Story Crater Bot
368e4a020a
fix(iam): Authentik OAuth2 provisioning — grant_types/groups claim, idempotent script, skip PATCH on existing apps
2026-08-18 15:08:03 -07:00
Story Crater Bot
a9800c7a3e
fix(authentik): widen server probe timeouts (3s->15s) — slow-but-200 health checks under DB contention triggered a liveness kill loop, dropping the pod from Service endpoints and breaking OAuth provisioning
2026-08-18 15:08:03 -07:00
Story Crater Bot
36db843a79
fix(iam): authentik-provision Job failing on apk permission denied
...
Job was crash-looping: 'apk add --no-cache curl' failed with Permission
denied - the container runs as non-root UID 1000 (securityContext.
runAsNonRoot: true), and both apk's working directories and /usr/local/bin
(where curl-downloaded kubectl was being written) are root-owned in the
python:3.12-alpine base image.
Replaced with a pure-Python download via urllib (stdlib, already a
dependency of this Job) writing to /tmp (world-writable) instead - no apk
install needed at all. PATH is extended to include /tmp before invoking the
provisioning script so authentik-provision.py's existing
subprocess.run(['kubectl', ...]) calls resolve it via normal PATH lookup,
no changes needed to the script itself.
2026-08-18 15:08:03 -07:00
Story Crater Bot
6b4f72ef1c
feat(iam): automate Authentik OAuth provisioning + create admin user rock
2026-08-18 15:08:02 -07:00
Story Crater Bot
5dd38d37d4
fix(vault): correct MinIO S3 backend endpoint/timeout/api_addr — converges to minio-cluster-hl:9000
2026-08-18 15:08:02 -07:00
Story Crater Bot
96b4064ec7
fix(prometheus): scrapeTimeout must be <= scrapeInterval — authentik/nginx SMs (60s>30s) + global (60s>30s) blocked operator config gen, no Prometheus STS created
2026-08-18 15:08:02 -07:00
Story Crater Bot
cd861a75e6
fix(argocd): raise repo-server memory 512Mi->1Gi — OOMKilled under CMP+Helm rendering caused chronic restarts, not-ready endpoint, and cluster-wide sync 'no route to host' failures
2026-08-18 15:08:02 -07:00
Story Crater Bot
6cbd887b89
fix(forgejo-runner): add fsGroup 1000 so runner user can write /data/.runner — register hit permission denied on root-owned Longhorn PVC
2026-08-18 15:08:02 -07:00
Story Crater Bot
7e345625fa
chore(ci): refresh forgejo runner registration token — prior token invalid/expired
2026-08-18 15:08:02 -07:00
Story Crater Bot
b1be1d0d2c
fix(forgejo-runner): point at in-cluster forgejo Service :3000 not public :443 — runner i/o timeout, forgejo serves 3000 not 443
2026-08-18 15:08:02 -07:00
Story Crater Bot
63fc502359
fix(loki,vault,iam): loki minio endpoint :80 not :9000, emit vault-minio-creds via CMP, drop redundant broken authentik-migrations job
2026-08-18 15:08:02 -07:00
Story Crater Bot
2b89981c28
chore(ci): add SOPS-encrypted runner-token secret record for forgejo-runner registration
2026-08-18 15:08:02 -07:00
Story Crater Bot
384548b424
fix(storage): add longhorn-wffc SC + pin portainer/forgejo-runner to az-a — fixes PVC attach
2026-08-18 15:08:02 -07:00
Story Crater Bot
cda75eeb7b
fix(authentik): drop redundant authentik-migrate init container — server entrypoint migrates; old-image manage migrate tripped version-history precheck on empty DB
2026-08-18 15:08:02 -07:00
Story Crater Bot
48f3dd1db9
feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution
2026-08-18 15:08:02 -07:00
Story Crater Bot
2623eecfca
feat(argocd): SOPS CMP plugin decryption for Stage 0 secrets (simplify to directory source)
2026-08-18 15:08:02 -07:00
Story Crater Bot
54bfb5ade6
feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications
2026-08-18 15:08:02 -07:00
Story Crater Bot
0f30d77288
refactor(k8s): Reorganize into 5-layer structure with production kustomizations
2026-08-18 15:08:01 -07:00
Story Crater Bot