rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(data): add CNPG managed roles + Database CRs for authentik/temporal — replaces missing helmfile post-sync user creation

Browse Source 
authentik/temporal DB users+databases were never provisioned (old helmfile hook
gone; db-init-job only made schemas in shared app DB). Adds managed.roles
(authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs
(dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in
kustomize resources so data-schemas app doesn't choke on ciphertext.
This commit is contained in:
Story Crater Bot
2026-07-20 23:36:21 -07:00
parent 89fa87f7c1
commit 5ce0b92186
5 changed files with 90 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/data/kustomization.yaml
+4
View File
@@ -14,3 +14,7 @@ resources:
- schemas.yaml
- db-init-job.yaml
- forgejo-database.yaml
- authentik-database.yaml
- temporal-database.yaml
# db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
# NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.