Story Crater Bot
68107ba962
GITOPS FIX: Permanent solution for database credentials
CHANGES:
1. authentik-values.yaml:
- postgresql.user: authentik → app
- env vars reference ddb-cluster-app secret (via secretKeyRef)
- Both server + worker containers updated
2. sync-db-credentials-job.yaml (PostSync):
- Copies ddb-cluster-app from ddb → iam namespace
- Allows secretKeyRef to work (no cross-namespace support)
- Runs after every iam-jobs sync
3. kustomization.yaml:
- Added sync-db-credentials-job to resources
REPLACES:
- Manual kubectl patch of authentik-secrets
- SOPS-encrypted per-app credentials
- Complex permission grants
BENEFITS:
✅ ArgoCD won't revert changes (in git)
✅ Follows CNPG simple pattern (app user)
✅ Single source of truth (ddb-cluster-app)
✅ Auto-syncs on every deploy
Deployed by: iam-jobs Application (wave 3)
61 lines
1.6 KiB
YAML
61 lines
1.6 KiB
YAML
# PostSync Job to copy ddb-cluster-app credentials to iam namespace
|
|
# Allows authentik to reference 'app' user credentials locally
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sync-db-credentials
|
|
namespace: iam
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: secret-copier
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create", "update", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: sync-db-credentials
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sync-db-credentials
|
|
namespace: iam
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: secret-copier
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: sync-db-credentials
|
|
namespace: iam
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: sync-db-credentials
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: copy-secret
|
|
image: alpine/k8s:1.30.3
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Copying ddb-cluster-app secret from ddb to iam namespace..."
|
|
|
|
# Get secret from ddb namespace
|
|
kubectl get secret ddb-cluster-app -n ddb -o json | \
|
|
jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.ownerReferences) | .metadata.namespace="iam"' | \
|
|
kubectl apply -f -
|
|
|
|
echo "Secret copied successfully"
|