Files

T

Story Crater Bot 30c5197228 docs: SSO + Storage HA completion summary

All fixes applied and tested:
- SSO: Authentik OAuth2 grant_types fixed, all 4 services working
- Storage: Longhorn distributed across 3 nodes, 3-replica HA enabled
- Documented in SSO-AND-STORAGE-HA-COMPLETE.md

2026-07-22 08:49:08 -07:00

2.3 KiB

Raw Blame History

SSO + Storage HA — Complete

What Was Fixed

1. SSO (Authentik OAuth2 for all services)

Root cause: Authentik 2026.5.5 requires explicit grant_types on OAuth2 providers. The provision script never set it → all providers had grant_types=[] → /authorize returned "Invalid grant_type for provider" → all SSO broken.

Fixed:

Updated k8s/security/iam/scripts/authentik-provision.py to set grant_types: ['authorization_code', 'refresh_token'] on create + patch
Fixed app-list idempotency bug (added superuser_full_list=true to bypass access-policy filtering)
Removed PATCH of existing applications (detail endpoint enforces policy, 404s for akadmin)
Added missing GITEA__oauth2__CLIENT_SECRET env injection to Forgejo bootstrap Application
All 4 providers (grafana, minio, forgejo, argocd) now have correct grant_types

Test: Login to any service with user rock / password UAKLX8lv0pRbMaeBh2LQDZfU

2. Storage HA (Longhorn on all 3 control-plane nodes)

Root cause: Longhorn DaemonSet had no toleration for node-role.kubernetes.io/control-plane:NoSchedule taint → only ran on talos-cp-1 → all workloads with PVCs forced to single node → no HA.

Fixed:

Created k8s/infrastructure/longhorn/longhorn-taint-toleration.yaml (Setting that adds toleration)
Created k8s/infrastructure/longhorn/longhorn-nodes.yaml (explicit Node CRDs for cp-2/cp-3, auto-discovery doesn't work with taints)
Updated StorageClass numberOfReplicas: 1→3 (true HA: each volume gets 3 copies across 3 nodes)
Removed Forgejo's nodeSelector: talos-cp-1 workaround

Verified:

Longhorn DaemonSet: 3/3 pods (one per node)
All 3 nodes show Ready: True with storage available
Forgejo pods can now schedule on any node (PVC attachments work everywhere)

Current State

✓ SSO working for all 4 services (Forgejo, Grafana, MinIO, ArgoCD)
✓ 3-node HA storage (Longhorn replicas across all control-plane nodes)
✓ All changes committed via GitOps (no manual kubectl patches retained)

Commits

be2a56c: fix provision script (grant_types + idempotency)
dde4b60: add Forgejo CLIENT_SECRET + temp nodeSelector workaround
be7881d: enable Longhorn on all 3 nodes (taint toleration + Node CRDs + 3 replicas)
6d1c055: remove Forgejo nodeSelector (no longer needed)

2.3 KiB Raw Blame History