claude-botandClaude Opus 5.5
67a1eb2ba5
Stage 2 of unifying the auth flows, after the llama and paperless trial of stage 1 was confirmed: - Brand authentik.srv.renner.uno: flow_authentication = sso-authentication (was NULL, i.e. the slug-first default-authentication-flow with password + MFA). Every provider without its own authentication_flow logs in through it, PVE and PBS included. - The 7 blueprint OIDC providers (Home Assistant, NetBird, Audiobookshelf, Immich, Gitea, Grafana, Matrix MAS): authentication flow unset (brand), authorization implicit consent. - authentik-gate-sync: default authorization flow implicit consent, via DEFAULT_AUTHORIZATION_FLOW on the Deployment and in the code; the per-gate login/authorization annotations are dropped. Paperless keeps paperless-authorization. Every flow referenced here already exists, so the gate controller does not hit the missing-flow removal seen in stage 1. Stage 3 removes the passkey-only flows once nothing references them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
971 B
YAML
32 lines
971 B
YAML
---
|
|
# prometheus.renner.uno — Prometheus. It has no auth of its own and its metrics
|
|
# DB exposes hostnames, IPs and service inventory, so the Authentik gate
|
|
# (ingress class authentik-gate) is the only thing in front of it: Monitoring
|
|
# Access only. Replaces the chart-generated Ingress
|
|
# (prometheus.ingress.enabled=false in helmrelease-prometheus.yaml).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: prometheus
|
|
namespace: monitoring
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
auth.renner.uno/group: Monitoring Access
|
|
spec:
|
|
ingressClassName: authentik-gate
|
|
rules:
|
|
- host: prometheus.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: kube-prometheus-stack-prometheus
|
|
port:
|
|
number: 9090
|
|
tls:
|
|
- secretName: prometheus-tls
|
|
hosts:
|
|
- prometheus.renner.uno
|