fix: gateway authentik port 80→9000 + encrypt internal infrastructure URLs

Browse Source

Security improvements:
- Fix NetworkPolicy port: gateway→authentik 80→9000
- Encrypt internal cluster DNS names (.svc.cluster.local)
- SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata)
- Only sensitive URLs are encrypted, not the config structure

What's encrypted:
✓ jwksUrl, tokenUrl (authentik endpoints)
✓ All upstream service URLs (.svc.cluster.local)
✓ Internal infrastructure topology

What stays readable:
✓ apiVersion, kind (Kubernetes needs these)
✓ metadata.name, namespace (pod identification)
✓ Configuration structure

Fixes JWT validation failures and 401 errors on LLM requests.

...

This commit is contained in:

Admin Bot

2026-09-13 08:58:07 +09:00

parent 45254a48b0

commit db3a30fbcf

2 changed files with 24 additions and 153 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/configmap.yaml

+20 -153

File diff suppressed because one or more lines are too long