unkin-agent
efed6c8966
#456 omitted the combine-certs initContainer and OAUTH2_PROXY_PROVIDER_CA_FILES on the grounds that identity.unkin.net serves a publicly trusted Let's Encrypt cert and so needs no internal CA. That reasoning holds for the browser redirect but not for oauth2-proxy's own back-channel calls: every other oauth2-proxy in the estate needs the internal bundle, including repospawner, which uses the same public identity.unkin.net issuer hostname. artifactapi is the only one of six without it (arrproxy, logviewer, mediamark, repospawner and watchstate all have it). This is NOT the current outage. The UI is 503 because the Authentik application slug artifactapi does not exist -- terraform-authentik's push/apply on main (4e16401) failed, so discovery 404s and oauth2-proxy never starts. This change removes the next blocker, which would surface as an x509 failure once that apply succeeds. - Add the combine-certs initContainer, byte-identical to repospawner's. - Mount the combined bundle and set OAUTH2_PROXY_PROVIDER_CA_FILES. - Reload the Deployment when vault-ca-cert rotates. Trust-only and strictly additive: it appends the internal CA to the system roots, so it is harmless if the back channel turns out to reach a publicly trusted endpoint after all.
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |