rock
81883a8ea1
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
27 lines
732 B
YAML
27 lines
732 B
YAML
# DB clusters are wave 2 — their namespaces must exist first (their apps that
|
|
# would CreateNamespace run later, w3/w8). Declared here so the databases App
|
|
# creates them. vault/temporal/paperless CreateNamespace=true then no-ops.
|
|
# poimen namespace created by poimen-root app (wave 7).
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: iam
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: temporal
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: paperless
|
|
---
|
|
# Needed here (not just immich's own CreateNamespace=true at wave 8) because
|
|
# k8s/infra/iam's PostSync job (wave 3) has a RoleBinding targeting this
|
|
# namespace - same ordering reason as paperless above.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: immich
|