rock
c5058dadc6
key-rotation-controller / image (push) Failing after 6s
Two defects that a real rotation exposed:
merge writeSecret replaced the whole Secret map, so every key a consumer
keeps beside the credential disappeared. paperless lost
SOCIALACCOUNT_PROVIDERS_JSON and immich lost config.json; both pods then
failed to start while the rotation reported success.
backoff a Failed attempt returned 0, so the controller retried in a tight loop.
It now waits two minutes and then retries.
All eight objects carry both identifiers ZITADEL needs: the app resource id for the
secret endpoint and the client id for introspection.
Result: seven rotations reach Succeeded with every consumer ready (grafana, comfyui,
argocd, forgejo, paperless, immich, minio). api-gw stays suspended because no workload
exists for it.
220 lines
5.9 KiB
YAML
220 lines
5.9 KiB
YAML
# Every credential this cluster owns, described as a KeyRotation.
|
|
#
|
|
# One object per consumer. The controller creates the value, writes the Secret and
|
|
# proves the new value works before it retires the old one. Nothing here holds a
|
|
# secret, so this file is safe in git.
|
|
#
|
|
# suspend: true everywhere on purpose. The controller image does not exist yet, and
|
|
# an unsuspended object would claim an intent no process is acting on. Clear the flag
|
|
# per object as its pilot passes.
|
|
#
|
|
# poimen-memory is absent deliberately: it is in use and excluded from this migration.
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: grafana
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: false
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801948413953" # app resource id, not the client id 396757801965191169
|
|
zitadelClientID: "396757801965191169"
|
|
secretName: grafana-oidc
|
|
secretNamespace: logging
|
|
secretKeys:
|
|
secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: grafana, namespace: logging}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: argocd
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801210216831" # app resource id, not the client id 396757801210282367
|
|
zitadelClientID: "396757801210282367"
|
|
secretName: argocd-oidc
|
|
secretNamespace: argocd
|
|
secretKeys:
|
|
secret: oidc.clientSecret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: argocd-server, namespace: argocd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: comfyui
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "397015743994003854" # app resource id, not the client id 397015744010781070
|
|
zitadelClientID: "397015744010781070"
|
|
secretName: comfyui-oauth2-proxy
|
|
secretNamespace: comfyui
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: minio
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803240259585" # app resource id, not the client id 396757803257036801
|
|
zitadelClientID: "396757803257036801"
|
|
secretName: minio-oidc
|
|
secretNamespace: storage
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: paperless
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757803542249855" # app resource id, not the client id 396757803559027071
|
|
zitadelClientID: "396757803559027071"
|
|
secretName: paperless-oidc
|
|
secretNamespace: paperless
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: paperless, namespace: paperless}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: immich
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757802602725759" # app resource id, not the client id 396757802602791295
|
|
zitadelClientID: "396757802602791295"
|
|
secretName: immich-oidc
|
|
secretNamespace: immich
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: immich-server, namespace: immich}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: forgejo
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757801562538367" # app resource id, not the client id 396757801579315583
|
|
zitadelClientID: "396757801579315583"
|
|
secretName: forgejo-oidc
|
|
secretNamespace: cicd
|
|
secretKeys:
|
|
secret: CLIENT_SECRET
|
|
reload: restart
|
|
consumers:
|
|
- {kind: Deployment, name: forgejo-gitea, namespace: cicd}
|
|
verify:
|
|
introspect: true
|
|
---
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
|
kind: KeyRotation
|
|
metadata:
|
|
name: api-gw
|
|
namespace: iam
|
|
labels:
|
|
app.kubernetes.io/part-of: key-rotation
|
|
spec:
|
|
provider: zitadel-oidc-client
|
|
strategy: atomic
|
|
intervalHours: 2160
|
|
suspend: true
|
|
target:
|
|
zitadelProjectID: "396757796898471937"
|
|
zitadelAppID: "396757800857895295" # app resource id, not the client id 396757800874672511
|
|
zitadelClientID: "396757800874672511"
|
|
secretName: api-gw-oidc
|
|
secretNamespace: api-gw
|
|
secretKeys:
|
|
secret: client-secret
|
|
reload: hot
|
|
consumers:
|
|
- {kind: Deployment, name: api-gw, namespace: api-gw}
|
|
verify:
|
|
introspect: true
|