rock
5fc9101888
CI / CI (push) Successful in 15m28s
## Problem JWT validation failing with `error decoding response body: expected value at line 6 column 1`. Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik. Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them. ## Changes - **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs) - **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS` - **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption - **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret - **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator - **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug ## Rollout Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40 Co-authored-by: rock <[email protected]>
12 lines
259 B
YAML
12 lines
259 B
YAML
# KSOPS generator — ArgoCD decrypts auth.enc.yaml at sync time
|
|
apiVersion: viaduct.ai/v1
|
|
kind: ksops
|
|
metadata:
|
|
name: poimen-memory-auth-generator
|
|
annotations:
|
|
config.kubernetes.io/function: |
|
|
exec:
|
|
path: ksops
|
|
files:
|
|
- auth.enc.yaml
|