From 45254a48b0066f9cda1d07e345c53f80537a35b5 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sun, 13 Sep 2026 08:48:00 +0900
Subject: [PATCH] fix: gateway authentik port from 80 to 9000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NetworkPolicy allows gateway→iam only on ports 9000/9443, but config
used port 80 for JWKS fetch and token endpoints. This caused
'operation not permitted' errors and JWKS refresh failures.

Affects:
- auth.jwksUrl: uses port 9000 (Authentik HTTP)
- auth.tokenUrl: uses port 9000 for token exchange
- iam adapter upstream: routes to port 9000

Fixes: Gateway unable to validate JWT tokens, all chat/inference requests
returned 401 with 'token is unverifiable' error.
---
 k8s/configmap.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index f5a0807..b1c62b8 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -15,9 +15,9 @@ data:
       enabled: true
       issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
       audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
       requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
       clientId: "api-gw"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)
@@ -137,7 +137,7 @@ data:
 
     - serviceName: iam
       upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
+        url: http://authentik-server.iam.svc.cluster.local:9000
         timeoutSeconds: 30
       auth:
         required: false