From fc62345f0dd66c4c93e4ca4558f473b48404a9f6 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 22:42:19 -0500 Subject: [PATCH] chore: temp-defer oauth2-proxy to break the prod-cert deadlock (re-enable after) --- platform-config/kustomization.yaml | 6 ++++-- platform/kustomization.yaml | 7 ++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml index c7c910f..19e822e 100644 --- a/platform-config/kustomization.yaml +++ b/platform-config/kustomization.yaml @@ -50,7 +50,9 @@ resources: - ../platform/keycloak/httproute.yaml - ../platform/keycloak/servicemonitor.yaml # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs) - - ../platform/oauth2-proxy/httproute.yaml - - ../platform/oauth2-proxy/servicemonitor.yaml + # TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable together + # once the wildcard cert is re-issued via LE-prod. + # - ../platform/oauth2-proxy/httproute.yaml + # - ../platform/oauth2-proxy/servicemonitor.yaml # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR) - ../platform/monitoring/grafana-httproute.yaml diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index f889423..c411e52 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -29,7 +29,12 @@ resources: # Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ---- - cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami) - keycloak # Keycloak Operator (quay.io images) + SOPS admin credential - - oauth2-proxy # forward-auth for non-OIDC UIs — SOPS oauth2-proxy-credentials now provisioned + # TEMP-DEFERRED (PM): oauth2-proxy sits in platform-core but depends on cert-manager's wildcard cert + # being LE-PROD-trusted (+ split-horizon DNS). While it's Failed, platform wait:true stays not-Ready, + # so platform-config can't reconcile the Certificate onto the prod issuer → deadlock. Deferring lets + # the prod cert issue; then re-enable so oauth2-proxy starts trusted. FOLLOW-UP: move oauth2-proxy to + # a post-platform tier (dependsOn platform-config) so it can never block its own dependencies. + # - oauth2-proxy # forward-auth for non-OIDC UIs (re-enable after wildcard cert is LE-prod) # ---- Later phases: enabled when their phase opens ---- # - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision) # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate