riotpiao-poimen/poimen-memory
2
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: extract auth config to ConfigMap + SOPS, update Authentik slug #40

Merged
rock merged 1 commits from fix/auth-configmap-sops into main 2026-09-08 05:34:18 +00:00
Conversation 1 Commits 1 Files Changed 6
+74 -4
rock commented 2026-09-08 05:26:01 +00:00
Owner
Copy Link
Copy Source

Problem

JWT validation failing with error decoding response body: expected value at line 6 column 1.

Root cause: AUTHENTIK_ISSUER pointed to slug poimen-memory which returns 404 on OIDC discovery. Slug was renamed to poimen in Authentik.

Secondary issue: auth env vars were set via kubectl set env (not in git), so every ArgoCD sync reverted them.

Changes

  • k8s/app/config.yaml — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
  • k8s/app/auth.enc.yaml — SOPS-encrypted Secret with AUTHENTIK_ISSUER, AUTHENTIK_AUDIENCE, JWT_CACHE_TTL_SECS
  • k8s/app/secret-generator.yaml — KSOPS generator for ArgoCD decryption
  • k8s/app/deployment.yaml — envFrom referencing ConfigMap + Secret
  • k8s/app/kustomization.yaml — Added config.yaml + KSOPS generator
  • k8s/app/opensearch-deployment.yaml — Updated JWKS/issuer URLs to poimen slug

Rollout

Reloader (--auto-reload-all=true) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.

## Problem JWT validation failing with `error decoding response body: expected value at line 6 column 1`. Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik. Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them. ## Changes - **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs) - **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS` - **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption - **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret - **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator - **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug ## Rollout Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.
rock added 1 commit 2026-09-08 05:26:03 +00:00
fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen
CI / CI (pull_request) Successful in 4m21s
Details
c538397db4 
- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars
- Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE
- Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD)
- Deployment uses envFrom instead of inline env vars
- Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery)
- Update OpenSearch JWKS/issuer URLs to match new slug
- Reloader (auto-reload-all=true) triggers rollout on config change
rock commented 2026-09-08 05:31:56 +00:00
Author
Owner
Copy Link
Copy Source

Manual pre-apply status

ConfigMap and Secret applied manually (ahead of merge):

kubectl apply -f k8s/app/config.yaml              # created
sops decrypt k8s/app/auth.enc.yaml | kubectl apply # created

Issue encountered: kubectl rollout restart triggered Reloader, new pods crashed:

exec: "serve": executable file not found in $PATH

Root cause: Deployment in-cluster doesn't have envFrom yet (PR not merged). Reloader detected new ConfigMap/Secret but deployment doesn't reference them, so restart exposed pre-existing image issue.

Rolled back: old pods (2/2) healthy.

Next steps:

  1. Merge this PR (adds envFrom to deployment)
  2. ArgoCD syncs — Reloader triggers clean rollout
  3. New pods get correct AUTHENTIK_ISSUER=.../poimen/
## Manual pre-apply status **ConfigMap and Secret applied manually** (ahead of merge): ``` kubectl apply -f k8s/app/config.yaml # created sops decrypt k8s/app/auth.enc.yaml | kubectl apply # created ``` **Issue encountered**: `kubectl rollout restart` triggered Reloader, new pods crashed: ``` exec: "serve": executable file not found in $PATH ``` **Root cause**: Deployment in-cluster doesn't have `envFrom` yet (PR not merged). Reloader detected new ConfigMap/Secret but deployment doesn't reference them, so restart exposed pre-existing image issue. **Rolled back**: old pods (2/2) healthy. **Next steps**: 1. Merge this PR (adds `envFrom` to deployment) 2. ArgoCD syncs — Reloader triggers clean rollout 3. New pods get correct `AUTHENTIK_ISSUER=.../poimen/`
rock merged commit 5fc9101888 into main 2026-09-08 05:34:18 +00:00
rock deleted branch fix/auth-configmap-sops 2026-09-08 05:34:18 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
memory-observability
Observability implementation tasks
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/poimen-memory#40