rock c5058dadc6 fix(iam): merge into the consumer Secret, and retry with a backoff ...

Two defects that a real rotation exposed:

  merge      writeSecret replaced the whole Secret map, so every key a consumer
             keeps beside the credential disappeared. paperless lost
             SOCIALACCOUNT_PROVIDERS_JSON and immich lost config.json; both pods then
             failed to start while the rotation reported success.
  backoff    a Failed attempt returned 0, so the controller retried in a tight loop.
             It now waits two minutes and then retries.

All eight objects carry both identifiers ZITADEL needs: the app resource id for the
secret endpoint and the client id for introspection.

Result: seven rotations reach Succeeded with every consumer ready (grafana, comfyui,
argocd, forgejo, paperless, immich, minio). api-gw stays suspended because no workload
exists for it.

2026-10-27 19:59:23 -07:00

..

apps

fix(iam): merge into the consumer Secret, and retry with a backoff

2026-10-27 19:59:23 -07:00

argocd

chore(iam): retire the .enc files whose values rotation invalidated

2026-10-27 14:47:48 -07:00

bootstrap

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

infra

feat(grafana): provision a Gotify contact point

2026-10-27 12:38:29 -07:00