jakman85andClaude Opus 4.8
dfde5292d7
Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin + Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox ([email protected]) so the config loads (REPLACE-ME is not a valid address); operator can change it. NOTE: smtp_from ([email protected]) differs from the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured; that only affects email delivery at alert time, not stack health. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
platform/keycloak
Keycloak — the platform Identity Provider (SSO via OIDC + SAML).
- Governing ADR: ADR-0014 — IdP: Keycloak
- Spec: docs/15 — Identity & Access
- Serves: R-IDP-01..06
- Owner: WS-SEC
What this stub is
Flux HelmRelease for the Keycloak instance with PostgreSQL on Longhorn (DR-critical). Replica
count is an overlay knob (${KEYCLOAK_REPLICAS}, R-ENV-02). Admin/DB credentials referenced by
name, SOPS-encrypted (WS-SEC). Realms/clients/groups are config-as-code (Phase 6).
The ADR allows the Keycloak Operator OR Helm for the instance; this stub uses Helm — swap to the Operator if WS-SEC prefers CR-driven config.
Contract (SSO/auth)
The "SSO/auth contract" (roadmap/workstreams.md, WS-SEC): a ServiceDefinition's auth block maps to
a Keycloak client (native OIDC) or oauth2-proxy protection (forward-auth — see
../oauth2-proxy). Consumed by WS-APPS/WS-C2.
TODO (later phases — onboarded EARLY in Phase 6)
- Realms/clients/groups as code (keycloak-config-cli / realm-import); MFA for privileged groups.
- DR-critical: off-cluster DB backup (velero/) + documented break-glass local-admin path.
- Exceptions that keep native auth (do not force SSO): Plex/Seerr (Plex auth), Minecraft (Mojang/Microsoft), UniFi (native) — ADR-0014.