From 79118de8d331de44527feaf2297e6468b027c290 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Mon, 20 Jul 2026 23:36:21 -0700 Subject: [PATCH] =?UTF-8?q?feat(data):=20add=20CNPG=20managed=20roles=20+?= =?UTF-8?q?=20Database=20CRs=20for=20authentik/temporal=20=E2=80=94=20repl?= =?UTF-8?q?aces=20missing=20helmfile=20post-sync=20user=20creation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit authentik/temporal DB users+databases were never provisioned (old helmfile hook gone; db-init-job only made schemas in shared app DB). Adds managed.roles (authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs (dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in kustomize resources so data-schemas app doesn't choke on ciphertext. --- k8s/data/authentik-database.yaml | 10 +++++++ k8s/data/db-role-secrets.enc.yaml | 49 +++++++++++++++++++++++++++++++ k8s/data/ddb-cluster.yaml | 17 +++++++++++ k8s/data/kustomization.yaml | 4 +++ k8s/data/temporal-database.yaml | 10 +++++++ 5 files changed, 90 insertions(+) create mode 100644 k8s/data/authentik-database.yaml create mode 100644 k8s/data/db-role-secrets.enc.yaml create mode 100644 k8s/data/temporal-database.yaml diff --git a/k8s/data/authentik-database.yaml b/k8s/data/authentik-database.yaml new file mode 100644 index 0000000..63a3859 --- /dev/null +++ b/k8s/data/authentik-database.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: authentik + namespace: ddb +spec: + name: authentik + owner: authentik + cluster: + name: ddb-cluster diff --git a/k8s/data/db-role-secrets.enc.yaml b/k8s/data/db-role-secrets.enc.yaml new file mode 100644 index 0000000..9355fc0 --- /dev/null +++ b/k8s/data/db-role-secrets.enc.yaml @@ -0,0 +1,49 @@ +apiVersion: ENC[AES256_GCM,data:u74=,iv:vPf+N0mpxoTTHn8t3W6kiIbNrXGOFngfnc5vk3gzq+Y=,tag:OlJWpHdVqQHeA96OdJoA7A==,type:str] +kind: ENC[AES256_GCM,data:9f6uPGLQ,iv:V5KjMaBQoQRwMxHRoStLIlSYW0zqgcORLX5GKYKZ7hY=,tag:zLozLmSNHOd2/lFxFfnxtw==,type:str] +metadata: + name: ENC[AES256_GCM,data:uNU+lZyIdW0bwLQHoecYqdU=,iv:ov6MQQ9e7s+dRoQbZQPbjtB5j42dckyg27nx+LWJw0I=,tag:74nJSTgy9pZ5LH/O3xpwSA==,type:str] + namespace: ENC[AES256_GCM,data:xIre,iv:Gv//YoAeIoFgFbW9OJkHPv1Fz8NEAzB+qSpNYXm1008=,tag:Vsj/V3wLX8mUnHrMGZZxFw==,type:str] +type: ENC[AES256_GCM,data:pkm2nd/50FTigAJyEW2mEcgKVR0Y61VA,iv:DQ3k8Xp54nySnVEJvbiMXYJ+0ssUC8oSDLsoRut+qMg=,tag:ZwVH9ivA5hBCCkiGjXPbUw==,type:str] +stringData: + username: ENC[AES256_GCM,data:TeIYIIDS+RWp,iv:feJ2lRnPWnDKIMgSEz4A070k2ZrDFz7VzF7vthxoQuM=,tag:QYeI+6qeuyL3hIZSH7eQWg==,type:str] + password: ENC[AES256_GCM,data:ACIyp9eAiQtuzcN8piX5XX/UzHEjobxT1M6usFV6jwQ=,iv:AnmrpNo9JqtWYMwh4ghWXZfmeCTXFqzkfN69CPbWkpM=,tag:kZ2jfUAvtG39+Og/Km2fwA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaFFueUY2MUZ1dzRkelRL + aklvRytMSVBJQjA4UXdqSjlRQUo2R0lyTTFVCktUNWl1cWttZDdVd2ZyR0lPVERj + T1ZpMkRrZGgvWFJVRnZOdlZJc3RNcTAKLS0tIHVwY0JNMXVWeTZnWW9BQnM0TCtK + bVJ0eU05N3hIT3Z6TWdSOUxxeGh1b1UKuQ23KqCTNlEk3c8gbQsFGQwkN4gkI7Z2 + HauqbNHQoU64smns+HPDoHq7z87xRlQ8c8efNpIGhfYgS/nf1eGXbg== + -----END AGE ENCRYPTED FILE----- + recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + lastmodified: "2026-07-21T06:35:41Z" + mac: ENC[AES256_GCM,data:VeVffJWYwoqNe/irAsWrl1rAOr2xMnsPgSCqiszaoF1807iU7FSpuvSOCAbaOJXSKgJ/MBflnegCIsDb7a1W4BcwhwuMGoGl2C2vBs2YPZvqTzfnfXAGrWCbZdyCh16Dg8nZQlwRe2QwokqW+t3j1qAYfq4KVu8MLi648adRIt0=,iv:mCMQXdfVQNDgY1ZHEQGBC4YaHwkCsyo+oADMJ7p23B8=,tag:7c9VkImsgkjSxOkM1Q3qgg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 +--- +apiVersion: ENC[AES256_GCM,data:DxA=,iv:eWizGuPMW/RfEkLvL4pei42sov2EUwSDHKrtdraSxWw=,tag:E1w/dzFGqUIr+W+wY4YKNA==,type:str] +kind: ENC[AES256_GCM,data:amkGISvV,iv:13KTCVXg9EKQLfz4cCCPxfHAnPHZ0AheDmn8HIm87rw=,tag:wHfOOTJsrN2iiOTsSN507A==,type:str] +metadata: + name: ENC[AES256_GCM,data:lpkz7+GPScHzbUsBL276Gw==,iv:ce+pCqVqXZD7G6LZzFGMCK58k2icd07cE9DTJYOid5I=,tag:ug6gUmLuTkyy0eRsTGJqOw==,type:str] + namespace: ENC[AES256_GCM,data:sCqW,iv:5rvJSGBshQsjrUkizUekMpS0Fpyfkf7IcNL8aZR3lks=,tag:cFtIZO6F9eAdzE+IVv1wyg==,type:str] +type: ENC[AES256_GCM,data:aUYmzPoRlh2uDcjhZ5OD82ScAtBxd1Fm,iv:ovGv+qPiiLBC1mVSEX+QuJOkAjqPAUO/e+Nux2xuVKg=,tag:gaZwWSH7LF1FCKZr+P+R1A==,type:str] +stringData: + username: ENC[AES256_GCM,data:kvKdlAd1ox4=,iv:NcwxeRHzyRECQ7cLUwOeEiKkHMG7FhFMZRsfUfdtBmM=,tag:zfS+ZOFMHA6Q3LCkM2GSqA==,type:str] + password: ENC[AES256_GCM,data:7/ZJxWr39GrKA+i50S7wLBjt2Kaz9aG1ML44VGyRWi0=,iv:y0KlJ5ogdBDGzL6IPIjqD6Ir/S6K6v1dGTg8wxxp8n4=,tag:zwnCvi7RPqQdLJvfk69KgA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaFFueUY2MUZ1dzRkelRL + aklvRytMSVBJQjA4UXdqSjlRQUo2R0lyTTFVCktUNWl1cWttZDdVd2ZyR0lPVERj + T1ZpMkRrZGgvWFJVRnZOdlZJc3RNcTAKLS0tIHVwY0JNMXVWeTZnWW9BQnM0TCtK + bVJ0eU05N3hIT3Z6TWdSOUxxeGh1b1UKuQ23KqCTNlEk3c8gbQsFGQwkN4gkI7Z2 + HauqbNHQoU64smns+HPDoHq7z87xRlQ8c8efNpIGhfYgS/nf1eGXbg== + -----END AGE ENCRYPTED FILE----- + recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + lastmodified: "2026-07-21T06:35:41Z" + mac: ENC[AES256_GCM,data:VeVffJWYwoqNe/irAsWrl1rAOr2xMnsPgSCqiszaoF1807iU7FSpuvSOCAbaOJXSKgJ/MBflnegCIsDb7a1W4BcwhwuMGoGl2C2vBs2YPZvqTzfnfXAGrWCbZdyCh16Dg8nZQlwRe2QwokqW+t3j1qAYfq4KVu8MLi648adRIt0=,iv:mCMQXdfVQNDgY1ZHEQGBC4YaHwkCsyo+oADMJ7p23B8=,tag:7c9VkImsgkjSxOkM1Q3qgg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/data/ddb-cluster.yaml b/k8s/data/ddb-cluster.yaml index a2282a9..44af9df 100644 --- a/k8s/data/ddb-cluster.yaml +++ b/k8s/data/ddb-cluster.yaml @@ -28,6 +28,23 @@ spec: - CREATE EXTENSION IF NOT EXISTS pgcrypto; - CREATE EXTENSION IF NOT EXISTS pg_trgm; + # Per-app login roles, passwords sourced from secrets (CNPG reconciles the + # role password to match the secret). Their databases are separate Database + # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these + # roles. Replaces the old helmfile post-sync user-creation hook. + managed: + roles: + - name: authentik + ensure: present + login: true + passwordSecret: + name: authentik-db-role + - name: temporal + ensure: present + login: true + passwordSecret: + name: temporal-db-role + # Disable superuser (security) enableSuperuserAccess: false diff --git a/k8s/data/kustomization.yaml b/k8s/data/kustomization.yaml index 4defab2..8f46450 100644 --- a/k8s/data/kustomization.yaml +++ b/k8s/data/kustomization.yaml @@ -14,3 +14,7 @@ resources: - schemas.yaml - db-init-job.yaml - forgejo-database.yaml + - authentik-database.yaml + - temporal-database.yaml +# db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) — +# NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext. diff --git a/k8s/data/temporal-database.yaml b/k8s/data/temporal-database.yaml new file mode 100644 index 0000000..2559ace --- /dev/null +++ b/k8s/data/temporal-database.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: temporal + namespace: ddb +spec: + name: temporal + owner: temporal + cluster: + name: ddb-cluster