Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Renovate Bot
|
c42653d064 |
@@ -23,15 +23,14 @@ jobs:
|
||||
REVIEW__INLINE_COMMENT_FALLBACK: "false"
|
||||
# LLM configuration
|
||||
LLM__PROVIDER: CLAUDE
|
||||
LLM__META__MODEL: claude-sonnet-5-5
|
||||
LLM__META__REASONING__EFFORT: high
|
||||
LLM__META__MODEL: claude-3-opus
|
||||
LLM__META__MAX_TOKENS: "4096"
|
||||
LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
|
||||
LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v7
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
submodules: true
|
||||
fetch-depth: 0
|
||||
@@ -41,11 +40,11 @@ jobs:
|
||||
run: git submodule update --remote --merge
|
||||
|
||||
- name: Run inline review
|
||||
uses: docker://nikitafilonov/ai-review:v1.1.0
|
||||
uses: docker://nikitafilonov/ai-review:v0.64.0
|
||||
with:
|
||||
args: ai-review run-inline
|
||||
|
||||
- name: Run summary review
|
||||
uses: docker://nikitafilonov/ai-review:v1.1.0
|
||||
uses: docker://nikitafilonov/ai-review:v0.64.0
|
||||
with:
|
||||
args: ai-review run-summary
|
||||
|
||||
@@ -9,7 +9,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v7
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Install TruffleHog
|
||||
|
||||
@@ -29,7 +29,7 @@ spec:
|
||||
topologyKey: kubernetes.io/hostname
|
||||
initContainers:
|
||||
- name: gitea-dump
|
||||
image: gitea/gitea:1.27.3
|
||||
image: gitea/gitea:1.25.4
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
|
||||
+16
-16
@@ -1,27 +1,27 @@
|
||||
{
|
||||
"$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
|
||||
"packages": [
|
||||
"kubectl@1.36.3",
|
||||
"kubernetes-helm@4.2.4",
|
||||
"kubectl@1.33.2",
|
||||
"kubernetes-helm@3.18.4",
|
||||
"k9s@0.51.0",
|
||||
"kubeseal@0.38.4",
|
||||
"kubeseal@0.30.0",
|
||||
"argocd@3.4.6",
|
||||
"kubecm@0.35.1",
|
||||
"kubecm@0.33.1",
|
||||
"kubectl-tree@0.6.0",
|
||||
"kind@0.32.0",
|
||||
"kustomize@5.8.1",
|
||||
"kyverno@1.19.0",
|
||||
"syft@1.51.0",
|
||||
"kind@0.29.0",
|
||||
"kustomize@5.7.0",
|
||||
"kyverno@1.14.3",
|
||||
"syft@1.29.0",
|
||||
"grype@0.118.0",
|
||||
"traefik@3.7.10",
|
||||
"claude-code@2.1.245",
|
||||
"traefik@3.6.7",
|
||||
"claude-code@0.2.122",
|
||||
"go@latest",
|
||||
"dotnet-sdk@8.0.424",
|
||||
"opentofu@1.12.5",
|
||||
"_1password@2.30.0",
|
||||
"github-cli@2.23.0",
|
||||
"upcloud-cli@3.36.0",
|
||||
"awscli2@2.35.11"
|
||||
"dotnet-sdk@2.1.810",
|
||||
"opentofu@1.11.6",
|
||||
"_1password@1.12.2",
|
||||
"github-cli@latest",
|
||||
"upcloud-cli@3.29.0",
|
||||
"awscli2@2.34.24"
|
||||
],
|
||||
"shell": {
|
||||
"init_hook": [
|
||||
|
||||
@@ -1469,12 +1469,6 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
|
||||
| `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
|
||||
| `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
|
||||
|
||||
#### Public CLI Client (Device-Code Login)
|
||||
|
||||
`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
|
||||
|
||||
It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
|
||||
|
||||
### Retrieving Secrets for External Deployments
|
||||
|
||||
The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
source:
|
||||
repoURL: https://charts.jetstack.io
|
||||
chart: cert-manager
|
||||
targetRevision: "v1.21.2"
|
||||
targetRevision: "v1.14.0"
|
||||
|
||||
helm:
|
||||
values: |
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://dl.gitea.com/charts
|
||||
chart: actions
|
||||
targetRevision: "0.1.2"
|
||||
targetRevision: "0.0.5"
|
||||
helm:
|
||||
releaseName: gitea-actions
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://dl.gitea.com/charts
|
||||
chart: gitea
|
||||
targetRevision: "12.7.0"
|
||||
targetRevision: "12.6.0"
|
||||
helm:
|
||||
releaseName: gitea
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://grafana.github.io/helm-charts
|
||||
chart: grafana
|
||||
targetRevision: "8.15.0"
|
||||
targetRevision: "8.0.0"
|
||||
helm:
|
||||
releaseName: grafana
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://grafana.github.io/helm-charts
|
||||
chart: loki
|
||||
targetRevision: "7.3.0"
|
||||
targetRevision: "7.0.0"
|
||||
helm:
|
||||
releaseName: loki
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://opencost.github.io/opencost-helm-chart
|
||||
chart: opencost
|
||||
targetRevision: "2.5.32"
|
||||
targetRevision: "1.42.0"
|
||||
helm:
|
||||
releaseName: opencost
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://prometheus-community.github.io/helm-charts
|
||||
chart: prometheus
|
||||
targetRevision: "28.16.0"
|
||||
targetRevision: "28.9.0"
|
||||
helm:
|
||||
releaseName: prometheus
|
||||
valueFiles:
|
||||
|
||||
@@ -24,7 +24,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://traefik.github.io/charts
|
||||
chart: traefik
|
||||
targetRevision: "28.3.0"
|
||||
targetRevision: "28.0.0"
|
||||
helm:
|
||||
releaseName: traefik
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://guerzon.github.io/vaultwarden
|
||||
chart: vaultwarden
|
||||
targetRevision: "0.46.2"
|
||||
targetRevision: "0.36.4"
|
||||
helm:
|
||||
releaseName: vaultwarden
|
||||
valueFiles:
|
||||
|
||||
@@ -186,21 +186,6 @@ keycloakConfigCli:
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"clientId": "forte-cli",
|
||||
"name": "Forte CLI",
|
||||
"description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"standardFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"publicClient": true,
|
||||
"redirectUris": [],
|
||||
"webOrigins": [],
|
||||
"attributes": {
|
||||
"oauth2.device.authorization.grant.enabled": "true"
|
||||
}
|
||||
}
|
||||
],
|
||||
"browserFlow": "browser-auto-idp",
|
||||
@@ -686,7 +671,7 @@ extraDeploy:
|
||||
MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
|
||||
|
||||
# Hardcoded protected clients (never delete these)
|
||||
PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
|
||||
PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
|
||||
|
||||
echo "Fetching clients from realm '${REALM}'..."
|
||||
CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
|
||||
|
||||
+1
-1
Submodule shared-prompts updated: 97057a4436...b79858d73c
Reference in New Issue
Block a user