Prefixing services as subdomains breaks Oauth2 authentication to environments

[smlx]

Describe the bug

Situation: A web developer uses Oauth2 for authentication to their PR environments.

Oauth2 generally is quite strict about limiting redirect URIs to be absolute. The reasons behind this are described in the Oauth2 threat model RFC.

However some Oauth2 providers such as auth0 do allow limited wildcards for subdomains as a convenience. These rules are similar to those for wildcard DNS records. In particular, only the leftmost label in the domain may be a wildcard.

On Openshift this works because for autogenerated routes we prefixed the service, environment, and project to the cluster domain as a single label joined by hyphens. e.g. app-myproject-pr-1234.lagoon.mycluster.example.com.

On k8s however, we separate these components into separate labels e.g. app.pr-1234.myproject.lagoon.mycluster.example.com

This means that there is no way to capture auto-generated domains using a wildcard given the rules linked above.

To Reproduce

Steps to reproduce the behavior:

1. Deploy a PR environment using Oauth2 via auth0.
2. Authentication doesn't work.
3. There's no way to get it working with the current autogenerated router pattern system.

Expected behavior

I would expect existing Lagoon workflows to continue working on kubernetes the same way they work on openshift.

Screenshots

n/a

Additional context

n/a

[tobybellwood]

implemented!