From 4a6e0d3d37e9fde10a7ef8e08aae143c3c59a73d Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 22:47:07 -0500 Subject: [PATCH] feat: re-enable oauth2-proxy on the LE-prod-trusted wildcard cert (R-IDP-02) --- platform-config/kustomization.yaml | 6 ++---- platform/kustomization.yaml | 9 +++------ 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml index 19e822e..c7c910f 100644 --- a/platform-config/kustomization.yaml +++ b/platform-config/kustomization.yaml @@ -50,9 +50,7 @@ resources: - ../platform/keycloak/httproute.yaml - ../platform/keycloak/servicemonitor.yaml # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs) - # TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable together - # once the wildcard cert is re-issued via LE-prod. - # - ../platform/oauth2-proxy/httproute.yaml - # - ../platform/oauth2-proxy/servicemonitor.yaml + - ../platform/oauth2-proxy/httproute.yaml + - ../platform/oauth2-proxy/servicemonitor.yaml # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR) - ../platform/monitoring/grafana-httproute.yaml diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index c411e52..a851ce9 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -29,12 +29,9 @@ resources: # Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ---- - cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami) - keycloak # Keycloak Operator (quay.io images) + SOPS admin credential - # TEMP-DEFERRED (PM): oauth2-proxy sits in platform-core but depends on cert-manager's wildcard cert - # being LE-PROD-trusted (+ split-horizon DNS). While it's Failed, platform wait:true stays not-Ready, - # so platform-config can't reconcile the Certificate onto the prod issuer → deadlock. Deferring lets - # the prod cert issue; then re-enable so oauth2-proxy starts trusted. FOLLOW-UP: move oauth2-proxy to - # a post-platform tier (dependsOn platform-config) so it can never block its own dependencies. - # - oauth2-proxy # forward-auth for non-OIDC UIs (re-enable after wildcard cert is LE-prod) + - oauth2-proxy # forward-auth for non-OIDC UIs — wildcard cert now LE-prod-trusted + split-horizon DNS live + # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never + # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG. # ---- Later phases: enabled when their phase opens ---- # - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision) # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate