rock
81883a8ea1
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
27 lines
1004 B
YAML
27 lines
1004 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Single source for cluster monitoring config (alerts, servicemonitors, dashboards).
|
|
# NO top-level `namespace:` transformer — PrometheusRules deliberately live in
|
|
# per-app namespaces (forgejo, iam, argocd, storage, ...); a transformer would
|
|
# wrongly rewrite them all to one ns.
|
|
resources:
|
|
- alerts/ingress-alerts.yaml
|
|
- alerts/svc-argocd-rules.yaml
|
|
- alerts/svc-zitadel-rules.yaml
|
|
- alerts/svc-forgejo-rules.yaml
|
|
- alerts/svc-grafana-rules.yaml
|
|
- alerts/svc-minio-rules.yaml
|
|
- alerts/svc-vault-rules.yaml
|
|
- alerts/cluster-alerts.yaml
|
|
- alerts/api-gateway-alerts.yaml
|
|
- alerts/cag-kv-cache-rules.yaml
|
|
- servicemonitors/argocd.yaml
|
|
- servicemonitors/forgejo.yaml
|
|
- servicemonitors/minio.yaml
|
|
- servicemonitors/ingress-nginx.yaml
|
|
- servicemonitors/vllm.yaml
|
|
- servicemonitors/api-gateway.yaml
|
|
- dashboards/cluster-infrastructure.yaml
|
|
- dashboards/api-gateway.yaml
|
|
- dashboards/llm-observability.yaml
|