Story Crater Bot
89f01b6f2e
Adds permissions claim + per-service admin groups in Authentik, scoped Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.
18 lines
550 B
YAML
18 lines
550 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: paperless
|
|
resources:
|
|
- pvc.yaml
|
|
- configmap.yaml
|
|
- redis.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- ingress.yaml
|
|
- backup-cronjob.yaml
|
|
- adapter-configmap.yaml
|
|
- rbac.yaml
|
|
# postgres: paperless-db CNPG Cluster, deployed by k8s/infra/databases (wave 2,
|
|
# before this app at wave 8) - not duplicated here. Same for the paperless-oidc
|
|
# and paperless-minio-creds Secrets, written by PostSync provisioning Jobs in
|
|
# k8s/infra/iam and k8s/infra/minio respectively.
|