jakman85andClaude Opus 4.8
dfde5292d7
Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin + Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox ([email protected]) so the config loads (REPLACE-ME is not a valid address); operator can change it. NOTE: smtp_from ([email protected]) differs from the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured; that only affects email delivery at alert time, not stack health. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
33 lines
1.4 KiB
YAML
33 lines
1.4 KiB
YAML
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# (a) Copy to: platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
|
|
# (b) kustomization: add this line under `resources:` in
|
|
# platform/oauth2-proxy/kustomization.yaml
|
|
# - oauth2-proxy-credentials.sops.yaml
|
|
# (c) Encrypt: sops -e -i platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
|
|
# (d) Consumed by: oauth2-proxy Helm chart -> existingSecret. [Phase 6]
|
|
#
|
|
# VALUE NOTES:
|
|
# - client-id / client-secret: come from the Keycloak OIDC client created for
|
|
# oauth2-proxy (Phase 6, after Keycloak is up).
|
|
# - cookie-secret: must be a 16, 24, or 32-byte value, base64-encoded.
|
|
# Generate with: openssl rand -base64 32
|
|
#
|
|
# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
|
|
# Confirm the exact stringData key names against the pinned oauth2-proxy chart's
|
|
# existingSecret contract (common keys: client-id, client-secret, cookie-secret,
|
|
# but chart versions vary). Adjust below to match before running `sops -e -i`.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy-credentials
|
|
namespace: oauth2-proxy
|
|
type: Opaque
|
|
stringData:
|
|
client-id: REPLACE-ME
|
|
client-secret: REPLACE-ME
|
|
cookie-secret: REPLACE-ME
|