feat(iam): wire all 9 consumer manifests to Zitadel OIDC

k8s/infra/logging/grafana-values.yaml

@@ -74,7 +74,7 @@ grafana.ini:
     enabled: true
     name: Zitadel
     allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: 396757801965191169
+    client_id: "396757801965191169"
     scopes: openid email profile groups
     auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
     token_url: https://zitadel.riotpiao.com/oauth/v2/token

k8s/infra/rbac/homarr-operator-role.yaml

@@ -1,32 +0,0 @@
-# Scoped operator access for homarr-admins: the homarr Deployment + app
-# secrets only. homarr-oidc, auth-oidc-secret, db-encryption stay excluded
-# (security-managed, not app config). Inert until kube-apiserver's OIDC
-# wiring lands.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-operator
-  namespace: dashboard
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    resourceNames: ["homarr"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["homarr-secrets"]
-    verbs: ["get", "list", "watch", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-admins-binding
-  namespace: dashboard
-subjects:
-  - kind: Group
-    name: "oidc:homarr-admins"
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: homarr-operator
-  apiGroup: rbac.authorization.k8s.io

k8s/infra/rbac/kustomization.yaml

@@ -10,7 +10,6 @@ resources:
   - grafana-operator-role.yaml
   - minio-operator-role.yaml
   - forgejo-operator-role.yaml
-  - homarr-operator-role.yaml
   - portainer-operator-role.yaml
   - kmsvc-operator-role.yaml
   - temporal-operator-role.yaml