unkin-agent
7db66455c9
Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app, fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern. - ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete RWO PVC at /config (sqlite + in-container cron/redis are single-writer). - oauth2-proxy fronts every path; Authentik OIDC issuer identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist. - Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net, vault-issuer TLS leaf, external-dns to 198.18.200.4. - VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects. - Registered in the media ApplicationSet + AppProject. No VMPodScrape: WatchState exposes no /metrics endpoint.
22 lines
648 B
YAML
22 lines
648 B
YAML
---
|
|
# Authentik OIDC client for watchstate (client_id, client_secret, cookie_secret)
|
|
# seeded at kv/kubernetes/namespace/watchstate/default/oauth-credentials; the
|
|
# watchstate/default templated policy grants read, so no terraform-vault change
|
|
# is needed.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: watchstate-oauth-credentials
|
|
namespace: watchstate
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: watchstate-oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/watchstate/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|