From fbe8a083bde3bc24dba97edaba8f5091bc9a7c59 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 28 Sep 2026 09:10:03 +0800
Subject: [PATCH] fix(poimen-frontend): remove speculative COREPACK env
 workarounds

Root cause fixed in Dockerfile (corepack prepare at build time).
No env overrides needed in the deployment.
---
 k8s/apps/poimen/frontend-deployment.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/k8s/apps/poimen/frontend-deployment.yaml b/k8s/apps/poimen/frontend-deployment.yaml
index ccef17a..985cd18 100644
--- a/k8s/apps/poimen/frontend-deployment.yaml
+++ b/k8s/apps/poimen/frontend-deployment.yaml
@@ -55,11 +55,10 @@ spec:
                   name: poimen-config
                   key: POIMEN_MEMORY_URL
             # OIDC — uses same client as existing poimen services
+            # Use in-cluster Authentik (port 80 → pod 9000) to avoid Cloudflare hairpin.
+            # External URL in poimen-secrets is for out-of-cluster clients only.
             - name: LLM_OIDC_TOKEN_URL
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: LLM_OIDC_TOKEN_URL
+              value: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
             - name: LLM_OIDC_CLIENT_ID
               valueFrom:
                 secretKeyRef: