jakman85andClaude Opus 4.8
ed6a772599
Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm import can inject the grafana + oauth2-proxy client secrets and both consumers match: - platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets) - platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie) - platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret) Wire each into its component kustomization and re-enable oauth2-proxy in platform + platform-config (reverses the temp deferral now that its secret exists). Values generated by PM per operator instruction (random; recorded out-of-repo at ~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the dev container to the age recipient in .sops.yaml; plaintext never committed. Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01. Co-Authored-By: Claude Opus 4.8 <[email protected]>
31 lines
1.7 KiB
YAML
31 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy-credentials
|
|
namespace: oauth2-proxy
|
|
type: Opaque
|
|
stringData:
|
|
client-id: ENC[AES256_GCM,data:YqWOatWC7SbM0yp4,iv:vMxhYu7PxLlTrjIcRMrWhN1r4cPiWAUtPrEyTeb3DiA=,tag:ZEVcSR8YaEVxiMj7IsRd8g==,type:str]
|
|
client-secret: ENC[AES256_GCM,data:DKxzn/nSQRWhKHzYqQNpmrnNmc0LzcIg+aUNODG6vd5TGMDkEQtsbR96j0PaS5MpNUraWKlo/GCKSPaZr/wqMA==,iv:IPRHbq0Nir90GZLjKPmqawdpRgzAf9mfs6mP5N0bwqI=,tag:Zuik7AN23lz408ikj67OtQ==,type:str]
|
|
cookie-secret: ENC[AES256_GCM,data:acF3v5BRojefjARfJB2udO2gaeffk64/0J+3YvOzvdHdtGk9lrXI/vuzC5A=,iv:EiloVBHhCWxgoGlbRruZUTgTB9/ekcQOHY7fmZPZu8I=,tag:+D4T7mNz1U8EnzErk98OyQ==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac0gxeDFhbW8wNVY4SkNj
|
|
OWc2aVc3M1dzYmRxdkk3dWNJNkJKYk9qRUMwClBzVXBvUStKdW8wU3orWFlkTFFW
|
|
WkhyVGd4VVdMbmlMMUZ4VDA5M09lYmcKLS0tIGFXekE3ODFaNTlqR1RhS1N3SmhC
|
|
elUvK1l2Q1gvd0hFQXZrQUd1a29RQVEKQ/9keILThurYGEs5vbuRUghlyfpVpcDt
|
|
Gc0EGCN0ZZyV4zNmODX91Yubd7whUTl3WNs0n3TZfqXSeSP9bUFI+Q==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-25T03:06:30Z"
|
|
mac: ENC[AES256_GCM,data:Q5dzE84NWDdZo9qrgPMJghF823nNr57bhg4CURfZHCoc1hkpsBNy0XVdbKfOt4wqvsy9ebL2s/vAhBlUJjqIgrk742YA+oUDkksII+CsldlECBTmFrJQULgmSIJgrlctgGP06wycnCL6dYvB+bnEG7hitlP9isoAyW0rQ7dUNmc=,iv:nIKr1zerrY6FEaOlu+hIBJYxK58GrV0NOeFpTzUFny4=,tag:lrC82Nt7/gZTZ6R3BjigpQ==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|