mediamark: deploy the media marking app (#441)

## Why mediamark needs a home in the cluster: it marks/organises media on the shared mediastore tree and drives the adult-tier sonarr/radarr through arrproxy's hash routes. This adds the full app to the `media` project, mirroring the watchstate two-host oauth2-proxy pattern and the arrstack static-CephFS + projected-API-keys patterns. ## How - Adds `apps/base/mediamark/`: namespace, VaultAuth (`k8s/au/syd1`, role `default`), three VaultStaticSecrets, static mediastore PV/PVC, the app Deployment, oauth2-proxy ConfigMap/Deployment, two Services, and internal + external Gateway/HTTPRoute pairs. - Binds a dedicated static PV (`mediamark-mediastore`, own `volumeHandle`, `claimRef`-pinned) to the same CephFS mediastore subvolume arrstack/fafflix/cheeztv use, RWX 10Ti Retain, mounted at `/media`. - Runs the app as 1000:1000 (deliberately not 65532) so it owns files on the shared media tree and hardlink/rename moves stay valid; read-only root filesystem, all caps dropped, no service-account token, `/livez` + `/readyz` probes. - Projects the sonarr/radarr API keys as one file per app under `/etc/mediamark/keys`, mirroring arrproxy's keys projection, with reloader annotations on both secrets. - Fronts both `mediamark.unkin.net` (traefik-external, reflected Let's Encrypt wildcard, no cert-manager annotations) and `mediamark.k8s.syd1.au.unkin.net` (traefik-internal, vault-issuer) with a single oauth2-proxy using a relative `/oauth2/callback` redirect; gated on `akP-mediamark-user` and passing identity to the app as `X-Forwarded-Groups` via `PASS_USER_HEADERS`. - Appends `mediamark` to the `wildcard-unkin-net` Certificate's two reflector namespace lists, and registers the app in `argocd/applicationsets/media.yaml` + `argocd/projects/media.yaml` with a passthrough `apps/overlays/au-syd1/mediamark` overlay. ## Prerequisite seeds (Ben, before pods go Ready) These KV paths must exist under `kv/kubernetes/namespace/mediamark/default/` — the `mediamark/default` templated policy already grants read, so no terraform-vault change is needed: - `oauth-credentials` — needs `client_id` and `cookie_secret` added alongside the existing `client_secret` (Authentik mediamark provider; both absolute callback URIs registered there). - `sonarr` — key `apitoken`. - `radarr` — key `apitoken`. ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/mediamark` (18 resources) and `.../cert-manager` both build. - kubeconform clean on both touched overlays. - `pre-commit run --all-files` passes. Reviewed-on: #441 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2026-08-30 15:07:41 +10:00
parent 221c575a44
commit b355d6aafb
19 changed files with 673 additions and 2 deletions
@@ -14,9 +14,9 @@ spec:
  secretTemplate:
    annotations:
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark"
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark"
  privateKey:
    size: 4096
  dnsNames:
@@ -0,0 +1,114 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mediamark
+  namespace: mediamark
+  annotations:
+    secret.reloader.stakater.com/reload: "arrstack-virtual-key"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mediamark
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mediamark
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        # 1000:1000 matches the media tree ownership on the shared mediastore
+        # subvolume; mediamark hardlinks/renames files the *arr apps own, so it
+        # deliberately does NOT run as the usual 65532.
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mediamark
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: MEDIAMARK_MEDIA_ROOT
+              value: /media
+            - name: MEDIAMARK_KEYS_DIR
+              value: /etc/mediamark/keys
+            # Virtual keys are only honoured by arrproxy, which validates the
+            # machine token and injects the real per-app key upstream; the
+            # sonarr/radarr Services would reject them.
+            - name: MEDIAMARK_SONARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/sonarr
+            - name: MEDIAMARK_RADARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/radarr
+            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
+            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
+            # auth_request-response-only and never reaches a proxied upstream.
+            - name: MEDIAMARK_GROUPS_HEADER
+              value: X-Forwarded-Groups
+            - name: MEDIAMARK_ALLOWED_GROUPS
+              value: akP-mediamark-user
+          volumeMounts:
+            - name: mediastore
+              mountPath: /media
+            - name: arr-keys
+              mountPath: /etc/mediamark/keys
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: mediastore
+          persistentVolumeClaim:
+            claimName: mediamark-mediastore
+        # One ephemeral virtual key covers both apps, so the same token lands on
+        # both per-app files under MEDIAMARK_KEYS_DIR; mediamark re-reads the
+        # file per request, so lease renewal rotates in place.
+        - name: arr-keys
+          projected:
+            sources:
+              - secret:
+                  name: arrstack-virtual-key
+                  items:
+                    - key: token
+                      path: sonarr
+                    - key: token
+                      path: radarr
+      restartPolicy: Always
@@ -0,0 +1,39 @@
+---
+# External (DMZ) front for mediamark on mediamark.unkin.net via the external
+# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt
+# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
+# reflector), so there is no cert-manager annotation here. The apex
+# mediamark.unkin.net A record lives in the bind-operator unkin.net zone, NOT
+# external-dns, so no external-dns annotation either. oauth2-proxy fronts both
+# hostnames.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: mediamark-external
+  namespace: mediamark
+spec:
+  gatewayClassName: traefik-external
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: mediamark.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: mediamark.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: wildcard-unkin-net-tls
@@ -0,0 +1,38 @@
+---
+# Internal front for mediamark (cf. watchstate).
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: mediamark.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: mediamark.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: mediamark
+  namespace: mediamark
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mediamark.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mediamark.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: mediamark-tls
+        mode: Terminate
@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-external-http-redirect
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark-external
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-external
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark-external
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: mediamark-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark-http-redirect
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mediamark
+  namespace: mediamark
+spec:
+  hostnames:
+    - mediamark.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: mediamark
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: mediamark-oauth2
+          port: 4180
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - vaultdynamicsecret.yaml
+  - pv-mediastore.yaml
+  - pvc-mediastore.yaml
+  - deployment.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
+  - service.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - gateway-external.yaml
+  - httproute-external.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: mediamark
+  name: mediamark
@@ -0,0 +1,45 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
+# from the oauth-credentials Secret). Single auth front for mediamark on both
+# host names; access is gated here on the akP-mediamark-user Authentik group and
+# re-checked by the app from X-Forwarded-Groups.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mediamark-oauth2-env
+  namespace: mediamark
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/mediamark/"
+  # Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
+  # derives scheme+host per request from X-Forwarded-Proto/Host, so the same
+  # deployment serves BOTH the external mediamark.unkin.net and internal
+  # mediamark.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
+  # registered on the Authentik provider (terraform-authentik, separate PR).
+  OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
+  OAUTH2_PROXY_UPSTREAMS: "http://mediamark.mediamark.svc.cluster.local:8080/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
+  # then emits it as a single comma-joined X-Forwarded-Groups header.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-mediamark-user"
+  # Forward identity + groups to mediamark as X-Forwarded-{User,Email,Groups}.
+  # NOTE: set-xauthrequest is intentionally NOT set -- it only populates
+  # auth_request *response* headers, which never reach a proxied upstream.
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  # Authentik hardcodes email_verified=false in the id_token; authorization is
+  # enforced via ak_groups, so accepting the unverified email is safe.
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  # One cookie domain per host (a single parent-domain cookie can't span
+  # unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
+  # matching the request host. Whitelist both so post-auth `rd` redirects to
+  # either front door are honoured.
+  OAUTH2_PROXY_COOKIE_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "mediamark.unkin.net,mediamark.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
@@ -0,0 +1,133 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mediamark-oauth2
+  namespace: mediamark
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mediamark-oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mediamark-oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: mediamark-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always
@@ -0,0 +1,32 @@
+---
+# Static PV for the shared MEDIASTORE CephFS subvolume, same rootPath as the
+# arrstack/fafflix/cheeztv mediastore PVs. Each namespace gets its own PV
+# (unique name + volumeHandle) pinned by claimRef; mediamark reads and rewrites
+# the same library tree the *arr apps import into, so it must be the same
+# filesystem (hardlink-safe).
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mediamark-mediastore
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: mediamark
+    name: mediamark-mediastore
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: mediamark-mediastore-static
+    nodeStageSecretRef:
+      name: csi-cephfs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: cephfs
+      rootPath: /volumes/csi_ssd_ec_4_1/mediastore/a0152dac-a51b-4b95-ac5e-ecdd99bfe3f1
@@ -0,0 +1,20 @@
+---
+# Statically bound to the mediamark-mediastore PV; storageClassName "" +
+# volumeName disables dynamic provisioning. Not backed up here -- the media tree
+# is backed up once from arrstack.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediamark-mediastore
+  namespace: mediamark
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: mediamark-mediastore
+  volumeMode: Filesystem
@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mediamark
+  namespace: mediamark
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: mediamark
+  sessionAffinity: None
+  type: ClusterIP
+---
+# Front-door entry Service: both HTTPRoutes target this; all traffic enters via
+# oauth2-proxy.
+apiVersion: v1
+kind: Service
+metadata:
+  name: mediamark-oauth2
+  namespace: mediamark
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 4180
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: mediamark-oauth2
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,38 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: mediamark
+spec:
+  allowedNamespaces:
+    - mediamark
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+---
+# Separate auth for the arrstack secrets engine: the `mediamark` k8s role is the
+# only one whose policy grants arrstack/creds/mediamark.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: arrstack-creds
+  namespace: mediamark
+spec:
+  allowedNamespaces:
+    - mediamark
+  kubernetes:
+    audiences:
+      - vault
+    role: mediamark
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,21 @@
+---
+# Ephemeral arrstack virtual key. The engine mints one machine token covering
+# both radarr and sonarr; it is only honoured by arrproxy, which validates it and
+# swaps in the real per-app key upstream. Role ttl is 60s, so VSO renews the
+# lease continuously (renewalPercent default 67) and rewrites the secret; the
+# reloader annotation restarts pods when the token actually changes.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: arrstack-virtual-key
+  namespace: mediamark
+spec:
+  allowStaticCreds: false
+  destination:
+    create: true
+    name: arrstack-virtual-key
+    overwrite: true
+  mount: arrstack
+  path: creds/mediamark
+  revoke: true
+  vaultAuthRef: arrstack-creds
@@ -0,0 +1,22 @@
+---
+# Authentik OIDC client for the mediamark front door (client_id, client_secret,
+# cookie_secret) at kv/kubernetes/namespace/mediamark/default/oauth-credentials.
+# The default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
+# terraform-vault change is needed.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: mediamark
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mediamark/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/mediamark