mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
cf33342500
knoe-auth (prole.org k3s): - Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only), switch spec.certificates from serverTLSSecret to serverAltDNSNames - Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster) - Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes - Add OIDC controllers: authorize, token, userinfo, jwks, discovery - Add prole Spring profile: cookieDomain, emailDomain, Kerberos config - Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole - Kong configmap: scope knoe-auth route to /auth prefix only Tenant onboarding: - Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC) - Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system - init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role Cluster stabilisation: - gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock); patch deployment strategy to Recreate - supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema in CNPG — analytics and realtime had never connected since Helm install day 1 - knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup Infrastructure: - gandalf host_vars: k3s registry config - pi host_vars: clean up stale entries - knoe-db schemas: ekosystem.sql, ekosystem_objects.sql - init_prole_app.sql: prole app DB initialisation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
102 lines
2.8 KiB
YAML
102 lines
2.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: knoe-svc-kong-config
|
|
namespace: knoe-system
|
|
data:
|
|
kong.yml: |
|
|
_format_version: "3.0"
|
|
_transform: true
|
|
|
|
services:
|
|
- name: healthz
|
|
url: http://knoe.healthz.invalid/
|
|
routes:
|
|
- name: healthz
|
|
paths:
|
|
- /healthz
|
|
strip_path: true
|
|
plugins:
|
|
- name: request-termination
|
|
config:
|
|
status_code: 200
|
|
message: ok
|
|
|
|
- name: knoe-service
|
|
url: http://knoe-svc.knoe-system.svc.cluster.local:8080
|
|
routes:
|
|
- name: knoe-k3s-kubeconfig
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /k3s/kube_config.sh
|
|
strip_path: false
|
|
|
|
- name: db-manager
|
|
url: http://knoe-db-manager.knoe-db.svc.cluster.local:80
|
|
routes:
|
|
- name: backup-route
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /backup
|
|
strip_path: false
|
|
|
|
# Grafana: routed through knoe-grafana-proxy (nginx) which handles
|
|
# Kerberos auth_request (X-WEBAUTH-USER injection) and passes
|
|
# /grafana/login paths through for auth.google sign-in.
|
|
- name: grafana
|
|
url: http://knoe-grafana-proxy.monitoring.svc.cluster.local:80
|
|
routes:
|
|
- name: grafana-root
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
- name: knoe-auth
|
|
url: http://knoe-auth.knoe-system.svc.cluster.local:8080
|
|
routes:
|
|
- name: knoe-auth-root
|
|
hosts:
|
|
- api.prole.org
|
|
paths:
|
|
- /auth
|
|
strip_path: false
|
|
|
|
# Supabase Studio: gated by oauth2-proxy (Google Workspace prole.org).
|
|
# oauth2-proxy forwards authenticated requests upstream to supabase-kong.
|
|
- name: studio
|
|
url: http://oauth2-proxy.supabase.svc.cluster.local:4180
|
|
routes:
|
|
- name: studio-root
|
|
hosts:
|
|
- db.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
# Gitea: routed through gitea-spnego-proxy (Apache + mod_auth_gssapi) which
|
|
# negotiates SPNEGO/Kerberos and injects X-WEBAUTH-USER for reverse proxy login.
|
|
- name: gitea-http
|
|
url: http://gitea-spnego-proxy.gitea.svc.cluster.local:4000
|
|
routes:
|
|
- name: gitea-root
|
|
hosts:
|
|
- git.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
- name: gitea-ssh
|
|
host: gitea-ssh.gitea.svc.cluster.local
|
|
port: 22
|
|
protocol: tcp
|
|
routes:
|
|
- name: gitea-ssh-tcp
|
|
protocols:
|
|
- tcp
|
|
destinations:
|
|
- port: 3022
|