unkin-agent
b3c08369fd
Onboard the VictoriaLogs query UI at https://vlogs.unkin.net behind oauth2-proxy, gated on akP-vlogs-admin. - add config/providers_oauth2/vlogs.yaml reading its client_secret from kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials - add permission group akP-vlogs-admin bound to the vlogs application - nest akP-vlogs-admin under akR-global-admin
25 lines
817 B
YAML
25 lines
817 B
YAML
# Role akR-global-admin (name = filename): full admin across all onboarded apps.
|
|
# Nests akP-media-fafflix / akP-media-cheeztv so admins pass the jellyfin
|
|
# application gate and can reach the akP-jellyfin-admin rights nested below.
|
|
permissions:
|
|
- akP-grafana-admin
|
|
- akP-argocd-admin
|
|
- akP-rancher-admin
|
|
- akP-litellm-admin
|
|
- akP-jellyfin-admin
|
|
- akP-traefik-admin
|
|
- akP-logviewer-admin
|
|
- akP-vlogs-admin
|
|
- akP-watchstate-admin
|
|
- akP-repospawner-admin
|
|
- akP-vault-admin
|
|
- akP-artifactapi-admin
|
|
# arrstack has no admin tier (it is a proxy front door); grant global admins
|
|
# the front door plus every per-app entitlement so they reach all media apps.
|
|
- akP-arrstack-user
|
|
- akP-arrstack-sonarr
|
|
- akP-arrstack-radarr
|
|
- akP-arrstack-prowlarr
|
|
- akP-media-fafflix
|
|
- akP-media-cheeztv
|