OIDC: dashboard cannot bootstrap because oauth2-proxy discovers Keycloak through an ingress that does not serve yet #3288

What happens

On a fresh cluster installed with authentication.oidc.enabled: true, the dashboard never comes up: its oauth2-proxy sidecar fails at startup and the console is unreachable. Reported by a user doing a first-time install who followed the OIDC guide.

Root cause

packages/system/dashboard/templates/gatekeeper.yaml gives oauth2-proxy only --oidc-issuer-url=https://keycloak.<host>/realms/cozy when keycloakInternalUrl is empty — which is the default. oauth2-proxy then performs OIDC discovery against that external hostname at startup, so the request resolves through public DNS and lands on the root ingress controller.

On a fresh cluster that ingress does not serve yet: the root tenant's IngressClass only exists once tenant-root is ready, and tenant-root is still reconciling while the dashboard starts. Discovery has nothing to talk to, oauth2-proxy fails, and the dashboard stays down. The same template shape is used by packages/system/linstor-gui/templates/gatekeeper.yaml.

Setting authentication.oidc.keycloakInternalUrl switches the container to --skip-oidc-discovery and routes the backend calls (token, jwks, userinfo, logout) to the in-cluster Service, while browser redirects stay on the external URL. That is the workaround the reporting user found on their own, and it is also what our install tooling works around from the other side, by making the root tenant serve ingress before OIDC is switched on.

Why the default is wrong

There is no configuration path for an external Keycloak: the external hostname is templated as keycloak.<host> and the realm is fixed, so the bundled Keycloak is the only supported provider. Backend-to-backend calls therefore have no reason to leave the cluster at all. Sending them out through public DNS, the ingress controller and TLS buys nothing and adds both a bootstrap ordering dependency and a failure mode that a first-time installer cannot diagnose.

The documentation currently presents the option as optional — "useful in environments with self-signed certificates or restricted external access" — which undersells it. Enabling OIDC before the root tenant's ingress serves leaves the dashboard permanently down, and nothing in the guide says so.

Proposed fix

Default authentication.oidc.keycloakInternalUrl to http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy — the same in-cluster address keycloak-configure already uses for its own backend calls — and keep it overridable. Apply it to the dashboard and linstor-gui gatekeepers alike, so both take the internal path by default.

Then drop the "optional, for self-signed certificates" framing from the OIDC docs.