refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# k8s/talos-iam/setup_talos_iam.sh
+# Validates required env vars are set, then delegates to helmfile.
+# All provisioning logic lives in helmfile hooks + provision_oidc.py.
+#
+# Usage:
+#   vsource .env && bash k8s/talos-iam/setup_talos_iam.sh
+#
+# To re-provision OIDC without redeploying Authentik:
+#   vsource .env && helmfile apply -l name=authentik
+#
+# To patch existing providers (update redirect URIs, scopes):
+#   vsource .env && helmfile apply -l name=authentik  # postsync runs provision_oidc.py --patch implicitly
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../cluster-config/kubeconfig}"
+export KUBECONFIG
+
+# ── Validate all required secrets are loaded from Vault ──────────────────────
+MISSING=()
+for var in \
+  AUTHENTIK_SECRET_KEY \
+  AUTHENTIK_BOOTSTRAP_PASSWORD \
+  AUTHENTIK_BOOTSTRAP_TOKEN \
+  AUTHENTIK_PG_PASSWORD \
+  GRAFANA_OIDC_CLIENT_SECRET \
+  MINIO_OIDC_CLIENT_SECRET \
+  AUTHENTIK_FORGEJO_CLIENT_SECRET \
+  AUTHENTIK_ARGOCD_CLIENT_SECRET; do
+  [[ -z "${!var:-}" ]] && MISSING+=("$var")
+done
+
+if [[ ${#MISSING[@]} -gt 0 ]]; then
+  echo "ERROR: the following vars are not set — run 'vsource .env' first:" >&2
+  printf '  %s\n' "${MISSING[@]}" >&2
+  echo "" >&2
+  echo "If a var is missing from Vault, store it first:" >&2
+  echo "  talos put cluster/VAR_NAME VAR_NAME=\"\$(openssl rand -hex 32)\"" >&2
+  exit 1
+fi
+
+echo "All required secrets present."
+echo ""
+echo "Provider credential mapping (client_id → client_secret):"
+printf '  %-10s  client_id=%-40s  secret=%s\n' \
+  "grafana"  "${GRAFANA_OIDC_CLIENT_ID:-"grafana (default)"}"  "GRAFANA_OIDC_CLIENT_SECRET" \
+  "minio"    "${MINIO_OIDC_CLIENT_ID:-"minio (default)"}"      "MINIO_OIDC_CLIENT_SECRET" \
+  "forgejo"  "${AUTHENTIK_FORGEJO_CLIENT_ID:-"forgejo (default)"}" "AUTHENTIK_FORGEJO_CLIENT_SECRET" \
+  "argocd"   "${AUTHENTIK_ARGOCD_CLIENT_ID:-"argocd (default)"}"   "AUTHENTIK_ARGOCD_CLIENT_SECRET"
+echo ""
+echo "Delegating to helmfile..."
+cd "${SCRIPT_DIR}/../.."
+helmfile apply -l name=authentik