Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge feature/reenable-oauth2proxy-trusted (SSO forward-auth online)

Browse Source
This commit is contained in:
jakman85 committed 2026-08-24 22:47:08 -05:00
2 parents d639cfeaba 4a6e0d3d37
commit 1338b43926
2 files changed
+5 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform-config/kustomization.yaml
+2 -4
View File
@@ -50,9 +50,7 @@ resources:
- ../platform/keycloak/httproute.yaml
- ../platform/keycloak/servicemonitor.yaml
# oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
# TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable together
# once the wildcard cert is re-issued via LE-prod.
# - ../platform/oauth2-proxy/httproute.yaml
# - ../platform/oauth2-proxy/servicemonitor.yaml
- ../platform/oauth2-proxy/httproute.yaml
- ../platform/oauth2-proxy/servicemonitor.yaml
# monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
- ../platform/monitoring/grafana-httproute.yaml
platform/kustomization.yaml
+3 -6
View File
@@ -29,12 +29,9 @@ resources:
# Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
- cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
- keycloak # Keycloak Operator (quay.io images) + SOPS admin credential
# TEMP-DEFERRED (PM): oauth2-proxy sits in platform-core but depends on cert-manager's wildcard cert
# being LE-PROD-trusted (+ split-horizon DNS). While it's Failed, platform wait:true stays not-Ready,
# so platform-config can't reconcile the Certificate onto the prod issuer → deadlock. Deferring lets
# the prod cert issue; then re-enable so oauth2-proxy starts trusted. FOLLOW-UP: move oauth2-proxy to
# a post-platform tier (dependsOn platform-config) so it can never block its own dependencies.
# - oauth2-proxy # forward-auth for non-OIDC UIs (re-enable after wildcard cert is LE-prod)
- oauth2-proxy # forward-auth for non-OIDC UIs — wildcard cert now LE-prod-trusted + split-horizon DNS live
# FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
# block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
# ---- Later phases: enabled when their phase opens ----
# - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
# - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate