Story Crater Bot
674c8f0d66
- PostgreSQL 3-replica HA with pgvector - Vault S3 storage backend (MinIO) - Authentik federated OIDC provider - Vault auto-unseal via postStart hook
53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
# Rotates the Authentik OIDC signing key quarterly for all homelab providers.
|
|
#
|
|
# Prerequisites (run once):
|
|
# # 1. ConfigMap from the Rust source file
|
|
# kubectl create configmap key-rotation-script \
|
|
# --from-file=rotate_key.rs=key_rotate.rs \
|
|
# -n iam --dry-run=client -o yaml | kubectl apply -f -
|
|
#
|
|
# # 2. Token secret — fill in your value, never commit it
|
|
# kubectl create secret generic authentik-key-rotation-token \
|
|
# --from-literal=AUTHENTIK_BOOTSTRAP_TOKEN="${AUTHENTIK_BOOTSTRAP_TOKEN}" \
|
|
# -n iam --dry-run=client -o yaml | kubectl apply -f -
|
|
#
|
|
# Apply: kubectl apply -f key-rotation-cronjob.yaml
|
|
# Test: kubectl create job --from=cronjob/authentik-key-rotation test-rotation -n iam
|
|
# Logs: kubectl logs -n iam -l job-name=test-rotation -f
|
|
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: authentik-key-rotation
|
|
namespace: iam
|
|
spec:
|
|
schedule: "0 0 1 */3 *" # 00:00 UTC on the 1st of Jan, Apr, Jul, Oct
|
|
concurrencyPolicy: Forbid # skip if a previous job is still running
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
volumes:
|
|
- name: script
|
|
configMap:
|
|
name: key-rotation-script
|
|
containers:
|
|
- name: rotate
|
|
image: rust:1.82-slim
|
|
command:
|
|
- sh
|
|
- -c
|
|
- rustc /scripts/rotate_key.rs -o /tmp/rotate_key && /tmp/rotate_key
|
|
volumeMounts:
|
|
- name: script
|
|
mountPath: /scripts
|
|
env:
|
|
- name: AUTHENTIK_BASE_URL
|
|
value: "http://authentik-server.iam.svc.cluster.local"
|
|
- name: AUTHENTIK_BOOTSTRAP_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-key-rotation-token
|
|
key: AUTHENTIK_BOOTSTRAP_TOKEN
|