jakman85andClaude Opus 4.8
dfde5292d7
Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin + Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox ([email protected]) so the config loads (REPLACE-ME is not a valid address); operator can change it. NOTE: smtp_from ([email protected]) differs from the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured; that only affects email delivery at alert time, not stack health. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
54 lines
2.8 KiB
YAML
54 lines
2.8 KiB
YAML
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# (a) Copy to: platform/keycloak/keycloak-admin-credentials.sops.yaml
|
|
# (b) kustomization: add this line under `resources:` in
|
|
# platform/keycloak/kustomization.yaml
|
|
# - keycloak-admin-credentials.sops.yaml
|
|
# (c) Encrypt: sops -e -i platform/keycloak/keycloak-admin-credentials.sops.yaml
|
|
# (d) Consumed by: Keycloak Helm chart -> auth.existingSecret. [Phase 6]
|
|
#
|
|
# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
|
|
# The exact stringData key names depend on the pinned Keycloak chart version.
|
|
# Bitnami Keycloak commonly reads `admin-password`; some versions also read
|
|
# `admin-user` (and older/other variants use `adminPassword`). Check the pinned
|
|
# chart's values (auth.existingSecret / auth.passwordSecretKey) and adjust the
|
|
# keys below to match before running `sops -e -i`.
|
|
#
|
|
# !! SEPARATE DB SECRET LIKELY NEEDED !!
|
|
# The Keycloak helmrelease references "Admin + DB credentials". Keycloak needs a
|
|
# PostgreSQL DB credential in addition to these admin creds. A separate DB secret
|
|
# (or the chart's postgresql.auth.existingSecret) will likely be required at
|
|
# Phase 6 — flag and provision it then.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: keycloak-admin-credentials
|
|
namespace: keycloak
|
|
type: Opaque
|
|
stringData:
|
|
admin-user: ENC[AES256_GCM,data:JQY/SY8=,iv:6L/zbQP0HWIenMLA9qhb7IhGEF12+lOEcDZOy+2Yi5Q=,tag:Y5mCE3jRUwB8Sd8/ZPK4dg==,type:str]
|
|
admin-password: ENC[AES256_GCM,data:0DOPDe3zWFlc+BPTBqAY,iv:FnQc6F0y0gsD1S47u13oRx9lUee7zLvh3d5QAwK2FyY=,tag:pwO3PUzEf32iqBYF0uIRwg==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXd2JoSE9Cd1pvN2x0djBs
|
|
bW16TGZMZ0JDMmIzZ3JqTFNrWFJGV0Zwc25jClpxNDh6VHNwNlVmMy9PcFh2VXp2
|
|
bm5mc1lsVFZLNDNBVllJWVc1a24yb28KLS0tIHUvSnRtQTJaMzRremFWMkxaWkxB
|
|
N3I2c3cyYXRMQlF2TFFKcVNFTlFKT3cK6zMk9NYrfEiZUtdmYYsoaOhI6qXNkGWj
|
|
k/kl8WwBv2pELusvc5mlAJTmwcdOUA36QtLcwHK58tAMPpyel0dohQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-22T02:48:22Z"
|
|
mac: ENC[AES256_GCM,data:SmREeL7sleG6LVvjzNO4xnoruGsexDUHsblxG1L7YaVDPp/5KURptAc3MfbZKXweYhA5D+eoJVRk4x8CJ8AVxB5rHeon1WX51kamK4zepKSBFItK7beSvHg4sOnn595IY76e8gl8PabwsRl2tvFLr0Hc4DKnPQQl4UjbMcpDfjo=,iv:us2wMyI7BTNlgPPXYS9KZnKVu8xh7K9rOpwXHLJ7njY=,tag:oyp0g8g3Z+mOeMwqcugiOQ==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|