chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 14:44:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
cf33342500
prole/deploy/opentofu/k3s/manifests/knoe
History
chrisfu cf33342500 feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 
knoe-auth (prole.org k3s):
- Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only),
  switch spec.certificates from serverTLSSecret to serverAltDNSNames
- Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster)
- Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService
  does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes
- Add OIDC controllers: authorize, token, userinfo, jwks, discovery
- Add prole Spring profile: cookieDomain, emailDomain, Kerberos config
- Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole
- Kong configmap: scope knoe-auth route to /auth prefix only

Tenant onboarding:
- Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password
  vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC)
- Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system
- init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role

Cluster stabilisation:
- gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock);
  patch deployment strategy to Recreate
- supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema
  in CNPG — analytics and realtime had never connected since Helm install day 1
- knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup

Infrastructure:
- gandalf host_vars: k3s registry config
- pi host_vars: clean up stale entries
- knoe-db schemas: ekosystem.sql, ekosystem_objects.sql
- init_prole_app.sql: prole app DB initialisation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 00:50:37 -07:00
..
dashboard-ingress.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
garage-configmap.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
garage-service.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
garage-statefulset.yaml chore(deploy): cluster config and k3s manifest updates 2026-04-27 14:47:27 -07:00
gitea-spnego-proxy.yaml fix(auth): fix gitea krb5.conf KDC hostname: knoe-auth→auth 2026-05-08 12:18:22 -07:00
grafana-proxy-configmap.yaml fix(k3s): disable auth_request in grafana-proxy; disable auth.proxy in Grafana 2026-05-06 18:16:00 -04:00
grafana-proxy-deployment.yaml fix(k3s): fix Kong + grafana-proxy config for prole.org routing 2026-05-06 17:26:40 -04:00
grafana-proxy-service.yaml fix(k3s): fix Kong + grafana-proxy config for prole.org routing 2026-05-06 17:26:40 -04:00
ingress.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
iscsi-pvs.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-auth-deployment.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-auth-google-prole-secret.example.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-auth-http-keytab-secret.example.yaml feat(auth): dual IdP for db.prole.org — Google OAuth + Kerberos SPNEGO 2026-05-03 20:03:09 -07:00
knoe-auth-kerberos-configmap.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-auth-oidc-signing-secret.example.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-auth-secrets.example.yaml Merge claude/crazy-bose-fec256 into main 2026-05-01 16:39:10 -07:00
knoe-auth-service.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-configmap.yaml chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents 2026-05-02 02:58:03 -07:00
knoe-db-barman-objectstore.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-db-postgres-service.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
knoe-db-postgres-tcp-ingress.yaml feat(oauth): add Google OIDC/OAuth2 Proxy support for Studio and Grafana. Add Google OIDC configuration for Grafana in gke.cfg, introduce oauth2-proxy templates and configurations for Supabase Studio, update Helm values/templates for authenticated Studio access, and add ingress/service manifests for Postgres TCP and Prole services. 2026-04-28 11:27:34 -07:00
knoe-db-scheduled-backup.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-db-user.example.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-db.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
knoe-deployment.yaml chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents 2026-05-02 02:58:03 -07:00
knoe-kdc-configmap.yaml chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents 2026-05-02 02:58:03 -07:00
knoe-kdc-secrets.example.yaml chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents 2026-05-02 02:58:03 -07:00
knoe-service.yaml chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents 2026-05-02 02:58:03 -07:00
kong-configmap.yaml feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 2026-05-26 00:50:37 -07:00
kong-deployment.yaml fix(k3d): rename prole-svc-kong → knoe-svc-kong, clean up stale resources 2026-05-03 00:24:02 -07:00
kong-service.yaml fix(k3d): rename prole-svc-kong → knoe-svc-kong, clean up stale resources 2026-05-03 00:24:02 -07:00
kustomization.yaml feat(auth): KNOE.LOCAL realm; prole-kerberos-ad-dc ExternalName svc; Gitea reverse proxy auth 2026-05-08 12:13:46 -07:00
oauth2-proxy-deployment-prole.yaml feat(auth): add Google Workspace OAuth (prole.org) for Grafana + Supabase Studio 2026-05-06 16:22:49 -04:00
oauth2-proxy-externalname.yaml feat(k3s): add ExternalName service for oauth2-proxy in knoe-system 2026-05-06 17:41:31 -04:00
openbao-service.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
openbao-statefulset.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
prole-kerberos-ad-dc-svc.yaml feat(auth): KNOE.LOCAL realm; prole-kerberos-ad-dc ExternalName svc; Gitea reverse proxy auth 2026-05-08 12:13:46 -07:00
prole-svc-ingress.yaml feat(oauth): add Google OIDC/OAuth2 Proxy support for Studio and Grafana. Add Google OIDC configuration for Grafana in gke.cfg, introduce oauth2-proxy templates and configurations for Supabase Studio, update Helm values/templates for authenticated Studio access, and add ingress/service manifests for Postgres TCP and Prole services. 2026-04-28 11:27:34 -07:00
storageclass-synology-iscsi.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
supabase-ingress.yaml Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces. 2026-04-22 15:08:35 -07:00
supabase-studio.yaml feat(oauth): add Google OIDC/OAuth2 Proxy support for Studio and Grafana. Add Google OIDC configuration for Grafana in gke.cfg, introduce oauth2-proxy templates and configurations for Supabase Studio, update Helm values/templates for authenticated Studio access, and add ingress/service manifests for Postgres TCP and Prole services. 2026-04-28 11:27:34 -07:00
svc-knoe-ingress.yaml feat(infra): replace GitLab with Gitea on git.prole.org 2026-05-07 01:25:32 -04:00
traefik-helmchartconfig.yaml feat(k3s): enable allowExternalNameServices in Traefik 2026-05-06 17:58:50 -04:00