coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

Browse Source 
privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-03-21 09:37:38 +00:00
parent bcae4bc6dd
commit bececac7b8
5 changed files with 31 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
sso-mfa/bootstrap/creds-bootstrap-agent.sh
View File

@@ -188,8 +188,17 @@ if [[ "$DRY_RUN" == false ]]; then
fi
done
[[ "$ALL_OK" == true ]] || die "One or more required secrets are missing — check creds-apply output above"
# Restart privacyIDEA if the deployment exists, so it picks up the newly
# generated secrets. Without this, a running pod would have stale env vars.
if kubectl get deployment privacyidea -n mfa &>/dev/null 2>&1; then
log "restarting privacyIDEA deployment to pick up new secrets..."
kubectl rollout restart deployment/privacyidea -n mfa
ok "privacyIDEA restart triggered"
fi
else
echo " [dry-run] would verify K8s secrets"
echo " [dry-run] would restart privacyIDEA if deployment exists"
fi
# ── Phase 5: Post-apply bootstrap — wait for privacyIDEA ──────────────────────

8
sso-mfa/k8s/network-policies/netpol-mfa.yaml
View File

@@ -1,8 +1,8 @@
# NetworkPolicies for the mfa namespace (privacyIDEA)
#
# Allowed paths:
# INGRESS: Traefik (kube-system) → privacyIDEA :5001 (user-facing portal)
# INGRESS: KeyCape (sso) → privacyIDEA :5001 (Provider API calls)
# INGRESS: Traefik (kube-system) → privacyIDEA :8080 (user-facing portal)
# INGRESS: KeyCape (sso) → privacyIDEA :8080 (Provider API calls)
# EGRESS: privacyIDEA → databases :5432 (PostgreSQL)
# EGRESS: all pods → kube-dns :53 (UDP+TCP)
#
@@ -42,7 +42,7 @@ spec:
matchLabels:
app.kubernetes.io/name: traefik
ports:
- port: 5001
- port: 8080
protocol: TCP
---
# ── Allow ingress from KeyCape (Provider API calls) ──────────────────────────
@@ -66,7 +66,7 @@ spec:
matchLabels:
app.kubernetes.io/name: keycape
ports:
- port: 5001
- port: 8080
protocol: TCP
---
# ── Allow egress to PostgreSQL ───────────────────────────────────────────────

6
sso-mfa/k8s/network-policies/netpol-sso.yaml
View File

@@ -13,7 +13,7 @@
# Allowed egress paths:
# keycape → authelia :9091 (OIDC callback orchestration)
# keycape → lldap :3890 (LDAP user lookups)
# keycape → mfa :5001 (privacyIDEA MFA check and token validation)
# keycape → mfa :8080 (privacyIDEA MFA check and token validation)
# authelia → lldap :3890 (LDAP authentication backend)
# all pods → kube-dns :53 (DNS resolution)
#
@@ -201,7 +201,7 @@ spec:
- port: 3890
protocol: TCP
---
# ── KeyCape egress → privacyIDEA (mfa namespace) :5001 ───────────────────────
# ── KeyCape egress → privacyIDEA (mfa namespace) :8080 ───────────────────────
# KeyCape calls privacyIDEA to check and validate MFA tokens.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
@@ -220,7 +220,7 @@ spec:
matchLabels:
net-kingdom/component: mfa
ports:
- port: 5001
- port: 8080
protocol: TCP
---
# ── Authelia egress → LLDAP (within sso namespace) ───────────────────────────

23
sso-mfa/k8s/privacyidea/deployment.yaml
View File

@@ -10,8 +10,8 @@
# 5. enckey-bootstrap.sh — extract enckey + audit keys, create DR Secrets
# 6. bootstrap-admin.sh — create pi-admin (+ MFA enrolment) and trigger-admin
#
# Container port: 5001.
# privacyidea/otpserver listens on port 5001 internally.
# Container port: 8080.
# ghcr.io/gpappsoft/privacyidea-docker listens on port 8080 (gunicorn).
apiVersion: apps/v1
kind: Deployment
@@ -53,14 +53,15 @@ spec:
containers:
- name: privacyidea
# Pin to a specific release; update via image update policy.
# Official image: https://hub.docker.com/r/privacyidea/otpserver
# privacyidea/privacyidea:3.12 does not exist — correct repo is otpserver.
image: privacyidea/otpserver:3.12.2
# Official image: https://github.com/gpappsoft/privacyidea-docker
# privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not exist.
# Correct image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2 (port 8080)
image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 5001
containerPort: 8080
protocol: TCP
# ── Environment — sensitive values from Secret ──────────────────
@@ -86,20 +87,20 @@ spec:
# Startup probe: give PI up to 3 min to run DB migrations on first boot.
startupProbe:
tcpSocket:
port: 5001
port: 8080
initialDelaySeconds: 15
periodSeconds: 10
failureThreshold: 18 # 18 × 10s = 3 min
livenessProbe:
tcpSocket:
port: 5001
port: 8080
initialDelaySeconds: 0
periodSeconds: 15
failureThreshold: 3
readinessProbe:
httpGet:
path: /token/
port: 5001
port: 8080
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
@@ -143,6 +144,6 @@ spec:
app.kubernetes.io/name: privacyidea
ports:
- name: http
port: 5001
targetPort: 5001
port: 8080
targetPort: 8080
protocol: TCP

6
sso-mfa/k8s/privacyidea/ingress.yaml
View File

@@ -46,7 +46,7 @@ spec:
service:
name: privacyidea
port:
number: 5001
number: 8080
tls:
- secretName: pink-tls
hosts:
@@ -83,7 +83,7 @@ spec:
service:
name: privacyidea
port:
number: 5001
number: 8080
tls:
- secretName: pink-tls
hosts:
@@ -114,7 +114,7 @@ spec:
service:
name: privacyidea
port:
number: 5001
number: 8080
tls:
- secretName: pink-account-tls
hosts: