Story Crater Bot 68107ba962 fix(authentik): use 'app' database credentials from CNPG (GitOps) ...

GITOPS FIX: Permanent solution for database credentials

CHANGES:
  1. authentik-values.yaml:
     - postgresql.user: authentik → app
     - env vars reference ddb-cluster-app secret (via secretKeyRef)
     - Both server + worker containers updated

  2. sync-db-credentials-job.yaml (PostSync):
     - Copies ddb-cluster-app from ddb → iam namespace
     - Allows secretKeyRef to work (no cross-namespace support)
     - Runs after every iam-jobs sync

  3. kustomization.yaml:
     - Added sync-db-credentials-job to resources

REPLACES:
  - Manual kubectl patch of authentik-secrets
  - SOPS-encrypted per-app credentials
  - Complex permission grants

BENEFITS:
  ✅ ArgoCD won't revert changes (in git)
  ✅ Follows CNPG simple pattern (app user)
  ✅ Single source of truth (ddb-cluster-app)
  ✅ Auto-syncs on every deploy

Deployed by: iam-jobs Application (wave 3)

2026-07-23 10:05:37 -07:00

..

ci-cd

fix(forgejo): rebuild with local storage (single pod, no Longhorn)

2026-07-22 13:26:55 -07:00

iam

fix(authentik): use 'app' database credentials from CNPG (GitOps)

2026-07-23 10:05:37 -07:00

sops-secrets

refactor(argocd): simplify secrets approach — use directory source, manual Secrets for Stage 0

2026-07-20 11:49:23 -07:00

kustomization.yaml

refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00