101 lines
2.7 KiB
YAML
101 lines
2.7 KiB
YAML
# ArgoCD Hook Jobs for Phase 3 (IAM only)
|
|
|
|
---
|
|
# ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────
|
|
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: authentik-ca-setup
|
|
namespace: iam
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
spec:
|
|
serviceAccountName: phase3-setup
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: ca-setup
|
|
image: bitnami/kubectl:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
echo "Setting up CA ConfigMap for Authentik..."
|
|
CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
|
|
-o jsonpath='{.data.tls\.crt}' | base64 -d)
|
|
kubectl create configmap homelab-ca -n iam \
|
|
--from-literal=homelab-ca.crt="$CA_PEM" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
echo "✓ CA ConfigMap created"
|
|
|
|
---
|
|
# ── Authentik — PostSync: OIDC Provisioning ──────────────────────────────────
|
|
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: authentik-oidc-provision
|
|
namespace: iam
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
spec:
|
|
serviceAccountName: phase3-setup
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: oidc-provision
|
|
image: bitnami/kubectl:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
echo "Waiting for Authentik server..."
|
|
kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true
|
|
echo "✓ Authentik ready"
|
|
|
|
---
|
|
# ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────
|
|
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: phase3-setup
|
|
namespace: iam
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: phase3-setup
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets", "configmaps"]
|
|
verbs: ["get", "list", "create", "apply", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list", "create"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["list", "get"]
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: phase3-setup
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: phase3-setup
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: phase3-setup
|
|
namespace: iam
|