homelab

545 Commits 39 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
rock	3630721366	feat(iam): run the controller with the RBAC and image it needs key-rotation-controller / image (push) Failing after 5s Details Three faults stopped the controller from running, each found by running it: image arch the first build was arm64 and every node is amd64, so the pod died with 'exec format error'. imagePullPolicy IfNotPresent kept the cached wrong-arch layer, so it is now Always. leases leader election needs coordination.k8s.io/leases. Without it the controller never acquired its lock and never reconciled. secrets list the manager caches Secrets, so it needs list and watch, not only get, create, update and patch. go.mod and go.sum gained the procfs entry the build needs.	2026-10-27 17:46:25 -07:00
rock	60931fbba1	ci(iam): build and push the key-rotation-controller image Dockerfile: static binary on distroless, no shell, user 65532. Workflow runs on the golang runner for a push to main that touches the controller. It builds two tags, the commit sha and 0.1.0, which is the tag the Deployment asks for, and runs the image with --help so a broken binary fails the job instead of the cluster. The runners were dead before this: every task fetch logged 'lookup forgejo-gitea-http.cicd.svc.cluster.local: no such host'. DNS resolved from a fresh pod and the Service had a healthy endpoint, so the runner pods held stale network state. A rollout restart cleared it and all three poll without error.	2026-10-27 14:50:33 -07:00
rock	c2071da9d8	feat(iam): define a KeyRotation for every consumer except poimen-memory Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and whether the consumer reloads hot or needs a restart. All are suspended: the controller image does not exist yet, and an unsuspended object would claim an intent that no process acts on. The README records the retirement target for the 34 .enc.yaml files: six root-of-trust secrets that cannot rotate themselves survive, everything else becomes a KeyRotation and leaves git.	2026-10-27 14:28:28 -07:00

Author

SHA1

Message

Date

rock

3630721366

feat(iam): run the controller with the RBAC and image it needs

key-rotation-controller / image (push) Failing after 5s

Details

Three faults stopped the controller from running, each found by running it:

  image arch    the first build was arm64 and every node is amd64, so the pod died
                with 'exec format error'. imagePullPolicy IfNotPresent kept the
                cached wrong-arch layer, so it is now Always.
  leases        leader election needs coordination.k8s.io/leases. Without it the
                controller never acquired its lock and never reconciled.
  secrets list  the manager caches Secrets, so it needs list and watch, not only
                get, create, update and patch.

go.mod and go.sum gained the procfs entry the build needs.

2026-10-27 17:46:25 -07:00

rock

60931fbba1

ci(iam): build and push the key-rotation-controller image

Dockerfile: static binary on distroless, no shell, user 65532.

Workflow runs on the golang runner for a push to main that touches the controller.
It builds two tags, the commit sha and 0.1.0, which is the tag the Deployment asks
for, and runs the image with --help so a broken binary fails the job instead of the
cluster.

The runners were dead before this: every task fetch logged 'lookup
forgejo-gitea-http.cicd.svc.cluster.local: no such host'. DNS resolved from a fresh
pod and the Service had a healthy endpoint, so the runner pods held stale network
state. A rollout restart cleared it and all three poll without error.

2026-10-27 14:50:33 -07:00

rock

c2071da9d8

feat(iam): define a KeyRotation for every consumer except poimen-memory

Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and
api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and
whether the consumer reloads hot or needs a restart.

All are suspended: the controller image does not exist yet, and an unsuspended
object would claim an intent that no process acts on.

The README records the retirement target for the 34 .enc.yaml files: six
root-of-trust secrets that cannot rotate themselves survive, everything else
becomes a KeyRotation and leaves git.

2026-10-27 14:28:28 -07:00