Story Crater Bot
89f01b6f2e
Adds permissions claim + per-service admin groups in Authentik, scoped Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# Scoped operator access for grafana-admins: dashboards + admin creds only.
|
|
# grafana-oidc (client secret) stays excluded - editing it is a security
|
|
# change, not app config. Inert until kube-apiserver's OIDC wiring lands.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: grafana-operator
|
|
namespace: logging
|
|
rules:
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
resourceNames: ["grafana"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
resourceNames: ["grafana-dashboards-default", "grafana-config-dashboards"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["grafana-admin"]
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: grafana-admins-binding
|
|
namespace: logging
|
|
subjects:
|
|
- kind: Group
|
|
name: "oidc:grafana-admins"
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: Role
|
|
name: grafana-operator
|
|
apiGroup: rbac.authorization.k8s.io
|