Move auth onto the estate path #80

Activity

1. ExtraToast

   self-assigned this

   on Oct 1, 2026
2. ExtraToast

   added

   type: featureNew user-facing or operator-facing capability.New user-facing or operator-facing capability.

   area: deployhomelab-deploy, deploy-v2, manifests, and rollout flow.homelab-deploy, deploy-v2, manifests, and rollout flow.

   priority: P2Medium; normal planned work.Medium; normal planned work.

   status: ready-for-agentFully specified; an agent may take it with nobody watching.Fully specified; an agent may take it with nobody watching.

   on Oct 1, 2026
3. ExtraToast

   added a parent issue on Oct 1, 2026

   • Estate delivery: deploy with deploy-kit, pause and roll back, watch it from one dashboard deploy-kit#195
4. ExtraToast

   marked this as blocked by 2 issues on Oct 1, 2026

   • Slice 3b: render auth, with its migration Jobs and identity deploy-kit#200
   • Release Gate: migrations, the guarded Down, held reporting and alerts delivery#3
5. ExtraToast

   marked this as blocking on Oct 1, 2026

   • Move the agents platform onto the estate path agents-api#89
6. ExtraToast commented on Oct 23, 2026

   

   ExtraToast

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Blocker update 2026-10-23: JorisJonkers-dev/deploy-kit#200 (closed 2026-10-05) and JorisJonkers-dev/delivery#3 (closed 2026-10-05) are done. JorisJonkers-dev/homelab-collections#15 is still open; the auth handover is being prepared now, so this stays open.
7. ExtraToast

   removed a parent issue on Oct 23, 2026

   • Estate delivery: deploy with deploy-kit, pause and roll back, watch it from one dashboard deploy-kit#195
8. ExtraToast

   added a parent issue on Oct 23, 2026

   • Epic: hand over the remaining Projects estate#204
9. ExtraToast

   marked this as blocking 2 issues on Oct 23, 2026

   • Move Vault to secrets-system and hand secrets over to the estate path estate#209
   • Retire fleet-infra as a Flux source estate#211
10. ExtraToast

    added

    status: in-progressActively being worked.Actively being worked.

    and removed

    status: ready-for-agentFully specified; an agent may take it with nobody watching.Fully specified; an agent may take it with nobody watching.

    on Oct 23, 2026
11. ExtraToast commented on Oct 23, 2026

    

    ExtraToast

    on Oct 23, 2026

    ContributorAuthor

    More actions

    Handover prepared as is on deploy-kit 0.31 (operator decision 2026-10-23), part of JorisJonkers-dev/estate#204. Nothing is merged and nothing live has changed.

    Order: JorisJonkers-dev/fleet-infra#533 (orphan) → #534 (drop) → JorisJonkers-dev/auth-ui#57 released → #113 released → JorisJonkers-dev/estate#214 (ledger, draft, in the window) → fleet-infra#535 (Vault clean-up). Runbook: JorisJonkers-dev/estate#213 (docs/runbooks/auth-handover.md).

    This differs from the description above: migration: self stays, and there is no gate-run migration or auth-migration image.
12. ExtraToast

    added 4 commits that reference this issue on Oct 23, 2026

    docs: the runbook for handing auth over to the estate path (#213)

    ...

    a84b7df

    feat: serve the sign-in UI from the unprivileged nginx on 8080 (#57)

    ...

    5d76c89

    feat: configure auth-api and auth-ui for the estate path (#113)

    ...

    51a13d4

    feat: hand auth over to the estate path (#214)

    ...

    e4eec38
13. ExtraToast commented on Oct 23, 2026

    

    ExtraToast

    on Oct 23, 2026

    ContributorAuthor

    More actions

    Done on 23 October 2026, about 13:45–14:00 UTC, with no outage (the OIDC discovery endpoint answered 200 throughout).

    • Released: auth-ui 0.7.0 (fix(auth): keep a stale bearer token from blocking sign-in #57/chore(main): release 0.7.1 #58), auth-api 0.20.0 (feat: configure auth-api and auth-ui for the estate path #113/chore(main): release 0.20.0 #114), estate 0.30.0 (estate#214). fleet-infra#533, #540 and #541 (which replaced #535) are merged.
    • auth now runs on the estate path. Both Canaries are Initialized, the Services select *-primary, and the pods run without the injector (auth-api uid 65532, auth-ui uid 101).
    • Cleaned up: the old ReplicaSets, ServiceMonitor auth-api, PDB auth-ui and secret ghcr-creds.
    • Verified: issuer, JWKS, forward-auth redirect, and the auth-api logs (only the two expected secret/application 403s). The old auth-api Vault policy now grants only secret/auth-api, database/creds and transit. Browser sign-in works on several clients.
    • Not yet checked: the password-reset mail, Tempo traces, up{job="auth-api"}.
14. ExtraToast

    closed this as completedon Oct 23, 2026