chore(iam): retire Authentik

Zitadel is running and has provisioned OIDC clients for all 12 consumers
(state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio,
vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to
serve until the last consumer moved.

Remove every Authentik artifact from GitOps:
- ArgoCD Application `authentik` and its Helm values
- ArgoCD Application `iam-jobs` (provisioner RBAC + migration job)
- ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart)
- authentik-db CNPG cluster definition
- authentik-secrets SOPS file and secret-generator entry
- Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite
- Prometheus alerts and ServiceMonitor
- admin OIDC ClusterRoleBinding provisioning binding
- scripts/iam/provision-rbac.py (the Authentik provisioner)

The chart repo https://charts.goauthentik.io is removed from the AppProject.

Kube-apiserver OIDC and consumer configs are switched to Zitadel in the
local cluster-config (gitignored) and applied separately via talosctl.

This commit is contained in:

rock

2026-10-26 03:32:18 -07:00

parent 7f96da880f

commit 81883a8ea1

21 changed files with 6 additions and 1223 deletions

									
										k8s/infra/databases/kustomization.yaml
									
		-1
	
												View File
												
				@@ -6,7 +6,6 @@ kind: Kustomization

				# deployed into it. paperless ns declared in namespaces.yaml above.

				resources:

				  - namespaces.yaml

				  - authentik-db.yaml

				  - zitadel-db.yaml

				  - temporal-db.yaml

				  - paperless-db.yaml