6 Commits

Include renames

Author	SHA1	Message	Date
Sten	338b4de3ba	refactor(apps): registrar-managed oidc creds, drop mcp client, DRY secret ... Per platform review (danijel): - keycloak-client-forte-drop: add the secret{} block telling the registrar where to write the credential Secret + key names (forte-drop-oidc-credentials, client-id/client-secret). The forte-helm oidc sidecar consumes that registrar-created Secret — no manual auth-oidc SealedSecret step (removed that NOTE). - Delete keycloak-client-forte-drop-mcp: auth.type: mcp auto-registers the MCP client; no manual config needed. - Re-seal forte-drop-secrets with all shared env (BASE_DOMAIN, PG*, S3_*, PASSWORD_GATE_SECRET) so both deployments get identical values via envSecretName (values extraEnv now carries only APP_MODE).	2026-05-29 14:05:29 +02:00
Sten	61a8a2b4ac	chore(apps): clarify auth-oidc follow-up (drop commented-out resource line) ... ai-review: a commented-out resource line reads as GitOps debt. Replace the '# - auth-oidc-sealed.yaml' line with an explicit NOTE explaining it's a deliberate post-deploy step (needs the registrar-generated client-secret), not a disabled resource.	2026-05-29 12:14:09 +02:00
Sten	d6a97a22df	fix(apps): explicit forte-drop namespace (sync-wave -1, Prune=false) ... Codex review: the apps overlay applies namespaced resources (keycloak-client Secrets, forte-drop-secrets, PDB) to forte-drop, but no base created the namespace — first sync on a fresh cluster raced ahead of the Applications' CreateNamespace and failed with 'namespaces forte-drop not found' until a retry. Add an explicit Namespace at sync-wave -1 so it exists before the wave-0 namespaced resources (covers both web + mcp bases via the shared parent). Prune=false keeps removing a base from cascade- deleting the namespace + postgres data + the other deployment.	2026-05-29 10:25:37 +02:00
Sten	c4b7167f9e	feat(apps): add forte-drop-secrets sealed secret ... Sealed forte-drop-secrets with the real UpCloud Managed Object Storage creds (existing drops bucket), PG creds matching the deployed forte-drop-pg-creds, and PASSWORD_GATE_SECRET. Consumed by both web + mcp deployments (envSecretName) and the pg-backup CronJob (S3 creds).	2026-05-29 10:03:57 +02:00
Sten	6bc5bd29b3	feat(apps): PodDisruptionBudget for forte-drop web (minAvailable 1)	2026-05-29 09:31:16 +02:00
Sten	a2fae9dd0c	feat(apps): forte-drop web + mcp ArgoCD applications ... Two ArgoCD apps from the same forte-drop image: - forte-drop (web): admin + public drops, sidecar in oidc mode, ingress drop-k8s.hackathon.forteapps.net. - forte-drop-mcp (mcp): MCP-over-HTTP, sidecar in mcp mode, ingress mcp.drop-k8s.hackathon.forteapps.net. Plus two labeled Keycloak client config Secrets — the registrar creates the OIDC clients in the forte realm within ~2 min. Sealed secrets (forte-drop-secrets + auth-oidc) added in a follow-up commit by the maintainer: cd /Users/sten/dev/work/forte_k8/launchpad kubeseal --format=yaml \ --controller-name=sealed-secrets-controller \ --controller-namespace=kube-system \ < private/forte-drop-secrets.yaml \ > apps/base/forte-drop/forte-drop-secrets-sealed.yaml # auth-oidc: wait for registrar, copy client-secret into private/, # then seal as apps/base/forte-drop/auth-oidc-sealed.yaml. # (mcp deployment is sidecar type=mcp — no auth-oidc Secret needed; # only the web deployment requires it.)	2026-05-28 16:47:38 +02:00