rock 20513c8b3b iam: add memory scope, service accounts, manual provisioning ...

- Add 'memory' scope property mapping (memory_projects, memory_visibility, memory_role)
- Add capability groups: llm-users, memory-users, memory-writers
- Add service account provisioning for portfolio-agent, memory-agent
- Fix sops-secrets kustomization (generatorOptions)
- Add RoleBindings for portfolio, poimen, dashboard namespaces
- Remove PostSync hook - IAM provisioning is now manual-only

2026-09-03 18:07:22 -07:00

..

_deferred-values-fragments

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

agent-pod-models.enc.yaml

pi-models: fix baseUrl to match homelab-frontend gateway contract

2026-08-20 00:26:52 -07:00

agent-pod-ssh-key.enc.yaml

fix(agent-pod): remote tui session for multi-agent

2026-08-18 15:08:04 -07:00

authentik-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

cloudflare-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

forgejo-registry-pat.enc.yaml

Add Forgejo registry PAT secret (encrypted with SOPS, ksops managed)

2026-08-23 16:15:26 -07:00

forgejo-registry-pull.enc.yaml

feat: let the runner build and the cluster pull from the Forgejo registry

2026-08-19 21:48:01 -07:00

forgejo-registry-token.enc.yaml

Add Poimen Memory to ArgoCD wave 2 deployment (namespace: poimen)

2026-08-22 23:09:02 -07:00

forgejo-runner-token.enc.yaml

feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1

2026-08-18 15:08:04 -07:00

forgejo-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

grafana-oidc-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

grafana-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homarr-auth-oidc.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-db-encryption.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homelab-ca-secrets.enc.yaml

fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert

2026-08-18 15:08:04 -07:00

kustomization.yaml

iam: add memory scope, service accounts, manual provisioning

2026-09-03 18:07:22 -07:00

loki-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

minio-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

paperless-secrets.enc.yaml

feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

2026-08-25 11:11:37 -07:00

portfolio-secrets.enc.env

feat: add portfolio LLM_API_TOKEN to ksops secrets

2026-09-01 09:42:02 -07:00

portfolio-secrets.enc.yaml

feat: add portfolio SOPS secret for CI status

2026-08-31 22:33:00 -07:00

secret-generator.yaml

feat: add portfolio SOPS secret for CI status

2026-08-31 22:33:00 -07:00

vault-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

vault-unseal-keys.enc.yaml

fix: rotate vault unseal keys after vault-0 wipe/reinit

2026-08-26 16:33:35 -07:00