rock
d1a7d3be6e
The oidc-bootstrap ArgoCD Application runs with selfHeal and prune. Three Jobs in restart-apiserver.yaml kill the kube-apiserver process on each control plane, and bootstrap.yaml carried a fourth Job that deletes the mirror pods. ArgoCD recreated a deleted Job within two minutes, so the kill repeated and every API server reached CrashLoopBackOff. Remove all four. The OIDC authenticator already loaded, so the one-shot restart is not needed again.
64 lines
3.2 KiB
JSON
64 lines
3.2 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"diagram_type": "sequence",
|
|
"meta": {
|
|
"title": "Service Acting on Behalf of User",
|
|
"viewBox": [1000, 600],
|
|
"column_fit": "spread",
|
|
"quality_profile": "showcase"
|
|
},
|
|
"participants": [
|
|
{ "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
|
|
{ "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
|
|
{ "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC" },
|
|
{ "id": "worker", "type": "backend", "label": "Backend Worker", "sublabel": "temporal/queue" },
|
|
{ "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
|
|
{ "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256" }
|
|
],
|
|
"segments": [
|
|
{ "from": 150, "to": 260, "label": "User Auth" },
|
|
{ "from": 270, "to": 370, "label": "Delegation" },
|
|
{ "from": 380, "to": 510, "label": "Downstream" }
|
|
],
|
|
"messages": [
|
|
{ "id": "login", "from": "user", "to": "app", "y": 165, "label": "login (OIDC)", "variant": "default" },
|
|
{ "id": "oidc-flow", "from": "app", "to": "authentik", "y": 200, "label": "authorization_code flow", "variant": "emphasis" },
|
|
{ "id": "user-jwt", "from": "authentik", "to": "app", "y": 235, "label": "user JWT {groups,roles}", "variant": "return" },
|
|
{ "id": "trigger-job", "from": "user", "to": "app", "y": 285, "label": "trigger async job", "variant": "default" },
|
|
{ "id": "queue-job", "from": "app", "to": "worker", "y": 320, "label": "enqueue job + user JWT", "variant": "emphasis", "note": "JWT passed as job metadata" },
|
|
{ "id": "job-ack", "from": "worker", "to": "app", "y": 355, "label": "job queued", "variant": "return" },
|
|
{ "id": "call-memory", "from": "worker", "to": "memory", "y": 400, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Bearer <user JWT>" },
|
|
{ "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 435, "label": "GET /jwks", "variant": "dashed" },
|
|
{ "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 470, "label": "RSA pubkey", "variant": "return" },
|
|
{ "id": "ingest-ok", "from": "memory", "to": "worker", "y": 505, "label": "202 Accepted", "variant": "return", "note": "uses USER's groups/roles" }
|
|
],
|
|
"activations": [
|
|
{ "participant": "user", "from": 160, "to": 291, "type": "external" },
|
|
{ "participant": "app", "from": 165, "to": 361, "type": "frontend" },
|
|
{ "participant": "authentik", "from": 195, "to": 241, "type": "security" },
|
|
{ "participant": "worker", "from": 315, "to": 511, "type": "backend" },
|
|
{ "participant": "memory", "from": 395, "to": 511, "type": "backend" },
|
|
{ "participant": "jwks", "from": 430, "to": 476, "type": "security" }
|
|
],
|
|
"cards": [
|
|
{
|
|
"dot": "emerald",
|
|
"title": "Delegation Pattern",
|
|
"items": [
|
|
"User JWT travels with the job payload",
|
|
"Worker uses user's token for downstream",
|
|
"Memory sees USER as the principal"
|
|
]
|
|
},
|
|
{
|
|
"dot": "rose",
|
|
"title": "Security Model",
|
|
"items": [
|
|
"No service-account escalation",
|
|
"User's permissions bound the action",
|
|
"Audit trail traces to user.sub"
|
|
]
|
|
}
|
|
]
|
|
}
|