konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 3 Packages Projects Releases 1 Wiki Activity

feat(authentik): automated SECRET_KEY rotation (openbao-ns) #302

Merged
k.renner merged 2 commits from feat/authentik-secret-rotation into master 2026-07-18 21:24:32 +00:00
Conversation 0 Commits 2 Files Changed 5
+130 -1
claude-bot commented 2026-07-18 20:06:59 +00:00
Member
Copy Link
Copy Source

Fan-out #2. Rotates authentik-secrets:secret-key (Django signing key) — self-sync 2-sided (server + worker read the same secret; Reloader restarts both via global.podAnnotations). Per-secret rotator-authentik role/policy, no netpol; smtp-password in the same KV entry preserved; refreshInterval 1h→10m.

⚠️ Blast radius: rotating invalidates active SSO sessions + in-flight signed links (password-reset/invite/verify tokens) → users re-login. Downstream LDAP/proxy outposts use separate material, unaffected. Prefer an off-hours window for on-demand runs. Needs the one-time OpenBao bootstrap. kustomize + yamllint clean.

Fan-out #2. Rotates `authentik-secrets:secret-key` (Django signing key) — self-sync 2-sided (server + worker read the same secret; Reloader restarts both via `global.podAnnotations`). Per-secret `rotator-authentik` role/policy, no netpol; `smtp-password` in the same KV entry preserved; refreshInterval 1h→10m. ⚠️ **Blast radius**: rotating invalidates active SSO sessions + in-flight signed links (password-reset/invite/verify tokens) → users re-login. Downstream LDAP/proxy outposts use separate material, unaffected. Prefer an off-hours window for on-demand runs. Needs the one-time OpenBao bootstrap. kustomize + yamllint clean.
claude-bot added 1 commit 2026-07-18 20:06:59 +00:00
feat(authentik): automated SECRET_KEY rotation (openbao-ns) dc42781a47 
Rotates authentik-secrets:secret-key (Django signing key) quarterly + on-demand via the openbao-ns pattern (per-secret rotator-authentik role/policy, no netpol). Self-sync 2-sided: server + worker read the same secret; Reloader restarts both via global.podAnnotations. smtp-password in the same KV entry is preserved. externalsecret refreshInterval 1h->10m. BLAST RADIUS: invalidates active SSO sessions + in-flight signed links (re-login); downstream LDAP/proxy outposts unaffected. Requires the one-time OpenBao bootstrap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
claude-bot added 1 commit 2026-07-18 21:24:09 +00:00
Merge remote-tracking branch 'origin/master' into feat/authentik-secret-rotation 0443107992 
# Conflicts:
#	kubernetes/infrastructure/openbao/rotation/kustomization.yaml
k.renner merged commit d09d458235 into master 2026-07-18 21:24:32 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#302