rock
cf1263235b
Every consumer SSO login failed for two independent reasons, and neither was recorded in git. 1. The OIDC client secrets lived only in the cluster. They are written by scripts/iam/zitadel-provision.py, whose `apply` phase calls _generate_client_secret for every app on every run. A rotation therefore invalidated the stored secret in ArgoCD, Grafana, MinIO, Immich and Paperless, with no git value to compare against. Declaring the five Secrets as SOPS manifests makes ArgoCD the owner, so the next rotation is a reviewable diff instead of silent drift. 2. Forgejo, Paperless and Immich store the identity-provider link inside their own databases, not in Kubernetes. Those rows still carried the Authentik subject and provider, which produced three different symptoms from one cause: Forgejo never left /user/link_account, Paperless showed the social signup page, and Immich answered 400 "email already linked to different account". The PostSync Job re-points each row at the ZITADEL `sub`, matching on email or username rather than the numeric ids this was first observed on, so a re-run converges. Verified with a real browser login against a live ZITADEL session: Forgejo, Paperless, Immich, Grafana and ArgoCD all reach their authenticated landing page. Vault has no UI by design. MinIO remains open: the operator sidecar serves its console with no OIDC environment, so it advertises form login only.
27 lines
1.4 KiB
YAML
27 lines
1.4 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-oidc
|
|
namespace: logging
|
|
labels:
|
|
app.kubernetes.io/managed-by: argocd
|
|
app.kubernetes.io/part-of: iam
|
|
type: Opaque
|
|
stringData:
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:ZCO6gQGNRKtahbUctlLYCTx3TpRdz5lj8r6X4fUXkyvS5rbWXgip2mGqho4LUSHh8du3wo+bK8VyP1MhzIFRGA==,iv:O2aCivj8Z3cbKCqj/Q8uG6mEH9QJbCrDLPIjX6bLkjo=,tag:qpKgg9AAtIUvYzr5zwTO1g==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEc2xWSk1ldGxpYzlHUlF5
|
|
aFZQWnVxWXJVemZVd1llQlZUTkNrTFpVWGhrCjZtbW1XU1Z0U1ZlTHlGMjVSTUFp
|
|
NnFNTjdlYUUyTlhnN3QybFZJSGRuRG8KLS0tIG9DL3ZQYmErc2ZndWd6TUNlOStp
|
|
UTI0UDZZM2IwQU9oRmxsU25rQi9zUUkKYznGn96vdcEZSCpfyReNj4qLoS0t19ZQ
|
|
frodab7z/n6TadRwsb1ufb+YIHa4pGPlImmrlNGOIpnKvzXlmOCP4Q==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
|
encrypted_regex: ^(data|stringData)$
|
|
lastmodified: "2026-10-31T03:41:24Z"
|
|
mac: ENC[AES256_GCM,data:uOPMvN1D/6AdxpWrR0aQYAxSEcC8/aJNg574cF+ypi/rt+srk68q2kAiKwA5L5GDvXs65rSZh2PMkJ0KV75g3ShFYOQSLaq0HIwYYTvIXRLtF43G8vMHaaZAhDC1pZeYPdD1KG61pDVjyCDc+qFZ/90kHqYiIeAdEI4Tia5YOJ4=,iv:SpU/YrCxORAJWJCLyTNSaNuIB0dAhq8+Bma58RUYL3U=,tag:s7fsEDQfqElTsE8EQsZfxw==,type:str]
|
|
version: 3.13.2
|