bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

maintenance: tighten metis access and control ui

Browse Source
This commit is contained in:
Brad Stein 2026-03-31 18:47:38 -03:00
parent 3bd9f08a67
commit 7aebb4ee08
5 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
services/keycloak/oneoffs/realm-settings-job.yaml
View File

@ -1,15 +1,15 @@
# services/keycloak/oneoffs/realm-settings-job.yaml # services/keycloak/oneoffs/realm-settings-job.yaml
# One-off job for sso/keycloak-realm-settings-36. # One-off job for sso/keycloak-realm-settings-37.
# Purpose: keycloak realm settings 36 (see container args/env in this file). # Purpose: keycloak realm settings 37 (see container args/env in this file).
# Run by setting spec.suspend to false, reconcile, then set it back to true. # This revision runs once to ensure the maintenance group exists for Metis access.
# Safe to delete the finished Job/pod; it should not run continuously. # Safe to delete the finished Job/pod; it should not run continuously.
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:
name: keycloak-realm-settings-36 name: keycloak-realm-settings-37
namespace: sso namespace: sso
spec: spec:
suspend: true suspend: false
backoffLimit: 0 backoffLimit: 0
template: template:
metadata: metadata:
@ -336,6 +336,7 @@ spec:
# Ensure basic realm groups exist for provisioning. # Ensure basic realm groups exist for provisioning.
ensure_group("dev") ensure_group("dev")
ensure_group("admin") ensure_group("admin")
ensure_group("maintenance")
ensure_group("demo") ensure_group("demo")
ensure_group("test") ensure_group("test")
ensure_group("vaultwarden_grandfathered") ensure_group("vaultwarden_grandfathered")

2
services/maintenance/kustomization.yaml
View File

@ -42,7 +42,7 @@ images:
- name: registry.bstein.dev/bstein/ariadne - name: registry.bstein.dev/bstein/ariadne
newTag: 0.1.0-22 # {"$imagepolicy": "maintenance:ariadne:tag"} newTag: 0.1.0-22 # {"$imagepolicy": "maintenance:ariadne:tag"}
- name: registry.bstein.dev/bstein/metis - name: registry.bstein.dev/bstein/metis
newTag: 0.1.0-1-amd64 newTag: 0.1.0-2-amd64
configMapGenerator: configMapGenerator:
- name: disable-k3s-traefik-script - name: disable-k3s-traefik-script
namespace: maintenance namespace: maintenance

1
services/maintenance/metis-configmap.yaml
View File

@ -12,7 +12,6 @@ data:
METIS_FLASH_HOSTS: titan-22 METIS_FLASH_HOSTS: titan-22
METIS_LOCAL_HOST: titan-22 METIS_LOCAL_HOST: titan-22
METIS_ALLOWED_GROUPS: admin,maintenance,maintainer METIS_ALLOWED_GROUPS: admin,maintenance,maintainer
METIS_ALLOWED_USERS: brad.stein@gmail.com,brad@bstein.dev,bstein
METIS_MAX_DEVICE_BYTES: "300000000000" METIS_MAX_DEVICE_BYTES: "300000000000"
METIS_SENTINEL_PUSH_URL: http://metis.maintenance.svc.cluster.local/internal/sentinel/snapshot METIS_SENTINEL_PUSH_URL: http://metis.maintenance.svc.cluster.local/internal/sentinel/snapshot
METIS_SENTINEL_INTERVAL_SEC: "1800" METIS_SENTINEL_INTERVAL_SEC: "1800"

2
services/maintenance/metis-deployment.yaml
View File

@ -27,7 +27,7 @@ spec:
node-role.kubernetes.io/accelerator: "true" node-role.kubernetes.io/accelerator: "true"
containers: containers:
- name: metis - name: metis
image: registry.bstein.dev/bstein/metis:0.1.0-1-amd64 image: registry.bstein.dev/bstein/metis:0.1.0-2-amd64
imagePullPolicy: Always imagePullPolicy: Always
envFrom: envFrom:
- configMapRef: - configMapRef:

3
services/maintenance/oauth2-proxy-metis.yaml
View File

@ -79,8 +79,11 @@ spec:
- --scope=openid profile email groups - --scope=openid profile email groups
- --email-domain=* - --email-domain=*
- --allowed-group=admin - --allowed-group=admin
- --allowed-group=/admin
- --allowed-group=maintenance - --allowed-group=maintenance
- --allowed-group=/maintenance
- --allowed-group=maintainer - --allowed-group=maintainer
- --allowed-group=/maintainer
- --set-xauthrequest=true - --set-xauthrequest=true
- --pass-access-token=true - --pass-access-token=true
- --set-authorization-header=true - --set-authorization-header=true