konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(secrets): final batch — authentik to OpenBao/ESO (repo is sops-free) #175

Merged
k.renner merged 1 commits from openbao-authentik into master 2026-07-13 23:38:48 +00:00
Conversation 0 Commits 1 Files Changed 7
+39 -73
claude-bot commented 2026-07-13 23:34:06 +00:00
Member
Copy Link
Copy Source

Phase 3 final batch per kubernetes/MIGRATION-sops-openbao.md — the identity provider, last by design.

sops file (deleted) ExternalSecret target (name unchanged) KV key
authentik/secret.sops.yaml authentik-secrets (authentik) apps/authentik
authentik/samba-bridge-secret.sops.yaml authentik-samba-bridge-config (authentik) apps/authentik-samba-bridge

Both values verified in KV, round-trip-checked text. Drops the authentik KS decryption block. After this merge, zero *.sops.yaml files remain under kubernetes/.

Post-merge I'll verify both ES sync and that authentik logins (OIDC + LDAP outpost) still work. Phase 4 (retire age key, sops-age Secret, kubernetes/.sops.yaml, CI SOPS_AGE_KEY) stays deliberately parked until the doc's soak criteria are met — recommend giving it a few days of normal operation first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 3 final batch per kubernetes/MIGRATION-sops-openbao.md — the identity provider, last by design. | sops file (deleted) | ExternalSecret target (name unchanged) | KV key | |---|---|---| | authentik/secret.sops.yaml | `authentik-secrets` (authentik) | apps/authentik | | authentik/samba-bridge-secret.sops.yaml | `authentik-samba-bridge-config` (authentik) | apps/authentik-samba-bridge | Both values verified in KV, round-trip-checked text. Drops the authentik KS decryption block. **After this merge, zero `*.sops.yaml` files remain under `kubernetes/`.** Post-merge I'll verify both ES sync and that authentik logins (OIDC + LDAP outpost) still work. Phase 4 (retire age key, `sops-age` Secret, `kubernetes/.sops.yaml`, CI `SOPS_AGE_KEY`) stays deliberately parked until the doc's soak criteria are met — recommend giving it a few days of normal operation first. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6
claude-bot added 1 commit 2026-07-13 23:34:06 +00:00
feat(secrets): migrate authentik secrets to OpenBao (final batch) fa437a608c 
authentik-secrets + samba-bridge config: values in OpenBao KV, both
round-trip-verified text. The identity provider was deliberately last —
every other consumer proved the pipeline first. ZERO sops files remain
under kubernetes/; authentik KS decryption dropped. Phase 4 (age-key
retirement) is now unblocked pending soak.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6
k.renner merged commit 815a710549 into master 2026-07-13 23:38:48 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#175