rock
d1a7d3be6e
The oidc-bootstrap ArgoCD Application runs with selfHeal and prune. Three Jobs in restart-apiserver.yaml kill the kube-apiserver process on each control plane, and bootstrap.yaml carried a fourth Job that deletes the mirror pods. ArgoCD recreated a deleted Job within two minutes, so the kill repeated and every API server reached CrashLoopBackOff. Remove all four. The OIDC authenticator already loaded, so the one-shot restart is not needed again.
55 lines
2.5 KiB
JSON
55 lines
2.5 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"diagram_type": "sequence",
|
|
"meta": {
|
|
"title": "Service-to-Service (M2M) Authentication",
|
|
"viewBox": [1080, 520],
|
|
"column_fit": "spread",
|
|
"quality_profile": "showcase"
|
|
},
|
|
"participants": [
|
|
{ "id": "worker", "type": "backend", "label": "Ingest Worker", "sublabel": "temporal/cron" },
|
|
{ "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
|
|
{ "id": "memory", "type": "backend", "label": "Memory Service", "sublabel": "poimen-memory" },
|
|
{ "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
|
|
],
|
|
"segments": [
|
|
{ "from": 150, "to": 230, "label": "Token Mint" },
|
|
{ "from": 240, "to": 380, "label": "API + RBAC" }
|
|
],
|
|
"messages": [
|
|
{ "id": "token-req", "from": "worker", "to": "authentik", "y": 165, "label": "POST /token grant_type=password", "variant": "emphasis", "note": "client_id + username + app_password + scope" },
|
|
{ "id": "jwt-resp", "from": "authentik", "to": "worker", "y": 205, "label": "JWT {groups,roles,aud,iss}", "variant": "return", "note": "groups=[poimen-admins] roles=[memory:write]" },
|
|
{ "id": "api-call", "from": "worker", "to": "memory", "y": 260, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
|
|
{ "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 295, "label": "GET /jwks (cached)", "variant": "dashed" },
|
|
{ "id": "jwks-resp", "from": "jwks", "to": "memory", "y": 330, "label": "RSA pubkey (kid)", "variant": "return" },
|
|
{ "id": "verify-ok", "from": "memory", "to": "worker", "y": 365, "label": "202 Accepted", "variant": "return", "note": "sig ✓ iss ✓ aud ✓ has_capability ✓" }
|
|
],
|
|
"activations": [
|
|
{ "participant": "worker", "from": 160, "to": 371, "type": "backend" },
|
|
{ "participant": "authentik", "from": 165, "to": 211, "type": "security" },
|
|
{ "participant": "memory", "from": 255, "to": 371, "type": "backend" },
|
|
{ "participant": "jwks", "from": 290, "to": 336, "type": "security" }
|
|
],
|
|
"cards": [
|
|
{
|
|
"dot": "emerald",
|
|
"title": "M2M Pattern",
|
|
"items": [
|
|
"grant_type=password (Authentik aliases client_credentials)",
|
|
"App-password token authenticates the service account",
|
|
"NOT client_secret — that creates nameless SA"
|
|
]
|
|
},
|
|
{
|
|
"dot": "rose",
|
|
"title": "JWT Claims",
|
|
"items": [
|
|
"groups: from user.groups (poimen-admins)",
|
|
"roles: from user.attributes.roles",
|
|
"iss/aud: per-provider issuer"
|
|
]
|
|
}
|
|
]
|
|
}
|