mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
e86d5e1154
Without hook annotations they land in ArgoCD's regular Sync phase, which
runs AFTER PreSync hooks - so the presync Job's pod couldn't be created
('serviceaccount not found', confirmed live). Weight -1 vs the Job's 0
gets them created first, within the same PreSync phase.
119 lines
4.2 KiB
YAML
119 lines
4.2 KiB
YAML
---
|
|
# Same idempotent secret-bootstrap pattern as home's
|
|
# infrastructure/authentik/manifests/presync-job.yaml, scoped to a
|
|
# dedicated ServiceAccount here (no shared argocd-hook-sa exists on the
|
|
# vps-standby cluster the way it does at home).
|
|
#
|
|
# SA/Role/RoleBinding are PreSync hooks too (hook-weight "-1", before the
|
|
# Job's default weight "0") - without that they're just regular resources
|
|
# applied in ArgoCD's normal Sync phase, which runs AFTER PreSync hooks,
|
|
# so the Job's pod would fail to create with "serviceaccount not found"
|
|
# (confirmed live 2026-08-18).
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: authentik-hook
|
|
namespace: authentik
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-weight: "-1"
|
|
# No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
|
|
# Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
|
|
# a HookSucceeded delete policy would remove the SA right away,
|
|
# possibly racing with (or before) the weight "0" Job below that
|
|
# actually needs it to still exist while it runs.
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: authentik-hook
|
|
namespace: authentik
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-weight: "-1"
|
|
# No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
|
|
# Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
|
|
# a HookSucceeded delete policy would remove the SA right away,
|
|
# possibly racing with (or before) the weight "0" Job below that
|
|
# actually needs it to still exist while it runs.
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create"]
|
|
- apiGroups: ["postgresql.cnpg.io"]
|
|
resources: ["clusters"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: authentik-hook
|
|
namespace: authentik
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-weight: "-1"
|
|
# No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
|
|
# Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
|
|
# a HookSucceeded delete policy would remove the SA right away,
|
|
# possibly racing with (or before) the weight "0" Job below that
|
|
# actually needs it to still exist while it runs.
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: authentik-hook
|
|
namespace: authentik
|
|
roleRef:
|
|
kind: Role
|
|
name: authentik-hook
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: authentik-presync
|
|
namespace: authentik
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-weight: "0"
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: authentik-hook
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: presync
|
|
image: alpine/k8s:1.32.13
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
echo "=== Authentik (VPS) PreSync ==="
|
|
|
|
# NOTE: does NOT wait for pg-authentik to be "Healthy" the way
|
|
# home's presync-job does - a replica cluster in continuous
|
|
# recovery never reports Healthy in that sense (it's
|
|
# perpetually catching up / read-only), and server/worker are
|
|
# at replicas: 0 anyway so nothing actually needs the DB yet.
|
|
|
|
if ! kubectl -n authentik get secret authentik >/dev/null 2>&1; then
|
|
echo "Creating authentik secret (literal env:// placeholder -"
|
|
echo "matches home's values.yaml exactly, see values.yaml comment)..."
|
|
kubectl -n authentik create secret generic authentik \
|
|
--from-literal=AUTHENTIK_SECRET_KEY="env://AUTHENTIK_SECRET_KEY"
|
|
else
|
|
echo "authentik secret already exists"
|
|
fi
|
|
|
|
echo "=== Done ==="
|