Story Crater Bot
5ce0b92186
authentik/temporal DB users+databases were never provisioned (old helmfile hook gone; db-init-job only made schemas in shared app DB). Adds managed.roles (authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs (dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in kustomize resources so data-schemas app doesn't choke on ciphertext.
21 lines
647 B
YAML
21 lines
647 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: data
|
|
|
|
# Layer 6: Data — stateful services (databases, message brokers)
|
|
# Dependencies: all previous layers (bootstrap, platform, etc.)
|
|
# Order: Applied last
|
|
|
|
# PostgreSQL cluster + schema initialization
|
|
# Required by: Authentik, Temporal, Vault, SQS
|
|
resources:
|
|
- ddb-cluster.yaml
|
|
- schemas.yaml
|
|
- db-init-job.yaml
|
|
- forgejo-database.yaml
|
|
- authentik-database.yaml
|
|
- temporal-database.yaml
|
|
# db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
|
|
# NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.
|