poimen-memory/k8s/app/kustomization.yaml at 5fc9101888c4b8596f0e8a4646954366fb120821 - poimen-memory - Gitea: Git with a cup of tea

riotpiao-poimen/poimen-memory

Files

T

rock 5fc9101888

CI / CI (push) Successful in 15m28s

Details

fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40 )

## Problem

JWT validation failing with `error decoding response body: expected value at line 6 column 1`.

Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik.

Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them.

## Changes

- **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
- **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS`
- **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption
- **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret
- **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator
- **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug

## Rollout

Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40

Co-authored-by: rock <[email protected]>

2026-09-08 05:34:17 +00:00

14 lines

337 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: poimen
 resources:
   # vault-pvc.yaml removed — memory service uses pgvector, not local storage
   - deployment.yaml
   - service.yaml
   - config.yaml
   - obsidian.yaml
   # Legacy secret managed separately
   # - secrets.yaml
 generators:
   - secret-generator.yaml