Skip to content

feat(mctl-api): sign in through ZITADEL only (OAUTH_UPSTREAM=zitadel) #1694

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mashkovd merged 2 commits into from
Oct 9, 2026
Merged

feat(mctl-api): sign in through ZITADEL only (OAUTH_UPSTREAM=zitadel) #1694

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
df9a6c3
feat(mctl-api): sign in through ZITADEL only (OAUTH_UPSTREAM=zitadel)
mashkovd Oct 6, 2026
c087579
Merge main into feat/mctl-api-oauth-upstream-zitadel
mashkovd Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions platform-gitops/bootstrap/templates/mctl-platform/mctl-api.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,14 +164,18 @@ spec:
# above (mctlhq/mctl-gitops#1363).
# Upstream identity provider of /oauth/authorize
# (mctlhq/mctl-api#467, canary for mctlhq/mctl-gitops#1500 phase 2).
# `both`: ZITADEL (auth.mctl.ai) is the primary sign-in and GitHub
# stays as the legacy link, so a person without a linked ZITADEL
# identity can still sign in. Needs OAUTH_ZITADEL_CLIENT_ID/SECRET
# from oauthZitadelSecret below; mctl-api refuses to start in this
# mode without them. mctl-issued tokens and group resolution are
# unchanged: the ZITADEL identity maps to the linked GitHub login.
# Rollback: delete this line (default `github`).
OAUTH_UPSTREAM: "both"
# `zitadel`: ZITADEL (auth.mctl.ai) is the only sign-in. The canary
# on `both` was proven end to end on 2026-10-06. A person whose
# ZITADEL identity is not linked gets a 403 page that leads to the
# link flow (/identity/link/zitadel); that flow still signs them in
# with GitHub once to prove the old account, in any mode. Sessions
# that already exist keep working: refresh never goes upstream.
# Needs OAUTH_ZITADEL_CLIENT_ID/SECRET from oauthZitadelSecret
# below; mctl-api refuses to start in this mode without them.
# mctl-issued tokens and group resolution are unchanged: the
# ZITADEL identity maps to the linked GitHub login.
# Rollback: set this back to `both`.
OAUTH_UPSTREAM: "zitadel"
# Browser origins permitted by CORS. Distinct from the redirect URIs
# above: those govern where the OAuth dance may hand a code back,
# this governs which page may read an authenticated API response.
Expand Down
Loading