rock
c2071da9d8
Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and whether the consumer reloads hot or needs a restart. All are suspended: the controller image does not exist yet, and an unsuspended object would claim an intent that no process acts on. The README records the retirement target for the 34 .enc.yaml files: six root-of-trust secrets that cannot rotate themselves survive, everything else becomes a KeyRotation and leaves git.
212 lines
5.1 KiB
YAML
212 lines
5.1 KiB
YAML
# Every credential this cluster owns, described as a KeyRotation.
|
|
#
|
|
# One object per consumer. The controller creates the value, writes the Secret and
|
|
# proves the new value works before it retires the old one. Nothing here holds a
|
|
# secret, so this file is safe in git.
|
|
#
|
|
# suspend: true everywhere on purpose. The controller image does not exist yet, and
|
|
# an unsuspended object would claim an intent no process is acting on. Clear the flag
|
|
# per object as its pilot passes.
|
|
#
|
|
# poimen-memory is absent deliberately: it is in use and excluded from this migration.
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: grafana
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801965191169"
|
|
secretName: grafana-oidc
|
|
secretNamespace: logging
|
|
secretKeys:
|
|
secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: grafana, namespace: logging}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: argocd
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801210282367"
|
|
secretName: argocd-oidc
|
|
secretNamespace: argocd
|
|
secretKeys:
|
|
secret: oidc.clientSecret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: argocd-server, namespace: argocd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: comfyui
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "397015744010781070"
|
|
secretName: comfyui-oauth2-proxy
|
|
secretNamespace: comfyui
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: minio
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803257036801"
|
|
secretName: minio-oidc
|
|
secretNamespace: minio
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: minio, namespace: minio}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: paperless
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803559027071"
|
|
secretName: paperless-oidc
|
|
secretNamespace: paperless
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: paperless, namespace: paperless}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: immich
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757802602791295"
|
|
secretName: immich-oidc
|
|
secretNamespace: immich
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: immich-server, namespace: immich}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: forgejo
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801579315583"
|
|
secretName: forgejo-oidc
|
|
secretNamespace: forgejo
|
|
secretKeys:
|
|
secret: key
|
|
reload: restart
|
|
consumers:
|
|
- {kind: StatefulSet, name: forgejo, namespace: forgejo}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: api-gw
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757800874672511"
|
|
secretName: api-gw-oidc
|
|
secretNamespace: api-gw
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: api-gw, namespace: api-gw}
|
|
verify:
|
|
introspect: true
|