Story Crater Bot
31582b21c8
All fixes applied and tested: - SSO: Authentik OAuth2 grant_types fixed, all 4 services working - Storage: Longhorn distributed across 3 nodes, 3-replica HA enabled - Documented in SSO-AND-STORAGE-HA-COMPLETE.md
41 lines
2.3 KiB
Markdown
41 lines
2.3 KiB
Markdown
# SSO + Storage HA — Complete
|
|
|
|
## What Was Fixed
|
|
|
|
### 1. SSO (Authentik OAuth2 for all services)
|
|
**Root cause:** Authentik 2026.5.5 requires explicit `grant_types` on OAuth2 providers. The provision script never set it → all providers had `grant_types=[]` → `/authorize` returned "Invalid grant_type for provider" → all SSO broken.
|
|
|
|
**Fixed:**
|
|
- Updated `k8s/security/iam/scripts/authentik-provision.py` to set `grant_types: ['authorization_code', 'refresh_token']` on create + patch
|
|
- Fixed app-list idempotency bug (added `superuser_full_list=true` to bypass access-policy filtering)
|
|
- Removed PATCH of existing applications (detail endpoint enforces policy, 404s for akadmin)
|
|
- Added missing `GITEA__oauth2__CLIENT_SECRET` env injection to Forgejo bootstrap Application
|
|
- All 4 providers (grafana, minio, forgejo, argocd) now have correct grant_types
|
|
|
|
**Test:** Login to any service with user `rock` / password `UAKLX8lv0pRbMaeBh2LQDZfU`
|
|
|
|
### 2. Storage HA (Longhorn on all 3 control-plane nodes)
|
|
**Root cause:** Longhorn DaemonSet had no toleration for `node-role.kubernetes.io/control-plane:NoSchedule` taint → only ran on talos-cp-1 → all workloads with PVCs forced to single node → no HA.
|
|
|
|
**Fixed:**
|
|
- Created `k8s/infrastructure/longhorn/longhorn-taint-toleration.yaml` (Setting that adds toleration)
|
|
- Created `k8s/infrastructure/longhorn/longhorn-nodes.yaml` (explicit Node CRDs for cp-2/cp-3, auto-discovery doesn't work with taints)
|
|
- Updated StorageClass `numberOfReplicas: 1→3` (true HA: each volume gets 3 copies across 3 nodes)
|
|
- Removed Forgejo's `nodeSelector: talos-cp-1` workaround
|
|
|
|
**Verified:**
|
|
- Longhorn DaemonSet: 3/3 pods (one per node)
|
|
- All 3 nodes show `Ready: True` with storage available
|
|
- Forgejo pods can now schedule on any node (PVC attachments work everywhere)
|
|
|
|
## Current State
|
|
- ✓ SSO working for all 4 services (Forgejo, Grafana, MinIO, ArgoCD)
|
|
- ✓ 3-node HA storage (Longhorn replicas across all control-plane nodes)
|
|
- ✓ All changes committed via GitOps (no manual kubectl patches retained)
|
|
|
|
## Commits
|
|
- `be2a56c`: fix provision script (grant_types + idempotency)
|
|
- `dde4b60`: add Forgejo CLIENT_SECRET + temp nodeSelector workaround
|
|
- `be7881d`: enable Longhorn on all 3 nodes (taint toleration + Node CRDs + 3 replicas)
|
|
- `6d1c055`: remove Forgejo nodeSelector (no longer needed)
|