Replaces the 1m refresh (one GET a minute forever, to cover a boot-time
race). Temporal fetches the JWKS once at start and only retries on the
refreshInterval tick; an unknown kid triggers nothing. So an init
container makes the frontend wait until the JWKS answers with a key,
backing off 2-4-8-...-60 s, and refreshInterval goes back to 1h for key
rotations. The chart gives every server service the init containers;
for anything but the frontend it exits at once.
Checked: rendered on all five server Deployments; frontend Deployment
and its pod template pass a server-side dry run (Kyverno, restricted
PSS); the script exits 0 for frontend (keys up) and history (no-op) and
backs off as written against an unreachable URL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
The frontend fetches the JWKS once at start and then every
refreshInterval, and a failed fetch waits for the next tick too. After
the 2026-10-31 boot it started before Caddy listened (connection
refused) and refused every token for the following hour: Shikigami sat
in CrashLoopBackOff. 1m bounds that to a minute for one small GET.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
Scales on Shikigami's own /backlog via the metrics-api trigger, so
KEDA holds no credentials. 2.21.0 fixes GHSA-637c-6jxx-4rwm. Reach cut
down: Secrets in its own namespace only, scale targets Deployments +
StatefulSets only (drops the chart's */* get). Digest-pinned, no CPU
limits, namespace not part-of meru.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
Any Meru namespace can get a pki_meru cert for its own name; with the
internode side trusting pki_meru, that cert reached the internal-frontend
(admin, no token) and history/matching directly. A self-signed CA in the
temporal namespace (cert-manager) now issues the internode cert only.
The frontend stays on pki_meru + tokens.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
Every call to the frontend now needs a token from Authentik's
temporal-oidc provider (aud temporal, temporal_permissions claim,
default authorizer + claim mapper). Temporal's own parts move to the
internal-frontend (internode mTLS, no authorizer). The UI logs Mario in
with OIDC (D73) and forwards his token; its client secret comes from
OpenBao through ESO (shared role meru-eso).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
The tag exists. Each app's sindri-registration is taken over by ESO with
the same values (probed live in echo-build and thoth-build); the runners
restart once (chart label) and keep their registration on its volume.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
Placeholders for ESO (D66/D68). Still no Secrets. A namespace's SecretStore
can only log in as its own service accounts, and OpenBao binds each role to
one namespace, so an app can't reach another app's values by writing its
own store.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
ESO turns ExternalSecret placeholders in app repos into Secrets, read from
OpenBao with each namespace's own login (D66). Only the namespaced kinds
run: no ClusterSecretStore, ClusterExternalSecret, PushSecret or
ClusterGenerator. Images pinned by digest, probes and resources set, so
the cluster rules pass without an exception.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
MarioGLealP
