jakman85andClaude Opus 4.8
a108d5ab98
Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
34 lines
1.6 KiB
Plaintext
34 lines
1.6 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# (a) Copy to: platform/keycloak/keycloak-admin-credentials.sops.yaml
|
|
# (b) kustomization: add this line under `resources:` in
|
|
# platform/keycloak/kustomization.yaml
|
|
# - keycloak-admin-credentials.sops.yaml
|
|
# (c) Encrypt: sops -e -i platform/keycloak/keycloak-admin-credentials.sops.yaml
|
|
# (d) Consumed by: Keycloak Helm chart -> auth.existingSecret. [Phase 6]
|
|
#
|
|
# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
|
|
# The exact stringData key names depend on the pinned Keycloak chart version.
|
|
# Bitnami Keycloak commonly reads `admin-password`; some versions also read
|
|
# `admin-user` (and older/other variants use `adminPassword`). Check the pinned
|
|
# chart's values (auth.existingSecret / auth.passwordSecretKey) and adjust the
|
|
# keys below to match before running `sops -e -i`.
|
|
#
|
|
# !! SEPARATE DB SECRET LIKELY NEEDED !!
|
|
# The Keycloak helmrelease references "Admin + DB credentials". Keycloak needs a
|
|
# PostgreSQL DB credential in addition to these admin creds. A separate DB secret
|
|
# (or the chart's postgresql.auth.existingSecret) will likely be required at
|
|
# Phase 6 — flag and provision it then.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: keycloak-admin-credentials
|
|
namespace: keycloak
|
|
type: Opaque
|
|
stringData:
|
|
admin-user: admin
|
|
admin-password: REPLACE-ME
|