unkin-agent
230db5ad7e
Adds config/providers_oauth2/vault.yaml so human logins to OpenBao go
through Authentik SSO (bao CLI and the web UI). Machine auth (approle,
kubernetes, CI) and break-glass are unchanged and stay on the OpenBao side.
Extends the oauth2 provider module so a config may generate its own client
secret instead of reading a pre-seeded one: client_secret_vault.generate
creates a random_password and writes {client_id, client_secret} to the given
kv-v2 path. Providers without the flag keep the existing read-only data source
behaviour. This is what lets the provider land with no manual Vault seed.
Gates the new application with akP-vault-admin and nests it in
akR-global-admin, matching how every other app in this repo is bound.
18 lines
550 B
YAML
18 lines
550 B
YAML
# Role akR-global-admin (name = filename): full admin across all onboarded apps.
|
|
permissions:
|
|
- akP-grafana-admin
|
|
- akP-argocd-admin
|
|
- akP-rancher-admin
|
|
- akP-litellm-admin
|
|
- akP-jellyfin-admin
|
|
- akP-traefik-admin
|
|
- akP-logviewer-admin
|
|
- akP-watchstate-admin
|
|
- akP-vault-admin
|
|
# arrstack has no admin tier (it is a proxy front door); grant global admins
|
|
# the front door plus every per-app entitlement so they reach all media apps.
|
|
- akP-arrstack-user
|
|
- akP-arrstack-sonarr
|
|
- akP-arrstack-radarr
|
|
- akP-arrstack-prowlarr
|