diff --git a/sso-mfa/bootstrap/creds-bootstrap-agent.sh b/sso-mfa/bootstrap/creds-bootstrap-agent.sh index 9829add..455b684 100755 --- a/sso-mfa/bootstrap/creds-bootstrap-agent.sh +++ b/sso-mfa/bootstrap/creds-bootstrap-agent.sh @@ -188,8 +188,17 @@ if [[ "$DRY_RUN" == false ]]; then fi done [[ "$ALL_OK" == true ]] || die "One or more required secrets are missing — check creds-apply output above" + + # Restart privacyIDEA if the deployment exists, so it picks up the newly + # generated secrets. Without this, a running pod would have stale env vars. + if kubectl get deployment privacyidea -n mfa &>/dev/null 2>&1; then + log "restarting privacyIDEA deployment to pick up new secrets..." + kubectl rollout restart deployment/privacyidea -n mfa + ok "privacyIDEA restart triggered" + fi else echo " [dry-run] would verify K8s secrets" + echo " [dry-run] would restart privacyIDEA if deployment exists" fi # ── Phase 5: Post-apply bootstrap — wait for privacyIDEA ────────────────────── diff --git a/sso-mfa/k8s/network-policies/netpol-mfa.yaml b/sso-mfa/k8s/network-policies/netpol-mfa.yaml index b6b6122..6429700 100644 --- a/sso-mfa/k8s/network-policies/netpol-mfa.yaml +++ b/sso-mfa/k8s/network-policies/netpol-mfa.yaml @@ -1,8 +1,8 @@ # NetworkPolicies for the mfa namespace (privacyIDEA) # # Allowed paths: -# INGRESS: Traefik (kube-system) → privacyIDEA :5001 (user-facing portal) -# INGRESS: KeyCape (sso) → privacyIDEA :5001 (Provider API calls) +# INGRESS: Traefik (kube-system) → privacyIDEA :8080 (user-facing portal) +# INGRESS: KeyCape (sso) → privacyIDEA :8080 (Provider API calls) # EGRESS: privacyIDEA → databases :5432 (PostgreSQL) # EGRESS: all pods → kube-dns :53 (UDP+TCP) # @@ -42,7 +42,7 @@ spec: matchLabels: app.kubernetes.io/name: traefik ports: - - port: 5001 + - port: 8080 protocol: TCP --- # ── Allow ingress from KeyCape (Provider API calls) ────────────────────────── @@ -66,7 +66,7 @@ spec: matchLabels: app.kubernetes.io/name: keycape ports: - - port: 5001 + - port: 8080 protocol: TCP --- # ── Allow egress to PostgreSQL ─────────────────────────────────────────────── diff --git a/sso-mfa/k8s/network-policies/netpol-sso.yaml b/sso-mfa/k8s/network-policies/netpol-sso.yaml index 0b09a04..30b5408 100644 --- a/sso-mfa/k8s/network-policies/netpol-sso.yaml +++ b/sso-mfa/k8s/network-policies/netpol-sso.yaml @@ -13,7 +13,7 @@ # Allowed egress paths: # keycape → authelia :9091 (OIDC callback orchestration) # keycape → lldap :3890 (LDAP user lookups) -# keycape → mfa :5001 (privacyIDEA MFA check and token validation) +# keycape → mfa :8080 (privacyIDEA MFA check and token validation) # authelia → lldap :3890 (LDAP authentication backend) # all pods → kube-dns :53 (DNS resolution) # @@ -201,7 +201,7 @@ spec: - port: 3890 protocol: TCP --- -# ── KeyCape egress → privacyIDEA (mfa namespace) :5001 ─────────────────────── +# ── KeyCape egress → privacyIDEA (mfa namespace) :8080 ─────────────────────── # KeyCape calls privacyIDEA to check and validate MFA tokens. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -220,7 +220,7 @@ spec: matchLabels: net-kingdom/component: mfa ports: - - port: 5001 + - port: 8080 protocol: TCP --- # ── Authelia egress → LLDAP (within sso namespace) ─────────────────────────── diff --git a/sso-mfa/k8s/privacyidea/deployment.yaml b/sso-mfa/k8s/privacyidea/deployment.yaml index 8a46edf..6ff3ecd 100644 --- a/sso-mfa/k8s/privacyidea/deployment.yaml +++ b/sso-mfa/k8s/privacyidea/deployment.yaml @@ -10,8 +10,8 @@ # 5. enckey-bootstrap.sh — extract enckey + audit keys, create DR Secrets # 6. bootstrap-admin.sh — create pi-admin (+ MFA enrolment) and trigger-admin # -# Container port: 5001. -# privacyidea/otpserver listens on port 5001 internally. +# Container port: 8080. +# ghcr.io/gpappsoft/privacyidea-docker listens on port 8080 (gunicorn). apiVersion: apps/v1 kind: Deployment @@ -53,14 +53,15 @@ spec: containers: - name: privacyidea # Pin to a specific release; update via image update policy. - # Official image: https://hub.docker.com/r/privacyidea/otpserver - # privacyidea/privacyidea:3.12 does not exist — correct repo is otpserver. - image: privacyidea/otpserver:3.12.2 + # Official image: https://github.com/gpappsoft/privacyidea-docker + # privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not exist. + # Correct image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2 (port 8080) + image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2 imagePullPolicy: IfNotPresent ports: - name: http - containerPort: 5001 + containerPort: 8080 protocol: TCP # ── Environment — sensitive values from Secret ────────────────── @@ -86,20 +87,20 @@ spec: # Startup probe: give PI up to 3 min to run DB migrations on first boot. startupProbe: tcpSocket: - port: 5001 + port: 8080 initialDelaySeconds: 15 periodSeconds: 10 failureThreshold: 18 # 18 × 10s = 3 min livenessProbe: tcpSocket: - port: 5001 + port: 8080 initialDelaySeconds: 0 periodSeconds: 15 failureThreshold: 3 readinessProbe: httpGet: path: /token/ - port: 5001 + port: 8080 initialDelaySeconds: 0 periodSeconds: 10 failureThreshold: 3 @@ -143,6 +144,6 @@ spec: app.kubernetes.io/name: privacyidea ports: - name: http - port: 5001 - targetPort: 5001 + port: 8080 + targetPort: 8080 protocol: TCP diff --git a/sso-mfa/k8s/privacyidea/ingress.yaml b/sso-mfa/k8s/privacyidea/ingress.yaml index 52ac68b..523c074 100644 --- a/sso-mfa/k8s/privacyidea/ingress.yaml +++ b/sso-mfa/k8s/privacyidea/ingress.yaml @@ -46,7 +46,7 @@ spec: service: name: privacyidea port: - number: 5001 + number: 8080 tls: - secretName: pink-tls hosts: @@ -83,7 +83,7 @@ spec: service: name: privacyidea port: - number: 5001 + number: 8080 tls: - secretName: pink-tls hosts: @@ -114,7 +114,7 @@ spec: service: name: privacyidea port: - number: 5001 + number: 8080 tls: - secretName: pink-account-tls hosts: