homelab/k8s/apps/key-rotation-controller/rotations.yaml

# Every credential this cluster owns, described as a KeyRotation.
#
# One object per consumer. The controller creates the value, writes the Secret and
# proves the new value works before it retires the old one. Nothing here holds a
# secret, so this file is safe in git.
#
# suspend: true everywhere on purpose. The controller image does not exist yet, and
# an unsuspended object would claim an intent no process is acting on. Clear the flag
# per object as its pilot passes.
#
# poimen-memory is absent deliberately: it is in use and excluded from this migration.
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: grafana
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: false
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757801948413953"  # app resource id, not the client id 396757801965191169
    zitadelClientID: "396757801965191169"
    secretName: grafana-oidc
    secretNamespace: logging
    secretKeys:
      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
    reload: restart
    consumers:
      - {kind: Deployment, name: grafana, namespace: logging}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: argocd
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757801210216831"  # app resource id, not the client id 396757801210282367
    zitadelClientID: "396757801210282367"
    secretName: argocd-oidc
    secretNamespace: argocd
    secretKeys:
      secret: oidc.clientSecret
    reload: restart
    consumers:
      - {kind: Deployment, name: argocd-server, namespace: argocd}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: comfyui
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "397015743994003854"  # app resource id, not the client id 397015744010781070
    zitadelClientID: "397015744010781070"
    secretName: comfyui-oauth2-proxy
    secretNamespace: comfyui
    secretKeys:
      secret: client-secret
    reload: restart
    consumers:
      - {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: minio
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757803240259585"  # app resource id, not the client id 396757803257036801
    zitadelClientID: "396757803257036801"
    secretName: minio-oidc
    secretNamespace: storage
    secretKeys:
      secret: client-secret
    reload: hot
    consumers:
      - {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: paperless
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757803542249855"  # app resource id, not the client id 396757803559027071
    zitadelClientID: "396757803559027071"
    secretName: paperless-oidc
    secretNamespace: paperless
    secretKeys:
      secret: client-secret
    reload: restart
    consumers:
      - {kind: Deployment, name: paperless, namespace: paperless}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: immich
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757802602725759"  # app resource id, not the client id 396757802602791295
    zitadelClientID: "396757802602791295"
    secretName: immich-oidc
    secretNamespace: immich
    secretKeys:
      secret: client-secret
    reload: restart
    consumers:
      - {kind: Deployment, name: immich-server, namespace: immich}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: forgejo
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757801562538367"  # app resource id, not the client id 396757801579315583
    zitadelClientID: "396757801579315583"
    secretName: forgejo-oidc
    secretNamespace: cicd
    secretKeys:
      secret: CLIENT_SECRET
    reload: restart
    consumers:
      - {kind: Deployment, name: forgejo-gitea, namespace: cicd}
  verify:
    introspect: true
---
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: api-gw
  namespace: iam
  labels:
    app.kubernetes.io/part-of: key-rotation
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "396757800857895295"  # app resource id, not the client id 396757800874672511
    zitadelClientID: "396757800874672511"
    secretName: api-gw-oidc
    secretNamespace: api-gw
    secretKeys:
      secret: client-secret
    reload: hot
    consumers:
      - {kind: Deployment, name: api-gw, namespace: api-gw}
  verify:
    introspect: true