From fd542fb4090caf5ae185fdfddb2db2819b55fc04 Mon Sep 17 00:00:00 2001
From: Mayne0213 <bluemayne0213@icloud.com>
Date: Fri, 9 Jan 2026 20:10:42 +0900
Subject: [PATCH] FIX(headlamp): configure OIDC authentication

- Remove groups scope (Authelia does not provide groups claim)
- Set proper baseURL for OIDC redirect
- Revert baseURL to empty string (must be empty or start with '/')
---
 headlamp/manifests/external-secret.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/headlamp/manifests/external-secret.yaml b/headlamp/manifests/external-secret.yaml
index e6ae155..dd4caa5 100644
--- a/headlamp/manifests/external-secret.yaml
+++ b/headlamp/manifests/external-secret.yaml
@@ -17,7 +17,7 @@ spec:
         OIDC_CLIENT_ID: headlamp
         OIDC_CLIENT_SECRET: "{{ .clientSecret }}"
         OIDC_ISSUER_URL: https://auth0213.kro.kr
-        OIDC_SCOPES: "openid profile email groups"
+        OIDC_SCOPES: "openid profile email"
         OIDC_VALIDATOR_CLIENT_ID: headlamp
         OIDC_VALIDATOR_ISSUER_URL: https://auth0213.kro.kr
   data: