iam: add memory scope, service accounts, manual provisioning

- Add 'memory' scope property mapping (memory_projects, memory_visibility, memory_role)
- Add capability groups: llm-users, memory-users, memory-writers
- Add service account provisioning for portfolio-agent, memory-agent
- Fix sops-secrets kustomization (generatorOptions)
- Add RoleBindings for portfolio, poimen, dashboard namespaces
- Remove PostSync hook - IAM provisioning is now manual-only

k8s/infra/iam/authentik-provision-job.yaml

@@ -1,19 +1,22 @@
-# Authentik OAuth provisioning — PostSync hook, reruns on every ArgoCD sync
-# (hook-delete-policy: BeforeHookCreation deletes the previous run's Job before
-# creating a new one, so this stays reconciled the same way the rest of the
-# cluster does — no separate manual bootstrap step like setup_talos_iam.sh /
-# provision_oidc.py, which never got migrated off the old helmfile workflow).
+# Authentik OAuth provisioning — MANUAL operation, NOT auto-run.
 #
-# What it does (see scripts/authentik-provision.py docstring): creates the
-# "groups" scope mapping, homelab-admins / grafana-admins groups, the "rock"
-# admin user, OAuth2 providers + Applications for grafana/minio/forgejo/argocd,
-# and binds homelab-admins to all of them. The script is generated into the
-# authentik-provision-script ConfigMap by kustomize configMapGenerator (see
-# kustomization.yaml), not embedded here.
+# Security-sensitive IAM changes should be reviewed and run locally:
+#   export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
+#     -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
+#   sed 's|http://authentik-server.iam.svc.cluster.local|https://authentik.riotpiao.com|g' \
+#     k8s/infra/iam/scripts/authentik-provision.py | python3
+#
+# What it does (see scripts/authentik-provision.py docstring): creates scope
+# mappings (groups, permissions, memory, policy, immich_role), admin groups,
+# the "rock" admin user, OAuth2 providers + Applications, service accounts
+# (portfolio-agent, memory-agent), and binds groups to applications.
+#
+# This file provides the RBAC (ServiceAccount + RoleBindings) needed if you
+# ever want to run the Job in-cluster manually (kubectl create -f), but the
+# PostSync hook is deliberately removed — IAM is not GitOps-auto-deployed.
 #
 # RBAC: this Job only touches Secrets (get existing client secrets, create new
-# ones for forgejo/argocd/rock) across the namespaces those services live in.
-# It never touches any other resource type.
+# ones) across the namespaces those services live in.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -143,14 +146,54 @@ roleRef:
   name: authentik-provisioner
   apiGroup: rbac.authorization.k8s.io
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: portfolio
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: poimen
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-provisioner
+  namespace: dashboard
+subjects:
+  - kind: ServiceAccount
+    name: authentik-provisioner
+    namespace: iam
+roleRef:
+  kind: ClusterRole
+  name: authentik-provisioner
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: authentik-provision
   namespace: iam
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+  # No ArgoCD hook - run manually when IAM changes are needed
 spec:
   ttlSecondsAfterFinished: 600
   backoffLimit: 3