feat(argocd): migrate phase3 (authentik) to ArgoCD, keep temporal on helmfile

2026-08-18 15:08:01 -07:00
parent 0b4a79b5ca
commit 5e887b4da3
6 changed files with 170 additions and 160 deletions
@@ -0,0 +1,100 @@
+# ArgoCD Hook Jobs for Phase 3 (IAM only)
+
+---
+# ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────
+
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: authentik-ca-setup
+  namespace: iam
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  backoffLimit: 1
+  template:
+    spec:
+      serviceAccountName: phase3-setup
+      restartPolicy: Never
+      containers:
+      - name: ca-setup
+        image: bitnami/kubectl:latest
+        command:
+          - /bin/sh
+          - -c
+          - |
+            echo "Setting up CA ConfigMap for Authentik..."
+            CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
+              -o jsonpath='{.data.tls\.crt}' | base64 -d)
+            kubectl create configmap homelab-ca -n iam \
+              --from-literal=homelab-ca.crt="$CA_PEM" \
+              --dry-run=client -o yaml | kubectl apply -f -
+            echo "✓ CA ConfigMap created"
+
+---
+# ── Authentik — PostSync: OIDC Provisioning ──────────────────────────────────
+
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: authentik-oidc-provision
+  namespace: iam
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  backoffLimit: 1
+  template:
+    spec:
+      serviceAccountName: phase3-setup
+      restartPolicy: Never
+      containers:
+      - name: oidc-provision
+        image: bitnami/kubectl:latest
+        command:
+          - /bin/sh
+          - -c
+          - |
+            echo "Waiting for Authentik server..."
+            kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true
+            echo "✓ Authentik ready"
+
+---
+# ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: phase3-setup
+  namespace: iam
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: phase3-setup
+rules:
+  - apiGroups: [""]
+    resources: ["secrets", "configmaps"]
+    verbs: ["get", "list", "create", "apply", "patch"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "create"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["list", "get"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: phase3-setup
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: phase3-setup
+subjects:
+  - kind: ServiceAccount
+    name: phase3-setup
+    namespace: iam