From 7c163eeeca1f4e47c5df7f19edae47a717fca0d7 Mon Sep 17 00:00:00 2001 From: xnoto Date: Tue, 25 Aug 2026 12:02:47 -0600 Subject: [PATCH] chore: remove unused static oidc issuer endpoint The endpoint served an empty keyset since creation and had zero consumers: no AWS IAM OIDC provider exists for it, no operator is wired to it, and the k3s apiserver validates ServiceAccount tokens with its local key. The AWS STS web-identity design it was scaffolded for was never built. Deploy with --delete removes it from the live site. --- README.md | 20 --------------- .../oidc/.well-known/openid-configuration | 7 ------ makeitwork.cloud/oidc/index.html | 25 ------------------- makeitwork.cloud/oidc/openid/v1/jwks | 3 --- 4 files changed, 55 deletions(-) delete mode 100644 makeitwork.cloud/oidc/.well-known/openid-configuration delete mode 100644 makeitwork.cloud/oidc/index.html delete mode 100644 makeitwork.cloud/oidc/openid/v1/jwks diff --git a/README.md b/README.md index 1e1772f..331d0b2 100644 --- a/README.md +++ b/README.md @@ -16,26 +16,6 @@ Serverless web content with GitHub Actions pushing changes to S3. - https://www.w3schools.com/icons/fontawesome_icons_intro.asp -# Static OIDC issuer - -`makeitwork.cloud/oidc/` hosts public static Kubernetes ServiceAccount OIDC -discovery metadata for future AWS STS web-identity authentication from the k3s -cluster. - -- Issuer: `https://makeitwork.cloud/oidc` -- Discovery: `https://makeitwork.cloud/oidc/.well-known/openid-configuration` -- JWKS: `https://makeitwork.cloud/oidc/openid/v1/jwks` - -The JWKS file must contain only public key material for the k3s ServiceAccount -token signing key. Never commit the private signing key, AWS credentials, KMS key -IDs, kubeconfigs, or decrypted SOPS values here. - -This static issuer is for Kubernetes ServiceAccount tokens used by AWS STS; it -is not the human kubectl login provider and does not expose the cluster API. -Maintainer kubectl access uses Cloudflare Access plus ArgoCD Dex as documented -in the -[`kustomize-cluster` README](https://github.com/makeitworkcloud/kustomize-cluster#kubectl-access). - # CI and deployment Pull requests run static pre-commit checks only. Pushes to `main` deploy the diff --git a/makeitwork.cloud/oidc/.well-known/openid-configuration b/makeitwork.cloud/oidc/.well-known/openid-configuration deleted file mode 100644 index 1b6f1f4..0000000 --- a/makeitwork.cloud/oidc/.well-known/openid-configuration +++ /dev/null @@ -1,7 +0,0 @@ -{ - "issuer": "https://makeitwork.cloud/oidc", - "jwks_uri": "https://makeitwork.cloud/oidc/openid/v1/jwks", - "response_types_supported": ["id_token"], - "subject_types_supported": ["public"], - "id_token_signing_alg_values_supported": ["RS256"] -} diff --git a/makeitwork.cloud/oidc/index.html b/makeitwork.cloud/oidc/index.html deleted file mode 100644 index e9860af..0000000 --- a/makeitwork.cloud/oidc/index.html +++ /dev/null @@ -1,25 +0,0 @@ - - - - - - makeitwork.cloud OIDC issuer - - -
-

makeitwork.cloud OIDC issuer

-

- This path hosts static Kubernetes ServiceAccount OIDC discovery metadata - for AWS STS web-identity authentication. -

- -
- - diff --git a/makeitwork.cloud/oidc/openid/v1/jwks b/makeitwork.cloud/oidc/openid/v1/jwks deleted file mode 100644 index faf87ec..0000000 --- a/makeitwork.cloud/oidc/openid/v1/jwks +++ /dev/null @@ -1,3 +0,0 @@ -{ - "keys": [] -}