unkin-agent
db5bf753b5
watchstate is an internal media watch-state sync admin tool deployed at watchstate.k8s.syd1.au.unkin.net behind oauth2-proxy (OIDC against Authentik). Add the OAuth2/OIDC provider + application mirroring the logviewer/traefik in-cluster admin pattern, gate it with the akP-watchstate-admin permission group bound to the app, and nest that permission into the akR-global-admin role so only the admin team can authorize.
17 lines
530 B
YAML
17 lines
530 B
YAML
# Role akR-global-admin (name = filename): full admin across all onboarded apps.
|
|
permissions:
|
|
- akP-grafana-admin
|
|
- akP-argocd-admin
|
|
- akP-rancher-admin
|
|
- akP-litellm-admin
|
|
- akP-jellyfin-admin
|
|
- akP-traefik-admin
|
|
- akP-logviewer-admin
|
|
- akP-watchstate-admin
|
|
# arrstack has no admin tier (it is a proxy front door); grant global admins
|
|
# the front door plus every per-app entitlement so they reach all media apps.
|
|
- akP-arrstack-user
|
|
- akP-arrstack-sonarr
|
|
- akP-arrstack-radarr
|
|
- akP-arrstack-prowlarr
|