homelab/apps
Watch
2
0
Fork
You've already forked apps
 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity

feat: stage remaining applications on GitOps group access #185

Merged
morten-olsen merged 16 commits from feat/homeit-474-remaining-access into main 2026-10-29 23:48:41 +01:00
Conversation 1 Commits 16 Files changed 34 +139 -32
morten-olsen commented 2026-10-29 23:44:58 +01:00
Owner

Summary

Migrate the remaining 16 OIDC applications from unmanaged access to GitOps groups: each app's own group OR shared/admin, matching the verified Mealie canary. Application groups start empty; administrator membership remains centrally declared. Morten approved full rollout on HOMEIT-474.

This PR is the complete Security review target. Its 16 commits retain per-app rollback boundaries. Before merging, the owner will temporarily block automatic/manual sync for precisely these 16 apps using an AppProject deny window, then release one app at a time only after the previous app passes live authorization. The temporary window is removed after completion.

Evidence

  • Before: 16 clients have no allowedGroups/application bindings; only Mealie is migrated.
  • All 16 local chart validation runs pass (dependencies, Helm lint, render/schema and chart tests); all 17 OIDC access render assertions pass.
  • Before/after object comparison and server dry-run verify the access objects; retained custom Dragonfly and Netbird client settings. CI is required at this exact head before merge. All non-identity rendered objects are unchanged (ignoring Helm chart version labels); all 16 new Group/Client pairs pass server dry-run.
  • Operator 0.2.0 and shared/admin are live and verified. Canary proved fresh allow/deny, Git grant/removal, drift/status recovery, missing/empty fail-closed behavior and restart stability.

Merge danger

Door: two-way for declared membership/grants. Managed clients deliberately stay closed if allowedGroups is removed; a blind chart downgrade does not restore legacy allow-all.

Blast radius: household. Every staged merge changes one application's fresh IdP authorization. Existing app sessions/tokens are not forcibly revoked. No application image, PVC, credential, user provisioning or release publishing change.

Rollback and verification

  • Roll back: retain explicit allowedGroups and restore the last working group/membership values through Git. Do not delete identity resources or remove the managed fields to recover access.
  • Verify after rollout: exact revision/mirror, Ready/AccessReady generations, group UID/PK and exact membership, unchanged provider/redirect/grant settings, permanent false guard and exactly own/admin group bindings, fresh Morten authorization code and unrelated akadmin denial before the next app.
  • Reviewers: Security Engineer reviews the complete concrete activation set; Software Engineer retains all merges, staged rollout and live checks.
## Summary Migrate the remaining 16 OIDC applications from unmanaged access to GitOps groups: each app's own group OR shared/admin, matching the verified Mealie canary. Application groups start empty; administrator membership remains centrally declared. Morten approved full rollout on HOMEIT-474. This PR is the complete Security review target. Its 16 commits retain per-app rollback boundaries. Before merging, the owner will temporarily block automatic/manual sync for precisely these 16 apps using an AppProject deny window, then release one app at a time only after the previous app passes live authorization. The temporary window is removed after completion. ## Evidence - Before: 16 clients have no allowedGroups/application bindings; only Mealie is migrated. - All 16 local chart validation runs pass (dependencies, Helm lint, render/schema and chart tests); all 17 OIDC access render assertions pass. - Before/after object comparison and server dry-run verify the access objects; retained custom Dragonfly and Netbird client settings. CI is required at this exact head before merge. All non-identity rendered objects are unchanged (ignoring Helm chart version labels); all 16 new Group/Client pairs pass server dry-run. - Operator 0.2.0 and shared/admin are live and verified. Canary proved fresh allow/deny, Git grant/removal, drift/status recovery, missing/empty fail-closed behavior and restart stability. ## Merge danger **Door:** two-way for declared membership/grants. Managed clients deliberately stay closed if allowedGroups is removed; a blind chart downgrade does not restore legacy allow-all. **Blast radius:** household. Every staged merge changes one application's fresh IdP authorization. Existing app sessions/tokens are not forcibly revoked. No application image, PVC, credential, user provisioning or release publishing change. ## Rollback and verification - **Roll back:** retain explicit allowedGroups and restore the last working group/membership values through Git. Do not delete identity resources or remove the managed fields to recover access. - **Verify after rollout:** exact revision/mirror, Ready/AccessReady generations, group UID/PK and exact membership, unchanged provider/redirect/grant settings, permanent false guard and exactly own/admin group bindings, fresh Morten authorization code and unrelated akadmin denial before the next app. - **Reviewers:** Security Engineer reviews the complete concrete activation set; Software Engineer retains all merges, staged rollout and live checks.
feat(windmill): declare GitOps application access
All checks were successful
ci/woodpecker/pr/charts Pipeline was successful
Details
ci/woodpecker/push/scan Pipeline was successful
Details
f82e0accee
morten-olsen reviewed 2026-10-29 23:47:53 +01:00
morten-olsen left a comment

Reviewed f82e0accee against 2ea2c625f3. Standards: no blocking findings. Independently rendered all 16 charts using published packages verified against fresh index SHA256: one empty-member prod/ AuthentikGroup per chart, group/client serverRef shared/authentik, allowedGroups exactly prod/ plus shared/admin. All other objects compare equal after dropping only helm.sh/chart labels; client specs otherwise identical, including Dragonfly public client, redirects, grants/scopes/subject/signing key and Netbird redirects/subject mode. No image source, exposure, RBAC, host privilege or credential change in this diff. Spec: no blocking source findings. Exact-head Forgejo status confirms Woodpecker #472 SUCCESS. Independently read Argo Applications: all 16 Synced/Healthy at baseline; apps AppProject syncWindows absent. AuthentikGroup/Client reads are Forbidden to this role; server dry-runs, remote membership/bindings and native canary results are supplied evidence from base main docs/evidence/authentik-mealie-canary.json, not independent live verification. Non-blocking operational constraints: install and verify the exact-16 deny window (including manual sync denial) BEFORE merge, then release one name at a time and require current Ready/AccessReady, exact UID/PK/membership/bindings and guard, unchanged provider, fresh Morten code issuance and unrelated akadmin denial before proceeding. Stop/close on failure; recover through Git retaining explicit managed allowedGroups, never blind downgrade/delete groups. Existing sessions/tokens are not revoked; record per-app lifetimes separately. Remaining 16 native checks are rollout acceptance still outstanding; Software Engineer retains ownership. Local Helm received a stale index; fresh index and digest-verified published packages resolved comparison, not a waiver. Standards: 0 blocking, 1 non-blocking operational constraint; Spec: 0 blocking, 1 non-blocking pending rollout acceptance.

Reviewed f82e0accee2566a837b54c5005d9e010a5460c01 against 2ea2c625f3269790c5ebf867c1c0c66ede1acd08. Standards: no blocking findings. Independently rendered all 16 charts using published packages verified against fresh index SHA256: one empty-member prod/<app> AuthentikGroup per chart, group/client serverRef shared/authentik, allowedGroups exactly prod/<app> plus shared/admin. All other objects compare equal after dropping only helm.sh/chart labels; client specs otherwise identical, including Dragonfly public client, redirects, grants/scopes/subject/signing key and Netbird redirects/subject mode. No image source, exposure, RBAC, host privilege or credential change in this diff. Spec: no blocking source findings. Exact-head Forgejo status confirms Woodpecker #472 SUCCESS. Independently read Argo Applications: all 16 Synced/Healthy at baseline; apps AppProject syncWindows absent. AuthentikGroup/Client reads are Forbidden to this role; server dry-runs, remote membership/bindings and native canary results are supplied evidence from base main docs/evidence/authentik-mealie-canary.json, not independent live verification. Non-blocking operational constraints: install and verify the exact-16 deny window (including manual sync denial) BEFORE merge, then release one name at a time and require current Ready/AccessReady, exact UID/PK/membership/bindings and guard, unchanged provider, fresh Morten code issuance and unrelated akadmin denial before proceeding. Stop/close on failure; recover through Git retaining explicit managed allowedGroups, never blind downgrade/delete groups. Existing sessions/tokens are not revoked; record per-app lifetimes separately. Remaining 16 native checks are rollout acceptance still outstanding; Software Engineer retains ownership. Local Helm received a stale index; fresh index and digest-verified published packages resolved comparison, not a waiver. Standards: 0 blocking, 1 non-blocking operational constraint; Spec: 0 blocking, 1 non-blocking pending rollout acceptance.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
homelab/apps!185
No description provided.