3 Commits

Include renames

Author	SHA1	Message	Date
rock	19cf9277d9	fix: add admin-oidc-binding to kustomization resources ... - admin-oidc-binding.yaml wasn't listed in resources - Now kustomize will include it when building manifests - ArgoCD can sync the OIDC group binding	2026-09-05 14:42:17 -07:00
Story Crater Bot	6c758e3606	feat: add poimen-memory-admins group/permissions and k8s RBAC role ... Follows the portainer/kmsvc/temporal pattern - group + "permissions" claim entry only, no Authentik Application/OAuth provider, since poimen-memory is an internal API-key service, not browser OIDC login. rock gets it automatically (already in every service_admin_group).	2026-08-25 21:50:05 -07:00
Story Crater Bot	89f01b6f2e	feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring ... Adds permissions claim + per-service admin groups in Authentik, scoped Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.	2026-08-25 15:03:44 -07:00