start-dex-local

Start a local IdP with Dex (for testing)

Replace the external OIDC provider (Okta, Google, …) that oauth2-proxy expects with Dex running inside the same kind cluster, so you can test the whole Flyte auth flow with no cloud account and no real users.

This assumes a kind cluster with Flyte and Traefik already up (steps 1–6 of the kind deployment / the deploy-flyte-kind skill's OIDC section), about to wire oauth2-proxy. Deploy Dex first, then point oauth2-proxy at it.

For local testing only. Dex here uses in-memory storage and a static test password baked into its config. Never use this configuration anywhere real.

The issuer-URL constraint (why the setup looks the way it does)

OIDC requires the issuer URL to be identical everywhere it's seen:

• oauth2-proxy (in-cluster) reaches Dex over a Kubernetes service name.
• The browser reaches Dex to log in, and must land on the same issuer the token was minted for, or validation fails.

A service name (dex.flyte.svc.cluster.local) isn't resolvable from the browser; a localhost URL isn't resolvable from inside the cluster. The fix: serve Dex under the same host as Flyte (flyte.local) at a sub-path (/dex), routed through Traefik. One URL — http://flyte.local/dex — works from both sides.

Step 0: Prerequisites

for t in kubectl helm; do command -v $t >/dev/null || echo "MISSING: $t"; done
kubectl --context kind-flyte -n traefik get deploy traefik >/dev/null 2>&1 || echo "MISSING: traefik"
kubectl --context kind-flyte -n flyte get svc flyte-http >/dev/null 2>&1 || echo "MISSING: flyte"
docker ps --filter name=flyte-control-plane --format '{{.Ports}}' | grep -q '80->30080' \
  || echo "MISSING: hostPort 80->30080 mapping (recreate the cluster — see deploy-flyte-kind Step 1)"

If anything is MISSING, stop. Flyte + Traefik must already be deployed, and the cluster must have been created with the hostPort: 80 → 30080 mapping — Dex's issuer (http://flyte.local/dex) is unreachable from the browser without it, and the mapping can't be added to an existing cluster. Also confirm 127.0.0.1 flyte.local is in /etc/hosts.