matsandClaude Sonnet 5
bd17837663
AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1008 B
YAML
36 lines
1008 B
YAML
# Local/agent development sign-in via the RFC 8628 device grant.
|
|
# Tokens minted for dev-console carry aud=[dev-console, https://otel.k6n.net], so the
|
|
# otel server (which requires aud to contain its own URL (OTEL_OIDC_AUDIENCE)) accepts them with no
|
|
# server-side change. Approval is still gated by the issuer's normal policy.
|
|
apiVersion: auth.k6n.net/v1alpha1
|
|
kind: AuthClient
|
|
metadata:
|
|
name: dev-console
|
|
namespace: ecommerce
|
|
labels:
|
|
auth.k6n.net/server: auth
|
|
spec:
|
|
clientID: dev-console
|
|
displayName: Dev console (device grant)
|
|
description: Public dev client for local and agent development via the device grant
|
|
redirectURIs: []
|
|
audience:
|
|
- https://otel.k6n.net
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- offline_access
|
|
---
|
|
# Partial apply: only deviceFlow is owned by this field manager.
|
|
apiVersion: auth.k6n.net/v1alpha1
|
|
kind: AuthServer
|
|
metadata:
|
|
name: auth
|
|
namespace: ecommerce
|
|
spec:
|
|
deviceFlow:
|
|
clientID: dev-console
|
|
codeTTL: 10m
|
|
pollInterval: 5s
|