feat(iam): wire all 9 consumer manifests to Zitadel OIDC

Co-authored-by: rock <[email protected]>

k8s/infra/logging/grafana-values.yaml

@@ -60,28 +60,28 @@ grafana.ini:
   database:
     wal: true
 
-  # ── Authentik OIDC (generic OAuth2) ───────────────────────────────────────
+  # ── ZITADEL OIDC (generic OAuth2) ────────────────────────────────────────
   # Grafana v10+ supports OIDC auto-discovery; we wire it manually here because
-  # Authentik's discovery endpoint is internal-only (no external DNS for iam.svc).
+  # ZITADEL's discovery endpoint is internal-only (no external DNS for iam.svc).
   # All URLs use the external hostname so CoreDNS rewrites them to
-  # authentik-server.iam.svc — this keeps the Host header correct so Authentik
+  # zitadel.iam.svc — this keeps the Host header correct so ZITADEL
   # doesn't return localhost redirects in its token responses.
   #
   # role_attribute_path: JMESPath expression evaluated against the userinfo
   # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
-  # homelab-admins members get Admin (org admin); everyone else Viewer.
+  # homelab-admins role members get Admin (org admin); everyone else Viewer.
   auth.generic_oauth:
     enabled: true
-    name: Authentik
+    name: Zitadel
     allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: grafana
+    client_id: 396757801965191169
     scopes: openid email profile groups
-    auth_url: https://authentik.riotpiao.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.com/application/o/token/
-    api_url: https://authentik.riotpiao.com/application/o/userinfo/
+    auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
+    token_url: https://zitadel.riotpiao.com/oauth/v2/token
+    api_url: https://zitadel.riotpiao.com/oidc/v1/userinfo
     # Read identity straight from the userinfo/id_token claims. Without these,
     # Grafana falls back to the GitHub-style "<api_url>/emails" call, which
-    # Authentik doesn't serve — request 404s with "Error getting email address"
+    # ZITADEL doesn't serve — request 404s with "Error getting email address"
     # and the whole OAuth login fails.
     email_attribute_path: email
     login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
@@ -91,10 +91,10 @@ grafana.ini:
     use_pkce: false
     use_refresh_token: false
     skip_org_role_sync: false  # Sync org roles from OAuth groups
-    tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
+    tls_skip_verify_insecure: true   # In-cluster cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s
-# Secret (created by k8s/talos-iam/setup_talos_iam.sh). envFromSecret mounts
+# Secret (k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml). envFromSecret mounts
 # every key in that secret as an environment variable — keeps secrets out of
 # values files and out of git.
 envFromSecret: grafana-oidc

k8s/infra/minio/minio-tenant.yaml

@@ -103,17 +103,17 @@ spec:
         - https://minio-api.riotpiao.com
       console: https://minio.riotpiao.com
 
-  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
-  # Use in-cluster URL for config fetch (pod→authentik); browser redirects use
-  # public URLs embedded in the OIDC metadata response (issuer stays public).
+  # ── OIDC via ZITADEL (server-side env, valid in v2 schema) ──────────────────
+  # Use external URL for config fetch (hairpins through ingress-nginx); browser
+  # redirects use public URLs embedded in the OIDC metadata response.
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       # Must use external URL — well-known response contains external issuer/jwks_uri.
       # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
       # Hairpins through ingress-nginx but stays in-cluster.
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+      value: "https://zitadel.riotpiao.com/.well-known/openid-configuration"
     - name: MINIO_IDENTITY_OPENID_CLIENT_ID
-      value: "minio"
+      value: "396757803257036801"
     - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
       valueFrom:
         secretKeyRef:
@@ -126,7 +126,7 @@ spec:
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
-      value: "Authentik"
+      value: "Zitadel"
     - name: MINIO_IDENTITY_OPENID_SCOPES
       value: "openid,profile,email,groups"
     - name: MINIO_BROWSER_LOGIN_ANIMATION

k8s/infra/monitoring/blackbox-exporter-values.yaml

@@ -43,8 +43,8 @@ serviceMonitor:
       url: https://grafana.riotpiao.com/
     - name: loki
       url: https://loki.riotpiao.com/ready
-    - name: authentik
-      url: https://authentik.riotpiao.com/-/health/ready/
+    - name: zitadel
+      url: https://zitadel.riotpiao.com/debug/ready
     - name: vault
       url: https://vault.riotpiao.com/v1/sys/health
     - name: minio-console