From ef5b7bd57b0dbe699fd716b8e5a7da5f42057689 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 21:43:12 -0500 Subject: [PATCH] chore(phase6): temp-defer oauth2-proxy until its SOPS secret is provisioned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit oauth2-proxy's HelmRelease mounts existingSecret oauth2-proxy-credentials, an operator hand-off not yet filled. Under the unified graph (platform wait:true), the not-ready HR blocks platform -> platform-config -> the whole downstream graph including KubeVirt. Deferring it (comment its line in platform/kustomization.yaml + its two entries in platform-config) lets the no-secret components (KubeVirt/CDI, CNPG, Keycloak operator + instance) reconcile and be certified now. Re-enable both together once the operator fills platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml. Serves: R-IDP-02 (deferred). PM sequencing correction — enable per phase AND readiness. Co-Authored-By: Claude Opus 4.8 --- platform-config/kustomization.yaml | 6 ++++-- platform/kustomization.yaml | 7 ++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml index c7c910f..ec38af9 100644 --- a/platform-config/kustomization.yaml +++ b/platform-config/kustomization.yaml @@ -50,7 +50,9 @@ resources: - ../platform/keycloak/httproute.yaml - ../platform/keycloak/servicemonitor.yaml # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs) - - ../platform/oauth2-proxy/httproute.yaml - - ../platform/oauth2-proxy/servicemonitor.yaml + # TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable both + # together once the operator provisions oauth2-proxy-credentials. + # - ../platform/oauth2-proxy/httproute.yaml + # - ../platform/oauth2-proxy/servicemonitor.yaml # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR) - ../platform/monitoring/grafana-httproute.yaml diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index 71c2630..f692688 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -28,7 +28,12 @@ resources: # Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ---- - cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami) - keycloak # Keycloak Operator (quay.io images) + SOPS admin credential - - oauth2-proxy # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off) + # TEMP-DEFERRED (PM, pending operator SOPS hand-off): oauth2-proxy's HelmRelease mounts + # `existingSecret: oauth2-proxy-credentials`, which is not yet provisioned. Under the unified graph's + # `platform` wait:true, a not-ready HR here blocks platform → platform-config → the whole downstream + # graph (incl. KubeVirt). Re-enable this line (and the two oauth2-proxy entries in platform-config) + # the moment the operator fills platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml + wires it. + # - oauth2-proxy # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off) # ---- Later phases: enabled when their phase opens ---- # - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision) # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate