rock
81883a8ea1
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
12 lines
457 B
YAML
12 lines
457 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Dedicated per-app CNPG clusters. NO top-level `namespace:` — each Cluster
|
|
# carries its own ns (iam / temporal / poimen / paperless); a transformer would
|
|
# wrongly collapse them. poimen ns created by poimen-root app, memory-db
|
|
# deployed into it. paperless ns declared in namespaces.yaml above.
|
|
resources:
|
|
- namespaces.yaml
|
|
- zitadel-db.yaml
|
|
- temporal-db.yaml
|
|
- paperless-db.yaml
|