homelab

Files

T

Story Crater Bot 68107ba962 fix(authentik): use 'app' database credentials from CNPG (GitOps)

GITOPS FIX: Permanent solution for database credentials

CHANGES:
  1. authentik-values.yaml:
     - postgresql.user: authentik → app
     - env vars reference ddb-cluster-app secret (via secretKeyRef)
     - Both server + worker containers updated

  2. sync-db-credentials-job.yaml (PostSync):
     - Copies ddb-cluster-app from ddb → iam namespace
     - Allows secretKeyRef to work (no cross-namespace support)
     - Runs after every iam-jobs sync

  3. kustomization.yaml:
     - Added sync-db-credentials-job to resources

REPLACES:
  - Manual kubectl patch of authentik-secrets
  - SOPS-encrypted per-app credentials
  - Complex permission grants

BENEFITS:
  ✅ ArgoCD won't revert changes (in git)
  ✅ Follows CNPG simple pattern (app user)
  ✅ Single source of truth (ddb-cluster-app)
  ✅ Auto-syncs on every deploy

Deployed by: iam-jobs Application (wave 3)

2026-07-23 10:05:37 -07:00

applications

fix(storage): consolidate longhorn-kafka → unified longhorn StorageClass

2026-07-23 09:09:44 -07:00

argocd

refactor(argocd): consolidate Applications (39→35)

2026-07-23 07:29:51 -07:00

bootstrap

fix(ingress): add service alias for CoreDNS compatibility

2026-07-23 07:45:23 -07:00

bootstrap-local

fix(storage): add PodSecurity privileged labels for minio