unkin-agent
7aec9a9021
**Fix-forward companion to the #457 rollback. This is NOT the current outage fix — see below.** ## The actual outage The UI is 503 because the Authentik application slug `artifactapi` **does not exist**. OIDC discovery 404s, so oauth2-proxy exits at startup, the Service has no ready endpoints, and Traefik answers `no available server`. ``` identity.unkin.net /application/o/artifactapi/… 404 identity.k8s.syd1.au.unkin.net /application/o/artifactapi/… 404 identity.unkin.net /application/o/repospawner/… 200 identity.unkin.net /application/o/argocd/… 200 ``` Root cause is upstream in **terraform-authentik**: `ci/woodpecker/push/apply` on main HEAD `4e16401` **failed**. That apply has to succeed before any argocd-apps change can help. **This PR does not fix that.** ## What this PR does fix #456 dropped the `combine-certs` initContainer and `OAUTH2_PROXY_PROVIDER_CA_FILES`, reasoning that `identity.unkin.net` serves a publicly trusted Let's Encrypt cert and so needs no internal CA. That holds for the browser redirect but not for oauth2-proxy's own back-channel discovery/token calls. artifactapi is the **only one of six** oauth2-proxies in the estate without it: | app | issuer host | `PROVIDER_CA_FILES` | |---|---|---| | arrproxy | identity.unkin.net | yes | | logviewer | identity.unkin.net | yes | | mediamark | identity.unkin.net | yes | | repospawner | identity.unkin.net | yes | | watchstate | identity.k8s… | yes | | **artifactapi** | identity.unkin.net | **no** | repospawner uses the **same public `identity.unkin.net` issuer** and still needs the internal bundle, which falsifies the removal reasoning. The existing comment on that initContainer states it plainly: *"The Authentik issuer is served behind the internal unkin.net CA."* ## Changes - Add the `combine-certs` initContainer — byte-identical to repospawner's. - Mount the combined bundle and set `OAUTH2_PROXY_PROVIDER_CA_FILES`. - Reload the Deployment when `vault-ca-cert` rotates. `vault-ca-cert` already exists in the `artifactapi` namespace (`api-deployment.yaml` uses it). `kustomize build apps/base/artifactapi` succeeds. ## Risk Trust-only and strictly additive — it appends the internal CA to the system roots. Harmless if the back channel turns out to reach a publicly trusted endpoint after all. Expected to remove the *next* blocker, surfacing as x509, once the terraform-authentik apply lands. ## Sequencing 1. Fix and re-run terraform-authentik `push/apply` so the `artifactapi` application exists. 2. Merge this. 3. Confirm `/ui/` returns 200, then close #457 unmerged. Only merge #457 instead if the UI must come back before step 1 can be done. Reviewed-on: #458 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |