rock
b8f934806e
comfyui served nothing and its oauth2-proxy could not start: the Secret carried only client-secret while the Deployment asked for client-id, cookie-secret and client-secret. Rather than repair a service nobody used, remove it from every layer. Gone: - k8s/apps/comfyui/* and its ArgoCD Application - the cloudflared tunnel rule for comfyui.riotpiao.com - the CoreDNS rewrite in the terraform Corefile (the tracked source) - the Cloudflare DNS record (terraform tfvars) - the ZITADEL OIDC app and its two rotation tables - the KeyRotation object Not gone by this commit: the comfyui namespace and its 50Gi PVC. ArgoCD does not own either, so a person deletes both by hand after the prune. The local cluster-config/talos-*.yaml copies are gitignored; they carry the same removal and need an apply-config to reach the live CoreDNS.
198 lines
5.5 KiB
YAML
198 lines
5.5 KiB
YAML
# Every credential this cluster owns, described as a KeyRotation.
|
|
#
|
|
# One object per consumer. The controller creates the value, writes the Secret and
|
|
# proves the new value works before it retires the old one. Nothing here holds a
|
|
# secret, so this file is safe in git.
|
|
#
|
|
# suspend: true everywhere on purpose. The controller image does not exist yet, and
|
|
# an unsuspended object would claim an intent no process is acting on. Clear the flag
|
|
# per object as its pilot passes.
|
|
#
|
|
# poimen-memory is absent deliberately: it is in use and excluded from this migration.
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: grafana
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: false
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801948413953" # app resource id, not the client id 396757801965191169
|
|
zitadelClientID: "396757801965191169"
|
|
secretName: grafana-oidc
|
|
secretNamespace: logging
|
|
secretKeys:
|
|
secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: grafana, namespace: logging}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: argocd
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801210216831" # app resource id, not the client id 396757801210282367
|
|
zitadelClientID: "396757801210282367"
|
|
secretName: argocd-oidc
|
|
secretNamespace: argocd
|
|
secretKeys:
|
|
secret: oidc.clientSecret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: argocd-server, namespace: argocd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: minio
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803240259585" # app resource id, not the client id 396757803257036801
|
|
zitadelClientID: "396757803257036801"
|
|
secretName: minio-oidc
|
|
secretNamespace: storage
|
|
secretKeys:
|
|
# The key name here must match the consumer's secretKeyRef, not a house style.
|
|
# minio-tenant.yaml reads MINIO_IDENTITY_OPENID_CLIENT_SECRET. While this said
|
|
# `client-secret`, the tenant failed with CreateContainerConfigError on every
|
|
# restart and the rotation wrote a key nobody read.
|
|
secret: MINIO_IDENTITY_OPENID_CLIENT_SECRET
|
|
reload: hot
|
|
consumers:
|
|
- {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: paperless
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803542249855" # app resource id, not the client id 396757803559027071
|
|
zitadelClientID: "396757803559027071"
|
|
secretName: paperless-oidc
|
|
secretNamespace: paperless
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: paperless, namespace: paperless}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: immich
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757802602725759" # app resource id, not the client id 396757802602791295
|
|
zitadelClientID: "396757802602791295"
|
|
secretName: immich-oidc
|
|
secretNamespace: immich
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: immich-server, namespace: immich}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: forgejo
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801562538367" # app resource id, not the client id 396757801579315583
|
|
zitadelClientID: "396757801579315583"
|
|
secretName: forgejo-oidc
|
|
secretNamespace: cicd
|
|
secretKeys:
|
|
secret: CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: forgejo-gitea, namespace: cicd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: api-gw
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757800857895295" # app resource id, not the client id 396757800874672511
|
|
zitadelClientID: "396757800874672511"
|
|
secretName: api-gw-oidc
|
|
secretNamespace: api-gw
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: api-gw, namespace: api-gw}
|
|
verify:
|
|
introspect: true
|