unkinben
dfb495d771
Authentik is canonical at https://identity.unkin.net, served by the internal unkin.net CA. Grafana, LiteLLM and NetBox failed OIDC discovery because their images don't trust that CA (x509: unknown authority); NetBox also still pointed at the secondary admin host. - grafana: mount the reflected vault-ca-cert; set generic_oauth `tls_client_ca`. - litellm: `combine-certs` init builds public+internal CA bundle; `SSL_CERT_FILE` + `REQUESTS_CA_BUNDLE` point at it. - netbox: flip OIDC issuer to identity.unkin.net; same combine bundle for python-social-auth (`requests`). - docs: record the Rancher manual runtime step (issuer + CA in the auth config). Validated: kustomize build + kubeconform + pre-commit. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: #314 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
140 lines
4.0 KiB
YAML
140 lines
4.0 KiB
YAML
---
|
|
# NetBox (netbox-community chart 8.3.40, appVersion v4.6.5).
|
|
# Postgres = external CNPG cluster, Valkey = standalone Deployment, both defined
|
|
# in apps/base/netbox. Secrets come from Vault via VSO (see base/vaultstaticsecret.yaml).
|
|
|
|
image:
|
|
# ghcr.io is mirrored through artifactapi at the containerd level; the pull is
|
|
# gated by the ^netbox-community/ allowlist added in terraform-artifactapi.
|
|
# tag defaults to the chart appVersion (v4.6.5).
|
|
registry: ghcr.io
|
|
repository: netbox-community/netbox
|
|
|
|
# Two web replicas for zero-downtime rollouts (media is RWX, see below).
|
|
replicaCount: 2
|
|
|
|
# Django SECRET_KEY — existingSecret must contain key: secret_key.
|
|
existingSecret: netbox-secret-key
|
|
|
|
# Bootstrap superuser — existingSecret keys: username, password, email, api_token.
|
|
superuser:
|
|
existingSecret: netbox-superuser
|
|
|
|
# Disable the bundled Bitnami subcharts; we bring our own Postgres and Valkey.
|
|
postgresql:
|
|
enabled: false
|
|
valkey:
|
|
enabled: false
|
|
|
|
# External Postgres = the CNPG cluster's pgbouncer pooler (session mode).
|
|
externalDatabase:
|
|
host: netbox-postgres-pooler-rw
|
|
port: 5432
|
|
database: netbox
|
|
username: netbox
|
|
existingSecretName: postgres-credentials
|
|
existingSecretKey: password
|
|
disableServerSideCursors: false
|
|
|
|
# External Valkey — one instance, DB 0 = RQ task queue, DB 1 = cache. No auth
|
|
# (in-cluster, namespace-isolated).
|
|
tasksDatabase:
|
|
host: netbox-valkey
|
|
port: 6379
|
|
database: 0
|
|
cachingDatabase:
|
|
host: netbox-valkey
|
|
port: 6379
|
|
database: 1
|
|
|
|
# Uploaded media/attachments, shared across web replicas (RWX CephFS).
|
|
persistence:
|
|
enabled: true
|
|
storageClass: cephfs-raid6-delete
|
|
accessMode: ReadWriteMany
|
|
size: 5Gi
|
|
|
|
allowedHosts:
|
|
- netbox.k8s.syd1.au.unkin.net
|
|
|
|
serviceAccount:
|
|
create: true
|
|
automountServiceAccountToken: false
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
|
|
worker:
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
|
|
# --- Authentik OIDC SSO via python-social-auth ---
|
|
# remoteAuth wires REMOTE_AUTH_ENABLED + REMOTE_AUTH_BACKEND; the SOCIAL_AUTH_*
|
|
# settings are supplied via extraConfig (YAML fragments the chart loads into the
|
|
# NetBox config). New OIDC users are auto-provisioned on first login.
|
|
remoteAuth:
|
|
enabled: true
|
|
backends:
|
|
- social_core.backends.open_id_connect.OpenIdConnectAuth
|
|
autoCreateUser: true
|
|
extraConfig:
|
|
# index 0 -> /run/config/extra/0/extra-0.yaml (non-secret OIDC config).
|
|
# Canonical Authentik host identity.unkin.net (served by the internal unkin.net
|
|
# CA; trusted via the combined bundle mounted below).
|
|
- values:
|
|
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT: https://identity.unkin.net/application/o/netbox/
|
|
SOCIAL_AUTH_OIDC_KEY: netbox
|
|
# index 1 -> /run/config/extra/1/oidc.yaml (client secret, from Vault via VSO)
|
|
- secret:
|
|
secretName: oauth-credentials
|
|
items:
|
|
- key: oidc.yaml
|
|
path: oidc.yaml
|
|
|
|
# python-social-auth uses `requests` to reach identity.unkin.net, whose cert is
|
|
# signed by the internal unkin.net CA. Combine the image's public roots with the
|
|
# reflected vault-ca-cert into one bundle and point requests/OpenSSL at it, so
|
|
# both internal (OIDC) and public HTTPS keep working.
|
|
initContainers:
|
|
- name: combine-certs
|
|
image: alpine:3
|
|
command:
|
|
- sh
|
|
- -c
|
|
- cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
|
|
volumeMounts:
|
|
- name: vault-ca-cert
|
|
mountPath: /custom-ca
|
|
readOnly: true
|
|
- name: combined-certs
|
|
mountPath: /combined-certs
|
|
extraVolumes:
|
|
- name: vault-ca-cert
|
|
secret:
|
|
secretName: vault-ca-cert
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
- name: combined-certs
|
|
emptyDir: {}
|
|
extraVolumeMounts:
|
|
- name: combined-certs
|
|
mountPath: /etc/ssl/combined
|
|
readOnly: true
|
|
extraEnvs:
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: /etc/ssl/combined/ca-certificates.crt
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/combined/ca-certificates.crt
|