rock
cb1219bf96
Coexistence wiring for the Authentik replacement: ZITADEL gets its own CNPG cluster, SOPS masterkey, Helm values and ArgoCD Application in namespace iam. Authentik keeps serving; no consumer is moved and no Authentik object changes. - k8s/infra/databases/zitadel-db.yaml: CNPG Postgres 16.2, 3 instances - k8s/infra/iam/zitadel-values.yaml: chart 10.4.0 pinned, DSN from the CNPG secret, masterkey from a Secret, metrics ServiceMonitor, second-sync caveat - k8s/argocd/apps/30-security.yaml: Application named zitadel, wave 3, automated sync deliberately absent for the first sync (chart PreSync hook re-run risk) - k8s/argocd/secrets/zitadel-masterkey.enc.yaml: 32-byte masterkey, SOPS - k8s/infra/monitoring/alerts/svc-zitadel-rules.yaml: target-down, login-UI, crash-loop and PreSync-job-failed rules - terraform/files/coredns/Corefile: in-cluster rewrite for the zitadel host Not applied. The cluster is mid-incident: vault-0 and authentik-server are 0/1, authentik-db-2 has 14 restarts, prometheus-0 is 1/2 CrashLoopBackOff and kube-state-metrics has 1925 restarts. Two manual steps still gate the first sync: the Cloudflare Tunnel public hostname plus a proxied CNAME, and terraform apply + make apply-cp for the CoreDNS rewrite (Talos-owned). The offline masterkey copy is at ~/zitadel-masterkey.offline (mode 600). Move it to sealed storage and delete it before the first sync. Losing it makes every encrypted ZITADEL value unreadable.
43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
# Dedicated CNPG Postgres for ZITADEL (GitOps, wave 2 — before the zitadel
|
|
# chart at wave 3). Same shape as authentik-db.yaml: CNPG generates the secret
|
|
# `zitadel-db-app` and the service `zitadel-db-rw` in ns iam, and
|
|
# k8s/infra/iam/zitadel-values.yaml reads the DSN from that secret locally (no
|
|
# cross-namespace secret copy).
|
|
#
|
|
# ZITADEL requires PostgreSQL 14+; the repo convention image is 16.2.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: zitadel-db
|
|
namespace: iam
|
|
annotations:
|
|
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
|
spec:
|
|
instances: 3
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
|
bootstrap:
|
|
initdb:
|
|
database: zitadel
|
|
owner: app
|
|
encoding: UTF8
|
|
localeCollate: C
|
|
localeCType: C
|
|
enableSuperuserAccess: false
|
|
resources:
|
|
requests: { memory: "512Mi", cpu: "250m" }
|
|
limits: { memory: "2Gi", cpu: "1" }
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: longhorn-cnpg
|
|
monitoring:
|
|
enablePodMonitor: true
|
|
affinity:
|
|
# preferred + tolerations: HA across nodes without deadlocking a partly-
|
|
# schedulable 3-CP (same as authentik-db and forgejo-db).
|
|
podAntiAffinityType: preferred
|
|
topologyKey: kubernetes.io/hostname
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|