Story Crater Bot
86f94f96fd
Adds Homarr landing page with Authentik SSO: - k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr chart from homarr-labs + in-repo values), ns dashboard, wave 8 - k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000 - k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com to ingress controller - k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES (generates OAuth provider/app + homarr-oidc secret with client-id/secret) - k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner SA access to dashboard ns for secret management - k8s/security/iam/kustomization.yaml: includes new RoleBinding Homarr now fully wired: - Ingress: https://homarr.riotpiao.com - SSO: redirects to Authentik, login as rock - Persistence: 5Gi RWO on longhorn-wffc (3-replica HA) - Tile config: UI-managed (saved to PVC)
37 lines
1.8 KiB
YAML
37 lines
1.8 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# NOTE: no top-level `namespace:` transformer here (removed) - it used to
|
|
# force-rewrite metadata.namespace to "iam" on every resource in this
|
|
# kustomization, which was harmless while every manifest here only ever
|
|
# targeted the iam namespace itself. authentik-provision-job.yaml's
|
|
# RoleBindings deliberately target cicd/argocd/logging/storage (least-
|
|
# privilege access for the authentik-provisioner ServiceAccount to touch
|
|
# Secrets in those namespaces) - the namespace transformer would have
|
|
# silently rewritten all of them back to iam, breaking the RBAC. Every
|
|
# manifest in this directory already sets its own explicit
|
|
# metadata.namespace, so dropping the transformer changes nothing for the
|
|
# existing resources/.
|
|
resources:
|
|
- key-rotation-cronjob.yaml
|
|
- authentik-provision-job.yaml
|
|
- rbac-dashboard-rolebinding.yaml
|
|
|
|
# Provisioning/verification python lives in scripts/*.py (real files, linted +
|
|
# diff-friendly) and is generated into ConfigMaps here rather than embedded in
|
|
# the job YAML. disableNameSuffixHash keeps the names stable so the Jobs'
|
|
# configMap volume refs and PostSync hook-delete semantics keep working; each
|
|
# hook Job is recreated per sync so it always mounts the latest script.
|
|
configMapGenerator:
|
|
- name: authentik-provision-script
|
|
namespace: iam
|
|
files:
|
|
- authentik-provision.py=scripts/authentik-provision.py
|
|
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|
|
# authentik-migrations-job.yaml removed — redundant + broken. The authentik
|
|
# `server` entrypoint runs migrations itself; this standalone job lacked the
|
|
# authentik-secrets envFrom (Secret key missing) and always failed.
|
|
# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time
|
|
# authentik/vault deployed via ArgoCD Helm source
|