Story Crater Bot
68107ba962
fix(authentik): use 'app' database credentials from CNPG (GitOps)
...
GITOPS FIX: Permanent solution for database credentials
CHANGES:
1. authentik-values.yaml:
- postgresql.user: authentik → app
- env vars reference ddb-cluster-app secret (via secretKeyRef)
- Both server + worker containers updated
2. sync-db-credentials-job.yaml (PostSync):
- Copies ddb-cluster-app from ddb → iam namespace
- Allows secretKeyRef to work (no cross-namespace support)
- Runs after every iam-jobs sync
3. kustomization.yaml:
- Added sync-db-credentials-job to resources
REPLACES:
- Manual kubectl patch of authentik-secrets
- SOPS-encrypted per-app credentials
- Complex permission grants
BENEFITS:
✅ ArgoCD won't revert changes (in git)
✅ Follows CNPG simple pattern (app user)
✅ Single source of truth (ddb-cluster-app)
✅ Auto-syncs on every deploy
Deployed by: iam-jobs Application (wave 3)
2026-07-23 10:05:37 -07:00
Story Crater Bot
14a17b4542
fix(authentik): increase startup probe timeout for migrations
...
Fresh authentik deployment runs ~100 database migrations which takes 15-20
minutes. Previous startup probe failureThreshold of 60 (10 minutes) killed
the pod before migrations could complete, causing infinite restart loop.
Increased to 120 failures (20 minutes) to allow migrations to finish.
Fixes: nginx 503 due to pod never becoming Ready.
2026-07-23 09:47:50 -07:00
Story Crater Bot
1361c9bd13
fix(authentik): widen server probe timeouts (3s->15s) — slow-but-200 health checks under DB contention triggered a liveness kill loop, dropping the pod from Service endpoints and breaking OAuth provisioning
2026-07-21 22:31:48 -07:00
Story Crater Bot
3e7238f71c
fix(prometheus): scrapeTimeout must be <= scrapeInterval — authentik/nginx SMs (60s>30s) + global (60s>30s) blocked operator config gen, no Prometheus STS created
2026-07-21 11:08:23 -07:00
Story Crater Bot
9117fd777a
fix(authentik): drop redundant authentik-migrate init container — server entrypoint migrates; old-image manage migrate tripped version-history precheck on empty DB
2026-07-20 23:40:08 -07:00
Story Crater Bot
2ec6eba9d2
fix(sops-cmp): correct loki s3 path (.loki.storage.s3), emit authentik-secrets separately, drop broken discover — merge via server/worker/migrate envFrom
...
Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate
authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it
via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository
timeouts; app names the plugin explicitly).
2026-07-20 22:55:23 -07:00
Story Crater Bot
578a707867
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
2026-07-19 09:29:17 -07:00
Story Crater Bot
2d7330798b
refactor(k8s): Reorganize into 5-layer structure with production kustomizations
2026-07-16 14:28:19 -07:00
Story Crater Bot