coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(workplan): NK-WP-0003-T07 done — KeyCape running

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-03-22 00:32:45 +00:00
parent 880f89bf98
commit c8c6efbc55
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
workplans/NK-WP-0003-keycape-privacyidea-cluster-deployment.md
View File

@@ -214,17 +214,20 @@ Verify: `bash sso-mfa/k8s/verify-t05.sh` (covers LLDAP + Authelia together)
```task
id: NK-WP-0003-T07
status: blocked
status: done
priority: high
state_hub_task_id: "496a97c9-3e2a-486e-ba62-18449868c6cf"
note: Blocked 2026-03-21 — keycape:v0.1 image cannot be built on the k3s node (no Docker/Go).
Deployment applied; pod stuck in ImagePullBackOff.
Secrets keycape-config + keycape-pi-token already in cluster (both correct, real PI token).
Capability request filed: hub ID 0e0aefd7 (routed to railiance, direct msg sent to key-cape).
key-cape repo must deliver:
1. .github/workflows/publish.yml — build+push to ghcr.io/<owner>/keycape:v0.1 on main
2. Update net-kingdom/sso-mfa/k8s/keycape/deployment.yaml image: to GHCR reference
Once image is published: kubectl rollout restart deployment/keycape -n sso
note: Completed 2026-03-22. KEY-WP-0002 delivered image to Gitea OCI registry
(92.205.130.254:32166/coulomb/key-cape:latest). Three issues fixed:
1. deployment.yaml image ref updated to Gitea registry (correct namespace: coulomb)
2. k3s hosts.toml fixed: server endpoint must be http:// for plain-HTTP Gitea NodePort
(k3s generated https:// by default → "http: server gave HTTP response to HTTPS client")
3. keycape-config clients: [] → added demo-app client (required for startup + T08 tests)
Pod 1/1 Running; /healthz OK; OIDC discovery live.
Note: hosts.toml at /var/lib/rancher/k3s/agent/etc/containerd/certs.d/92.205.130.254:32166/
is generated from /etc/rancher/k3s/registries.yaml — will revert on k3s restart.
Permanent fix: registries.yaml mirror config generates HTTPS server by default;
need to manually maintain hosts.toml or find k3s config that forces HTTP server.
```
Deploy KeyCape into the `sso` namespace.