feat(argocd): Disable local admin account

apps/garage-ui/httproute.yaml

@@ -14,23 +14,9 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
     - backendRefs:
         - name: garage-ui
           port: 80
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - middleware.yaml
   - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: garage
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

argocd-apps/add-ons/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - anubis-operator.yaml
   - argocd-dashboard.yaml
   - argocd-repos.yaml
   - authentik.yaml

argocd-apps/services/garage-ui.yaml

@@ -27,7 +27,9 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: false
+                enabled: true
+                existingSecret:
+                  name: garage-ui-secrets
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:

argocd-apps/services/redoost.yaml

@@ -39,19 +39,6 @@ spec:
             websiteUpstream: garage.garage.svc.cluster.local:3902
             bucket: redoost-sites
             existingSecret: redoost-s3
-          networkPolicy:
-            enabled: true
-            gateway:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: traefik
-            s3:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: garage
-                podSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: garage
     - path: apps/redoost
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

bootstrap/argocd-cm-oidc-patch.yaml

@@ -8,7 +8,6 @@ data:
     issuer: https://auth.whyredfire.dev/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:clientSecret
-    enablePKCEAuthentication: true
     requestedScopes:
       - openid
       - profile

infra/authentik/blueprints.yaml

@@ -4,11 +4,18 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
+  # Google is the only way in: its source has no enrollment flow, so a Google
+  # account can only log in when a user with the same email already exists.
   google-login.yaml: |
     version: 1
     metadata:
       name: Google login
     entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-authentication-flow.yaml
+          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -41,29 +48,8 @@ data:
           provider_type: google
           user_matching_mode: email_link
       - model: authentik_stages_identification.identificationstage
-        id: google-identification
         identifiers:
-          name: google-identification
+          name: default-authentication-identification
         attrs:
           sources:
             - !KeyOf google
-          user_fields: []
-      - model: authentik_flows.flow
-        id: google-flow
-        identifiers:
-          slug: google-login
-        attrs:
-          authentication: require_unauthenticated
-          designation: authentication
-          name: Google login
-          title: Welcome!
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf google-identification
-          target: !KeyOf google-flow
-      - model: authentik_brands.brand
-        identifiers:
-          domain: authentik-default
-        attrs:
-          flow_authentication: !KeyOf google-flow

infra/authentik/httproute.yaml

@@ -14,20 +14,6 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    # The ArgoCD Android app posts to the token endpoint without its trailing slash
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              replaceFullPath: /application/o/token/
-              type: ReplaceFullPath
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
     - backendRefs:
         - name: authentik-server
           port: 80

infra/authentik/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
-  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -1,17 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: ReferenceGrant
-metadata:
-  name: outpost
-  namespace: authentik
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: garage
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: qbit
-  to:
-    - group: ""
-      kind: Service
-      name: authentik-server