@cyc-seattle/platform 1.28.0 → 1.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +6 -5
  2. package/package.json +2 -1
package/README.md CHANGED
@@ -12,6 +12,7 @@ app owns. The apps that run on it live in their own repos, such as
12
12
  | [`infra`](stacks/infra) | The VPC, the cluster subnet and its Cloud NAT on a static address, the private services peering, the prod and dev Cloud SQL instances, the DNS zones, Artifact Registry and its cleanup policy, the GKE Autopilot cluster, the shared Gateway, its address, certificates, and dev's DNS records, the `dev` and `prod` namespaces with their quotas and network policies, dev's RBAC, the prod Job alerts, the log exclusions, and each environment's `platform/outputs.json` | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass. |
13
13
  | [`smoke`](stacks/smoke) | One `WebService` in dev, at `smoke.dev.cycsail.team`, for the integration tests | `deploy-dev`, from Actions for each queued PR. A deployer, with `PULUMI_STACK=dev mise run deploy`, when breaking glass. |
14
14
  | [`backend`](stacks/backend) | Directus, with the schema apply from `schemas/`, its roles, policies, and permission rules, the sync machine users, its OIDC client, and MCP, and the clubspot-sync and gsuite-sync CronJobs, with dev's Clubspot and Workspace fakes | `deploy-dev`, from Actions for each queued PR, and `deploy-runner` on a push to `main`, after `infra`. |
15
+ | [`authentik`](stacks/authentik) | Authentik, the sign-in at `login.<domain>`: its server and worker, database, secrets, and A record, dev's Mailpit, and its own configuration: flows, stages, policies, the Google source, the `staff` group, and the Directus OIDC and portal proxy applications | `deploy-dev`, from Actions for each queued PR, and `deploy-runner` on a push to `main`, after `backend`. |
15
16
 
16
17
  ## @cyc-seattle/platform
17
18
 
@@ -49,8 +50,8 @@ releases each merge to `main` with semantic-release, versioned by the convention
49
50
  ## Environments
50
51
 
51
52
  Every app runs on the one GKE Autopilot cluster, in its environment's namespace. Prod runs on
52
- regular capacity, and dev on Spot pods. isthmia's apps (Authentik and the portal) and platform's
53
- `backend` (Directus and the two syncs as CronJobs) run in both, and dev adds Mailpit and the Clubspot
53
+ regular capacity, and dev on Spot pods. isthmia's portal and platform's `authentik` and `backend`
54
+ (Directus and the two syncs as CronJobs) run in both, and dev adds Mailpit and the Clubspot
54
55
  and Workspace fakes. Dev's sync CronJobs are suspended: one scenario in each sync's feature and
55
56
  `mise run reset` run them as Jobs (cyc-seattle/isthmia#271).
56
57
 
@@ -117,8 +118,8 @@ changes, so a merge that changes nothing in prod asks for no approval. Dev build
117
118
  for every commit, and prod's CronJobs run the one built for theirs, so until cyc-seattle/isthmia#258
118
119
  every merge previews `backend`'s CronJobs as changed.
119
120
 
120
- `PULUMI_STACK` picks what the tasks run (`scripts/each-stack`): `dev` is `smoke`, then `backend`, and
121
- `prod` is `infra`, then `backend`. `integration` is dev only.
121
+ `PULUMI_STACK` picks what the tasks run (`scripts/each-stack`): `dev` is `smoke`, `backend`, then
122
+ `authentik`, and `prod` is `infra`, `backend`, then `authentik`. `integration` is dev only.
122
123
 
123
124
  `bootstrap` is never deployed from Actions (cyc-seattle/isthmia#118). It holds the identities that
124
125
  CI assumes, and a human with project Owner and `gh` `admin:org` applies it with the tasks below.
@@ -135,7 +136,7 @@ mise run deploy
135
136
  PULUMI_STACK=dev mise run deploy
136
137
  ```
137
138
 
138
- `mise run deploy` applies `infra`, then `backend`. isthmia's prod stacks read its outputs through a StackReference.
139
+ `mise run deploy` applies `infra`, `backend`, then `authentik`. isthmia's prod stacks read its outputs through a StackReference.
139
140
  Dev stacks can't read prod state, so `infra` writes each environment's platform
140
141
  values to `platform/outputs.json` in that environment's state bucket.
141
142
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cyc-seattle/platform",
3
- "version": "1.28.0",
3
+ "version": "1.29.0",
4
4
  "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
5
5
  "author": "CYC Community Sailing Center",
6
6
  "license": "Apache-2.0",
@@ -70,6 +70,7 @@
70
70
  "@cyc-seattle/gsuite-sdk": "^0.3.0",
71
71
  "@cyc-seattle/ts-config": "^0.1.2",
72
72
  "@electric-sql/pglite": "0.5.14",
73
+ "@pulumi/authentik": "file:./generated/authentik",
73
74
  "@pulumi/command": "1.3.0",
74
75
  "@pulumi/docker-build": "0.0.23",
75
76
  "@pulumi/gcp": "10.2.0",