rock
e800e2cf1c
key-rotation-controller / image (push) Failing after 19s
Three defects, each seen in a live rotation of grafana:
scope the access token needs urn:zitadel:iam:org:project:id:zitadel:aud,
otherwise the management API answers 401 Token.Invalid even though the
assertion was accepted.
app id the objects carry the client id, and the secret endpoint takes the app
resource id. They differ, so every call answered 404 Application
doesn't exist. The correct ids are recorded per object.
attempt time record ActiveCredentialID and LastRotation right after Prepare. Without
it a later failure leaves LastRotation empty, the due check says rotate
now, and each reconcile mints a new secret and restarts the consumer:
grafana was rolled continuously and never became ready.
Also raise the consumer-ready budget to 8 minutes, because grafana needs about four,
and retry a failed attempt after 2 minutes instead of waiting a whole interval.
212 lines
5.5 KiB
YAML
212 lines
5.5 KiB
YAML
# Every credential this cluster owns, described as a KeyRotation.
|
|
#
|
|
# One object per consumer. The controller creates the value, writes the Secret and
|
|
# proves the new value works before it retires the old one. Nothing here holds a
|
|
# secret, so this file is safe in git.
|
|
#
|
|
# suspend: true everywhere on purpose. The controller image does not exist yet, and
|
|
# an unsuspended object would claim an intent no process is acting on. Clear the flag
|
|
# per object as its pilot passes.
|
|
#
|
|
# poimen-memory is absent deliberately: it is in use and excluded from this migration.
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: grafana
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: false
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801948413953" # app resource id, not the client id 396757801965191169
|
|
secretName: grafana-oidc
|
|
secretNamespace: logging
|
|
secretKeys:
|
|
secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: grafana, namespace: logging}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: argocd
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801210216831" # app resource id, not the client id 396757801210282367
|
|
secretName: argocd-oidc
|
|
secretNamespace: argocd
|
|
secretKeys:
|
|
secret: oidc.clientSecret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: argocd-server, namespace: argocd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: comfyui
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "397015743994003854" # app resource id, not the client id 397015744010781070
|
|
secretName: comfyui-oauth2-proxy
|
|
secretNamespace: comfyui
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: minio
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803240259585" # app resource id, not the client id 396757803257036801
|
|
secretName: minio-oidc
|
|
secretNamespace: minio
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: minio, namespace: minio}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: paperless
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803542249855" # app resource id, not the client id 396757803559027071
|
|
secretName: paperless-oidc
|
|
secretNamespace: paperless
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: paperless, namespace: paperless}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: immich
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757802602725759" # app resource id, not the client id 396757802602791295
|
|
secretName: immich-oidc
|
|
secretNamespace: immich
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: immich-server, namespace: immich}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: forgejo
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801562538367" # app resource id, not the client id 396757801579315583
|
|
secretName: forgejo-oidc
|
|
secretNamespace: forgejo
|
|
secretKeys:
|
|
secret: key
|
|
reload: restart
|
|
consumers:
|
|
- {kind: StatefulSet, name: forgejo, namespace: forgejo}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: api-gw
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757800857895295" # app resource id, not the client id 396757800874672511
|
|
secretName: api-gw-oidc
|
|
secretNamespace: api-gw
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: api-gw, namespace: api-gw}
|
|
verify:
|
|
introspect: true
|