No description
45c4cfd90c
Cilium-Envoy praatte h1 met de proxy → v4-gRPC-status-trailers vielen weg op het h1-chunked-trailer-pad. appProtocol h2c op de proxy-svc + http2 on op de nginx-listener → Envoy↔nginx↔zitadel h2 end-to-end, trailers native. |
||
|---|---|---|
| base | ||
| README.md | ||
bb-zitadel
Zitadel identity-provider blueprint voor bb-open-platform. Singleton
platform-service — geen tier-overlays. Aangestuurd via Flux Kustomization
in bb-open-platform-v2/clusters/proxy-nbg2-prod/platform-zitadel.yaml.
ADR-0042 Fase B — zie bb-open-platform-v2/docs/decisions/0042-mail-identity-stack-architectuur.md.
Layout
base/
├── namespace.yaml # PSS=restricted
├── cnpg-cluster.yaml # zitadel-db (CNPG, 3 instances, longhorn-default 20Gi)
├── scheduledbackup.yaml # daily 02:30 → s3 bbopen-backups/_platform/zitadel/
├── helmrepository.yaml # https://charts.zitadel.com
├── helmrelease.yaml # chart 8.x, replicas 3
├── ingress.yaml # id.bb-open.com cilium + DNS-01
└── kustomization.yaml
Pre-conditions
| Item | Bron |
|---|---|
Pass-item zitadel-masterkey |
proton-pass-sync mapping → Secret zitadel-masterkey in ns zitadel |
Pass-item hetzner-bbopen-backups-nbg1 |
proton-pass-sync mapping → Secret in ns zitadel (WAL-archive) |
DNS A id.bb-open.com |
ClouDNS → 167.235.104.23 (cluster-LB) |
| CNPG operator | bb-open-platform-v2/platform/cnpg-operator/ (Flux KS platform) |
cert-manager letsencrypt-dns01 |
bb-open-platform-v2/platform/cert-manager-issuers/ |
| Kyverno polex (geen UID-0 voor Zitadel) | Niet nodig — Zitadel chart draait non-root |
Smoke-test einde Fase B
curl https://id.bb-open.com/.well-known/openid-configuration→ valid JSON- Login admin (initial creds via Zitadel-bootstrap-Job log)
- OAuth Authorization Code flow via test-client → token