/cozystack/openapi-ui:latest@sha256:cd1b51e2a6fbccb14b158f00c5237b15272ef3d46db148152c546be1d6f0cdf0"
+  image: "ghcr.io/cozystack/cozystack/openapi-ui:latest@sha256:33628338ef5183f8f75657c305dcd5df2103b944fe6a421f8cbd037f3fc3e8b7"
 openapiUIK8sBff:
   image: "ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:latest@sha256:e5178151aa8f4d168d9aee5581e896cb6086f254816280e1e979b970c0bf658c"