claude-botandClaude Opus 4.8
dc42781a47
Rotates authentik-secrets:secret-key (Django signing key) quarterly + on-demand via the openbao-ns pattern (per-secret rotator-authentik role/policy, no netpol). Self-sync 2-sided: server + worker read the same secret; Reloader restarts both via global.podAnnotations. smtp-password in the same KV entry is preserved. externalsecret refreshInterval 1h->10m. BLAST RADIUS: invalidates active SSO sessions + in-flight signed links (re-login); downstream LDAP/proxy outposts unaffected. Requires the one-time OpenBao bootstrap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
19 lines
544 B
YAML
19 lines
544 B
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-secrets
|
|
namespace: authentik
|
|
spec:
|
|
# 10m (was 1h) so an automated secret-key rotation propagates within ~10m;
|
|
# Reloader then restarts server + worker. See
|
|
# kubernetes/infrastructure/openbao/rotation/authentik.yaml.
|
|
refreshInterval: 10m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao
|
|
target:
|
|
name: authentik-secrets # keeps the old Secret's name — consumers unchanged
|
|
dataFrom:
|
|
- extract:
|
|
key: apps/authentik
|