markdown-vault-mcp to authelia oidc

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -23,6 +23,18 @@ spec:
               MARKDOWN_VAULT_MCP_STATE_PATH: /data/state/state.json
               MARKDOWN_VAULT_MCP_READ_ONLY: "false"
               MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
+              MARKDOWN_VAULT_MCP_OIDC_CONFIG_URL: "https://auth.aggtaa.com/.well-known/openid-configuration"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_ID: "markdown-vault-mcp"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_CLIENT_SECRET
+              MARKDOWN_VAULT_MCP_OIDC_JWT_SIGNING_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_JWT_SIGNING_KEY
               MARKDOWN_VAULT_MCP_BEARER_TOKEN:
                 valueFrom:
                   secretKeyRef:

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,19 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:+dhi9NACFpK50tglKbvYMbX4L+4DQMwgxIFjJaQEQy3ISMqX3ttsi/xXapKUa93JQV7L/1BHVU+lavi39W4gdQ==,iv:Nnds9N1hQ02jX7LjqBuW+25FdN4DXAzHt8xZXS7TyTc=,tag:L74snWm46Wv9JspmTg75fA==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:vRsc/kmZ1qySDUrI1dMeLqSSn+jEgvPivw3dRYTLr7NRm6T7SYnmhhBb81CG6xQAl0Wz8RfOCescQpUJlbPl4w==,iv:Zha9o8uIdR6DPMk+KRL6ZnKdh3zPXuyjCCK9yKnuYFI=,tag:l+8oHY/hgZcKVQx9yiaEmg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:2unvRtI/V0aTULgSacGvEoYYQN0uWBR3b2TKjl7hjvQTXesuglTtSNz9YsjDqc8ZHGNBndiz2Q6VZagS3ERprw==,iv:fjMhiKamjbIrNYAK9TU2PPn0smJR+Kr3qhRhEUbjm04=,tag:wuUZbccOBoFcdiTPqb8QCQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:63S/0TsEis959MJRLd5atPXQrv5pNMC5iyMHJvT67luLLPkd2bdgfmX4Pu7R3Hr5YIGoujn1/xCuOdZH0RtIog==,iv:3Gi2ZukSzU9SIy7fPzmlvWbA4ykaNgta95DuviHf5zk=,tag:BPUXUPMIxW9kbyyQqoz0gQ==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNHk2eGVOb3N0NEZzcFNP
-            cDFySjgzaS9JVmVYTVhHTmRGdjdoY3I1dGo4CnNZMTMvZjRnbXhTRzBIUWtyaFRo
-            OWN3V2hvMlNVakJrd2MvSy9xT0d4bUkKLS0tIElreW1hM2Y0WDVkUHQ0M0E1RVEy
-            ekFkdEVhQmw5RE1hN1VhZTh5T0RwQU0KLAM4mRrj0jhWisGMp5A9FI4Js20YIifF
-            lieCHOzMkD1alrwS/HGuXho8UpSCdXgS5A2m0fLo9rXw+vo6cUEuAA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaG5NRStTVXlIMklDSjI4
+            cUJxOGxuSWxrM2FQQWhkUjZsUEtXT1BzTmpFCkdnWHFUQlRGdGtjRWUrcUFUT05R
+            SDcxWi9SOTlIT2RCL0c1ZExuUXp5NDgKLS0tIG9EVi9WMW81bzd2REpzc1ZFK1JE
+            cTVIVVdTSkt4MXRYNHlDZVMrQkpBNUkK9uaUyjPZaFyWbxrZpEVgzOSw+1pWX/rF
+            tu0eoMSzf0w9l/zSiBAAQeCd1jnLp1LDw4eZKiYZ9DF5P0AclVT4Lg==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+    lastmodified: "2026-07-27T06:42:40Z"
+    mac: ENC[AES256_GCM,data:XRxbyHL4iJMoRMb4X6C2y1ChTNSkqou01bwtIb6zNfwcGCt7uMGbm1HxvmjbdeJI/zQIIVfgxbbTxhZw+sL2FF+PYAjPcaGvaJ86O97lr9fUB30NC0tMluW82pt2iiisK+6dEEPH9i/kGFrJHN6RlaYVkEfv6U8xjlpIcaNx0+A=,iv:YnqMRlHl1WVYNqqN9hRH88hgIALrfgv6WrJGyeNDstI=,tag:M1DYFr3G9ub/R2kNF8ZnNQ==,type:str]
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-26T17:40:02Z"
-    mac: ENC[AES256_GCM,data:UQgiaBGslKNIbg1nJhqBygreonl4OsE93cxVycrETTDjuT+Q7NeiA7Dm7h9TrluHffU8cGgjplkDZqPSBl4y1HYD/Y9T+/Hssz2lJ0p7U5Ut2O5TadSfr8hRhhdvZuOfRg2bn0MYRbpfgEf+NJd8XkO/IdCFQ2k9okLe+1H2kac=,iv:G9H5/jZ5YgfJnNe87UBAuMgITb6ThQSWt+FNlINUZuY=,tag:8OC4C7G4Wa3OKrHkErjDfw==,type:str]
-    version: 3.13.2
+    version: 3.11.0