rock
81883a8ea1
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
29 lines
989 B
YAML
29 lines
989 B
YAML
# Wave 2 — dedicated per-app CNPG Postgres clusters (zitadel-db → ns iam,
|
|
# temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
|
|
# CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
|
|
# dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates
|
|
# each cluster's `<name>-app` secret + `<name>-rw` service in-namespace; the apps
|
|
# read them locally. Forgejo's DB stays separate (bootstrap/circular).
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: databases
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/databases
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: default
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- ServerSideApply=true
|