rock
81883a8ea1
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
11 lines
260 B
YAML
11 lines
260 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- rbac-dashboard-rolebinding.yaml
|
|
|
|
# IAM provisioning is manual-only (security-sensitive).
|
|
# Script: scripts/iam/zitadel-provision.py
|
|
# Run:
|
|
# scripts/iam/zitadel-provision.py all
|