From e6b3a03ff431cb1b67c11ae8eb616ec94b989cfd Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 25 Aug 2026 13:17:04 -0500 Subject: [PATCH] flux: re-enable oauth2-proxy now Keycloak is live and split-horizon DNS points at 192.168.1.53 Co-Authored-By: Claude Opus 4.8 --- platform-config/kustomization.yaml | 12 +++++------- platform/kustomization.yaml | 9 ++------- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml index a68ef2e..b256bc4 100644 --- a/platform-config/kustomization.yaml +++ b/platform-config/kustomization.yaml @@ -49,12 +49,10 @@ resources: - ../platform/keycloak/keycloak-realm-import.yaml - ../platform/keycloak/httproute.yaml - ../platform/keycloak/servicemonitor.yaml - # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs) - # TEMP-DISABLED (parallels platform/kustomization.yaml oauth2-proxy disable): these objects are - # in namespace `oauth2-proxy`, created only by the disabled platform/oauth2-proxy component, so - # leaving them here fails the platform-config dry-run atomically. Re-enable together with - # oauth2-proxy after Keycloak is live (DECISIONS-LOG oauth2-proxy FOLLOW-UP). - # - ../platform/oauth2-proxy/httproute.yaml - # - ../platform/oauth2-proxy/servicemonitor.yaml + # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs). + # Re-enabled together with the platform/oauth2-proxy component now Keycloak is live and split-horizon + # DNS resolves to the Proxmox Gateway VIP (192.168.1.53). + - ../platform/oauth2-proxy/httproute.yaml + - ../platform/oauth2-proxy/servicemonitor.yaml # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR) - ../platform/monitoring/grafana-httproute.yaml diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index e0fc32f..d94b9f6 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -29,13 +29,8 @@ resources: # Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ---- - cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami) - keycloak # Keycloak Operator (quay.io images) + SOPS admin credential - # - oauth2-proxy # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak, - # # which lives in platform-config (dependsOn platform) — so it crashloops and - # # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is - # # green (Keycloak live). Proper fix = move to a post-platform-config tier - # # (DECISIONS-LOG oauth2-proxy FOLLOW-UP). - # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never - # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG. + - oauth2-proxy # forward-auth for non-OIDC apps (ADR-0014); OIDC-discovers Keycloak (now live) + # via the split-horizon VIP (GATEWAY_VIP 192.168.1.53) — pre-verified in-cluster. # ---- Later phases: enabled when their phase opens ---- # - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision) # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate