From 44604901b243a417c16c1c54e049c810691e236b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 28 Sep 2026 22:51:46 +0000 Subject: [PATCH 1/2] fix(docs): match Helm values, backup Secret namespace and OIDC role mapping to the code - installation: networkPolicies.kubeletCIDRs is a list and gameEgress.ports entries are {protocol, port} objects (the chart ranges over both); the string/integer examples failed to render. - installation: the Helm OIDC example with groupsClaim/defaultRole/ roleMappings/displayName is v0.3.0+; beta.8's chart only has enabled/issuer/clientID/clientSecretRef/redirectURL. - backup-restore-crds: the restic repo Secret must live in the Backup's namespace; the operator looks it up there. - sign-in-recovery: beta.8 already maps IdP groups to roles per provider (Admin Settings -> Authentication); only Helm seeding is v0.3.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y Signed-off-by: Claude --- src/content/docs/backup-restore-crds.mdx | 5 +++-- src/content/docs/installation.mdx | 15 +++++++++++---- src/content/docs/sign-in-recovery.mdx | 2 +- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/content/docs/backup-restore-crds.mdx b/src/content/docs/backup-restore-crds.mdx index 9c380c5..637550c 100644 --- a/src/content/docs/backup-restore-crds.mdx +++ b/src/content/docs/backup-restore-crds.mdx @@ -106,14 +106,15 @@ Uses the cluster's CSI storage provider to create native snapshots at the hyperv ## Repository credentials and references -Restic-snapshot backups require a Kubernetes Secret in the operator namespace (`gameplane-system` by default) containing the repository URL and credentials. +Restic-snapshot backups require a Kubernetes Secret containing the repository URL and credentials, in the same namespace as the Backup or BackupSchedule that references it (`gameplane-games` by default). The operator looks the Secret up in the Backup's own namespace and fails the Backup if it isn't there. ```yaml -# Secret in gameplane-system namespace +# Secret in the Backup's namespace apiVersion: v1 kind: Secret metadata: name: my-backup-repo + namespace: gameplane-games labels: gameplane.local/backup-destination: "true" type: Opaque diff --git a/src/content/docs/installation.mdx b/src/content/docs/installation.mdx index b77d67b..85e524f 100644 --- a/src/content/docs/installation.mdx +++ b/src/content/docs/installation.mdx @@ -97,7 +97,7 @@ api: ### Optional: OIDC authentication at install time -If you use OIDC (OpenID Connect) for single sign-on, seed the role mappings at install time: +If you use OIDC (OpenID Connect) for single sign-on, the chart can configure the provider at install time. In v0.2.0-beta.8 the chart accepts `enabled`, `issuer`, `clientID`, `clientSecretRef` and `redirectURL`; map IdP groups to roles per provider under **Admin Settings → Authentication**. From v0.3.0 the chart can also seed the role mappings: ```yaml api: @@ -128,8 +128,13 @@ Enable default-deny policies in the games namespace to prevent pod-to-pod and ou ```yaml networkPolicies: enabled: true - # Allow kubelet liveness/readiness probes - kubeletCIDRs: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16" + # Allow kubelet liveness/readiness probes (a list; empty falls back to + # RFC1918 + link-local) + kubeletCIDRs: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + - 169.254.0.0/16 # Allow player ingress (TCP/UDP for game traffic) gameIngress: enabled: true @@ -137,7 +142,9 @@ networkPolicies: # Allow public-internet egress (downloads, mod registries) gameEgress: enabled: true - ports: [80, 443] + ports: + - { protocol: TCP, port: 443 } + - { protocol: TCP, port: 80 } ``` ### Module sources and catalog diff --git a/src/content/docs/sign-in-recovery.mdx b/src/content/docs/sign-in-recovery.mdx index e6eac9d..9e678fc 100644 --- a/src/content/docs/sign-in-recovery.mdx +++ b/src/content/docs/sign-in-recovery.mdx @@ -46,7 +46,7 @@ Local accounts use a Gameplane credential; provider buttons delegate password an **Local auth** requires the account to exist in Gameplane's local user list — created manually under **Admin Settings → Users** or automatically on first OIDC login (assigned the viewer role by default). Each local account stores an `argon2id`-hashed password; the API enforces a 12-character minimum. -**OIDC** (OpenID Connect) delegates authentication to a third-party identity provider (Keycloak, Authentik, Google Workspace, Okta, etc.). The provider handles password storage and MFA; Gameplane stores only the OIDC subject ID (issuer + subject claim); group-claim role mapping is not available in beta.8 (coming in v0.3.0). Providers are configured under **Admin Settings → Authentication** and take effect on the next user login (no API restart required). +**OIDC** (OpenID Connect) delegates authentication to a third-party identity provider (Keycloak, Authentik, Google Workspace, Okta, etc.). The provider handles password storage and MFA; Gameplane stores only the OIDC subject ID (issuer + subject claim). Each provider can map IdP groups to dashboard roles (a groups claim, per-role group lists and a default role); a user with no matching group gets the default role, `viewer` unless you change it. Seeding these mappings from Helm values arrives in v0.3.0. Providers are configured under **Admin Settings → Authentication** and take effect on the next user login (no API restart required). OIDC group-claim role mapping will allow you to derive user roles from your identity provider's group claims, enabling zero-trust RBAC on login without post-deployment configuration. From e20010a1230ced68770c84831e5bacf717613870 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 28 Sep 2026 22:54:03 +0000 Subject: [PATCH 2/2] docs: split OIDC chart snippet by version, drop stale role-mapping callouts beta.8's chart takes only the connection keys; displayName, groupsClaim, defaultRole and roleMappings arrive in v0.3.0. Per-provider group-to-role mapping already works in beta.8 via Admin Settings, so the sign-in callout and effective-role text now say only Helm seeding is new. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y Signed-off-by: Claude --- src/content/docs/installation.mdx | 12 +++++++++++- src/content/docs/sign-in-recovery.mdx | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/src/content/docs/installation.mdx b/src/content/docs/installation.mdx index 85e524f..ebfaa24 100644 --- a/src/content/docs/installation.mdx +++ b/src/content/docs/installation.mdx @@ -97,9 +97,10 @@ api: ### Optional: OIDC authentication at install time -If you use OIDC (OpenID Connect) for single sign-on, the chart can configure the provider at install time. In v0.2.0-beta.8 the chart accepts `enabled`, `issuer`, `clientID`, `clientSecretRef` and `redirectURL`; map IdP groups to roles per provider under **Admin Settings → Authentication**. From v0.3.0 the chart can also seed the role mappings: +If you use OIDC (OpenID Connect) for single sign-on, the chart can configure the provider at install time. In v0.2.0-beta.8 the chart accepts only the connection settings; map IdP groups to roles per provider under **Admin Settings → Authentication** after install: ```yaml +# v0.2.0-beta.8 api: oidc: enabled: true @@ -107,6 +108,15 @@ api: clientID: "gameplane-app" clientSecretRef: name: "oidc-client-secret" # k8s Secret with 'clientSecret' key + redirectURL: "https://gameplane.your-domain.test/auth/oidc/callback" +``` + +From v0.3.0 the chart can also seed the provider's display name and role mappings. Add these keys only when installing a v0.3.0 or later chart: + +```yaml +# v0.3.0 and later (in addition to the keys above) +api: + oidc: displayName: "My SSO Provider" groupsClaim: "groups" # OIDC claim containing group memberships defaultRole: "viewer" # Default role when group mapping doesn't match diff --git a/src/content/docs/sign-in-recovery.mdx b/src/content/docs/sign-in-recovery.mdx index 9e678fc..0dd5dcb 100644 --- a/src/content/docs/sign-in-recovery.mdx +++ b/src/content/docs/sign-in-recovery.mdx @@ -49,7 +49,7 @@ Local accounts use a Gameplane credential; provider buttons delegate password an **OIDC** (OpenID Connect) delegates authentication to a third-party identity provider (Keycloak, Authentik, Google Workspace, Okta, etc.). The provider handles password storage and MFA; Gameplane stores only the OIDC subject ID (issuer + subject claim). Each provider can map IdP groups to dashboard roles (a groups claim, per-role group lists and a default role); a user with no matching group gets the default role, `viewer` unless you change it. Seeding these mappings from Helm values arrives in v0.3.0. Providers are configured under **Admin Settings → Authentication** and take effect on the next user login (no API restart required). - OIDC group-claim role mapping will allow you to derive user roles from your identity provider's group claims, enabling zero-trust RBAC on login without post-deployment configuration. + The Helm chart will be able to seed each provider's group-to-role mappings from values (`api.oidc.groupsClaim`, `roleMappings`, `defaultRole`), so a fresh install derives roles on first login without post-deployment configuration. For provider-specific setup steps, see [Users, Auth & RBAC](../users-auth-rbac/). @@ -106,7 +106,7 @@ An administrator with the `users:manage` role can reset any local user's passwor The user's effective role in Gameplane is determined by: - **Local account**: the role manually assigned in **Admin Settings → Users** -- **OIDC account**: the role is the viewer role by default (coming in v0.3.0: the role derived from the provider's group claim if group mapping is configured in **Admin Settings → Authentication**) *or* the role manually assigned in **Admin Settings → Users** as an override +- **OIDC account**: the role derived from the provider's group claim when group mapping is configured in **Admin Settings → Authentication** (otherwise the provider's default role, `viewer` unless changed) *or* the role manually assigned in **Admin Settings → Users** as an override To test your own recovery process, log out and use a private/incognito window to attempt re-login. If you are locked out of OIDC and cannot log in via a local backup account, use one of these break-glass paths: