rock
c2071da9d8
Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and whether the consumer reloads hot or needs a restart. All are suspended: the controller image does not exist yet, and an unsuspended object would claim an intent that no process acts on. The README records the retirement target for the 34 .enc.yaml files: six root-of-trust secrets that cannot rotate themselves survive, everything else becomes a KeyRotation and leaves git.
67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
# The controller. Its own machine key is the single bootstrap credential: it is
|
|
# created once and mounted here, and this process creates every other credential.
|
|
#
|
|
# The image must be built and pushed before this Deployment can start. Until then
|
|
# the object stays Pending, which is why no Argo CD Application is wired yet.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: key-rotation-controller
|
|
namespace: iam
|
|
labels:
|
|
app: key-rotation-controller
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: key-rotation-controller
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: key-rotation-controller
|
|
spec:
|
|
serviceAccountName: key-rotation-controller
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: controller
|
|
image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- --scan-interval=10m
|
|
env:
|
|
- {name: ZITADEL_ISSUER, value: "https://zitadel.riotpiao.com"}
|
|
- name: ZITADEL_CLIENT_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: client-id}}
|
|
- name: ZITADEL_USER_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: user-id}}
|
|
- name: ZITADEL_KEY_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: key-id}}
|
|
- {name: ZITADEL_KEY_FILE, value: "/var/run/keys/controller/key"}
|
|
ports:
|
|
- {name: metrics, containerPort: 8080}
|
|
- {name: health, containerPort: 8081}
|
|
readinessProbe:
|
|
httpGet: {path: /healthz, port: health}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /healthz, port: health}
|
|
initialDelaySeconds: 15
|
|
volumeMounts:
|
|
- {name: controller-key, mountPath: /var/run/keys/controller, readOnly: true}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 20m, memory: 64Mi}
|
|
limits: {cpu: 500m, memory: 256Mi}
|
|
volumes:
|
|
- name: controller-key
|
|
secret:
|
|
secretName: key-rotation-controller
|
|
items:
|
|
- {key: key, path: key}
|