29 lines
877 B
YAML
29 lines
877 B
YAML
|
# Example: rotate a service user's machine key with no gap.
|
||
|
|
#
|
||
|
|
# Machine keys overlap in ZITADEL, so the old key stays valid until the new one has
|
||
|
|
# obtained a token. Nothing in the window fails.
|
||
|
|
#
|
||
|
|
# Apply only after the controller runs and the machine user exists.
|
||
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
||
|
|
kind: KeyRotation
|
||
|
|
metadata:
|
||
|
|
name: example-machine-key
|
||
|
|
namespace: iam
|
||
|
|
spec:
|
||
|
|
provider: zitadel-machine-key
|
||
|
|
strategy: overlap
|
||
|
|
intervalHours: 720 # 30 days
|
||
|
|
suspend: true # flip to false once the pilot is proven
|
||
|
|
target:
|
||
|
|
machineUserID: "REPLACE_WITH_SERVICE_USER_ID"
|
||
|
|
secretName: example-jwt
|
||
|
|
secretNamespace: iam
|
||
|
|
secretKeys:
|
||
|
|
key: key
|
||
|
|
key-id: key-id
|
||
|
|
reload: hot # the consumer watches the file, so no restart
|
||
|
|
consumers: []
|
||
|
|
verify:
|
||
|
|
tokenExchange: true
|
||
|
|
audienceProject: "396757796898471937"
|