5 Commits

Include renames

Author	SHA1	Message	Date
rock	b8f934806e	chore(comfyui): retire the app for good ... comfyui served nothing and its oauth2-proxy could not start: the Secret carried only client-secret while the Deployment asked for client-id, cookie-secret and client-secret. Rather than repair a service nobody used, remove it from every layer. Gone: - k8s/apps/comfyui/* and its ArgoCD Application - the cloudflared tunnel rule for comfyui.riotpiao.com - the CoreDNS rewrite in the terraform Corefile (the tracked source) - the Cloudflare DNS record (terraform tfvars) - the ZITADEL OIDC app and its two rotation tables - the KeyRotation object Not gone by this commit: the comfyui namespace and its 50Gi PVC. ArgoCD does not own either, so a person deletes both by hand after the prune. The local cluster-config/talos-*.yaml copies are gitignored; they carry the same removal and need an apply-config to reach the live CoreDNS.	2026-11-04 03:44:07 +08:00
rock	af45e0f3ac	fix(key-rotation): read MINIO_IDENTITY_OPENID_CLIENT_SECRET, not client-secret ... The rotation wrote a key the tenant never read, so minio restarted into CreateContainerConfigError. The key name must match the consumer's secretKeyRef, not a house style.	2026-11-04 03:41:13 +08:00
rock	c5058dadc6	fix(iam): merge into the consumer Secret, and retry with a backoff ... Two defects that a real rotation exposed: merge writeSecret replaced the whole Secret map, so every key a consumer keeps beside the credential disappeared. paperless lost SOCIALACCOUNT_PROVIDERS_JSON and immich lost config.json; both pods then failed to start while the rotation reported success. backoff a Failed attempt returned 0, so the controller retried in a tight loop. It now waits two minutes and then retries. All eight objects carry both identifiers ZITADEL needs: the app resource id for the secret endpoint and the client id for introspection. Result: seven rotations reach Succeeded with every consumer ready (grafana, comfyui, argocd, forgejo, paperless, immich, minio). api-gw stays suspended because no workload exists for it.	2026-10-27 19:59:23 -07:00
rock	e800e2cf1c	fix(iam): make a rotation attempt survive a failure ... Three defects, each seen in a live rotation of grafana: scope the access token needs urn:zitadel:iam:org:project:id:zitadel:aud, otherwise the management API answers 401 Token.Invalid even though the assertion was accepted. app id the objects carry the client id, and the secret endpoint takes the app resource id. They differ, so every call answered 404 Application doesn't exist. The correct ids are recorded per object. attempt time record ActiveCredentialID and LastRotation right after Prepare. Without it a later failure leaves LastRotation empty, the due check says rotate now, and each reconcile mints a new secret and restarts the consumer: grafana was rolled continuously and never became ready. Also raise the consumer-ready budget to 8 minutes, because grafana needs about four, and retry a failed attempt after 2 minutes instead of waiting a whole interval.	2026-10-27 18:39:59 -07:00
rock	c2071da9d8	feat(iam): define a KeyRotation for every consumer except poimen-memory ... Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and whether the consumer reloads hot or needs a restart. All are suspended: the controller image does not exist yet, and an unsuspended object would claim an intent that no process acts on. The README records the retirement target for the 34 .enc.yaml files: six root-of-trust secrets that cannot rotate themselves survive, everything else becomes a KeyRotation and leaves git.	2026-10-27 14:28:28 -07:00