mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
aeaedd8603
The TEMPORAL_AUTH_AUTHORIZER=default + TEMPORAL_JWT_KEY_SOURCE1 env vars cause the internal system workers (scanner, archiver) to fail with "Request unauthorized" because they connect to the public frontend without a JWT token. Enabling USE_INTERNAL_FRONTEND=true creates a separate unauthenticated frontend on port 7236, but the worker SDK fails to connect with "context deadline exceeded". For now, auth is UI-only (OIDC login via hanzo.id). The gRPC API is network-restricted. JWT auth env vars are documented as TODO in the deployment manifest for future enablement once internal-frontend is properly wired. Also fix kustomization.yaml to not use kustomize labels (conflicts with live immutable deployment selectors) and add matching selector labels directly to deployment.yaml.
16 lines
425 B
YAML
16 lines
425 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: hanzo
|
|
|
|
resources:
|
|
- kms-secrets.yaml
|
|
- configmap.yaml
|
|
- deployment.yaml
|
|
- ingress.yaml
|
|
|
|
# Labels are applied directly in deployment.yaml to match the existing
|
|
# live selector labels (selectors are immutable in K8s deployments).
|
|
# DO NOT add a kustomize labels block here -- it will conflict with
|
|
# the already-deployed selector matchLabels.
|