coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed P06 policy and completed platform acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:10:26 +02:00
parent a5496170cf
commit bea425cf78
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
sso-mfa/k8s/keycape/deployment.yaml
View file

@ -2,7 +2,8 @@
# #
# KeyCape orchestrates OIDC. Pending logins and authorization codes are process-local; # KeyCape orchestrates OIDC. Pending logins and authorization codes are process-local;
# use one replica with Recreate during replacement. Persistent identity state remains # use one replica with Recreate during replacement. Persistent identity state remains
# in Authelia, LLDAP and privacyIDEA. No PVC is required. # in Authelia, LLDAP and privacyIDEA. Scoped authentication policy and receipts
# persist separately in the keycape-authentication-policy PVC.
# #
# Configuration is stored entirely in the keycape-config Secret, which holds # Configuration is stored entirely in the keycape-config Secret, which holds
# a complete config.yaml and the RSA private key used to sign OIDC tokens # a complete config.yaml and the RSA private key used to sign OIDC tokens
@ -11,8 +12,9 @@
# Prerequisites (apply in order): # Prerequisites (apply in order):
# 1. keycape-config Secret — run keycape/create-secrets.sh # 1. keycape-config Secret — run keycape/create-secrets.sh
# 2. keycape-factor-read Secret — ESO delivery owned by railiance-platform RPF-WP-0040 # 2. keycape-factor-read Secret — ESO delivery owned by railiance-platform RPF-WP-0040
# 3. This file # 3. policy-pvc.yaml
# 4. middleware.yaml + ingress.yaml # 4. This file
# 5. middleware.yaml + ingress.yaml
# #
# Container image: # Container image:
# KeyCape publishes immutable main-<short-sha> tags through Forgejo Actions. # KeyCape publishes immutable main-<short-sha> tags through Forgejo Actions.
@ -50,7 +52,7 @@ spec:
- name: keycape - name: keycape
# Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
# KEY-WP-0012: canonical OIDC subject resolution for /userinfo. # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
image: forgejo.coulomb.social/coulomb/key-cape@sha256:d3c358ec793b59d519ea6b1dbe4172449745a57504474399984de6cd8703024d image: forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
ports: ports:
@ -59,6 +61,8 @@ spec:
protocol: TCP protocol: TCP
env: env:
- name: KEYCAPE_POLICY_PATH
value: /var/lib/keycape-policy/policy.json
- name: KEYCAPE_ACCOUNT_PORTAL_URL - name: KEYCAPE_ACCOUNT_PORTAL_URL
value: https://users.coulomb.social value: https://users.coulomb.social
- name: KEYCAPE_BROWSER_LOGOUT_URL - name: KEYCAPE_BROWSER_LOGOUT_URL
@ -83,6 +87,8 @@ spec:
key: client-secret key: client-secret
volumeMounts: volumeMounts:
- name: authentication-policy
mountPath: /var/lib/keycape-policy
- name: factor-token - name: factor-token
mountPath: /etc/keycape-factor mountPath: /etc/keycape-factor
readOnly: true readOnly: true
@ -122,6 +128,9 @@ spec:
memory: "128Mi" memory: "128Mi"
volumes: volumes:
- name: authentication-policy
persistentVolumeClaim:
claimName: keycape-authentication-policy
- name: factor-token - name: factor-token
secret: secret:
secretName: keycape-factor-read secretName: keycape-factor-read