jakman85andClaude Opus 4.8
ed6a772599
Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm import can inject the grafana + oauth2-proxy client secrets and both consumers match: - platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets) - platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie) - platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret) Wire each into its component kustomization and re-enable oauth2-proxy in platform + platform-config (reverses the temp deferral now that its secret exists). Values generated by PM per operator instruction (random; recorded out-of-repo at ~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the dev container to the age recipient in .sops.yaml; plaintext never committed. Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01. Co-Authored-By: Claude Opus 4.8 <[email protected]>
16 lines
566 B
YAML
16 lines
566 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- helmrepositories.yaml
|
|
- kube-prometheus-stack.yaml
|
|
- loki.yaml
|
|
- alloy.yaml
|
|
# NOTE: alerts.yaml (PrometheusRule CRs) needs the monitoring.coreos.com CRDs that the
|
|
# kube-prometheus-stack HelmRelease above installs → applied by the platform-config Kustomization
|
|
# (dependsOn platform) so the CRDs exist first. File stays here for locality.
|
|
- grafana-admin-credentials.sops.yaml
|
|
- alertmanager-smtp.sops.yaml
|
|
- grafana-oidc-credentials.sops.yaml
|