chore(authentik): finish the retirement in Terraform and messaging

The live cluster has no Authentik workload, no DNS record and no tunnel route,
but two declarations still pointed at it.

controlplane.tftpl still set kube-apiserver oidc-issuer-url to
https://authentik.riotpiao.com/application/o/kubernetes/ and pinned that hostname
in extraHostEntries. The live API server carries zero OIDC arguments, so the
template and reality had diverged: the next machine-config render would have
re-added an issuer that does not resolve.

management-service exported KMSVC_AUTHENTIK_ISSUER_URL and
KMSVC_AUTHENTIK_AUDIENCE, both empty. Rename them to KMSVC_ZITADEL_* so the names
describe the identity provider that actually exists.

The CoreDNS Corefile kept one rewrite for authentik.riotpiao.com. The Terraform
source file no longer contains it, so the live ConfigMap was stale; that line is
removed live and the next render converges without it.

k8s/apps/messaging/management-service/templates/configmap.yaml

@@ -6,7 +6,7 @@ metadata:
 data:
   KMSVC_KAFKA_BROKERS: {{ .Values.env.kafkaBrokers | quote }}
   KMSVC_REDIS_ADDR: {{ .Values.env.redisAddr | quote }}
-  KMSVC_AUTHENTIK_ISSUER_URL: {{ .Values.env.authentikIssuerURL | quote }}
-  KMSVC_AUTHENTIK_AUDIENCE: {{ .Values.env.authentikAudience | quote }}
+  KMSVC_ZITADEL_ISSUER_URL: {{ .Values.env.zitadelIssuerURL | quote }}
+  KMSVC_ZITADEL_AUDIENCE: {{ .Values.env.zitadelAudience | quote }}
   KMSVC_GRPC_LISTEN_ADDR: ":{{ .Values.grpcPort }}"
   KMSVC_HTTP_LISTEN_ADDR: ":{{ .Values.httpPort }}"

k8s/apps/messaging/management-service/values.yaml

@@ -12,8 +12,8 @@ httpPort: 8080
 env:
   kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
   redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
-  authentikIssuerURL: ""
-  authentikAudience: ""
+  zitadelIssuerURL: ""
+  zitadelAudience: ""
 
 resources:
   requests:

terraform/templates/controlplane.tftpl

@@ -33,14 +33,6 @@ machine:
       - ip: ${forgejo_registry_ip}
         aliases:
           - ${forgejo_hostname}
-      # kube-apiserver's static pod runs on the host network, so it resolves
-      # authentik.riotpiao.com via THIS node's DNS, not cluster CoreDNS - the
-      # OIDC issuer discovery call would otherwise hit the public
-      # Cloudflare-fronted IP instead of nginx directly. Same reasoning as
-      # the forgejo entry above.
-      - ip: 192.168.1.160
-        aliases:
-          - authentik.riotpiao.com
   kubelet:
     image: ${kubelet_image}
     defaultRuntimeSeccompProfileEnabled: true
@@ -128,19 +120,10 @@ cluster:
       - ${san}
 %{ endfor ~}
     image: ${kube_apiserver_img}
-    # Foundation for the Authentik group -> k8s RBAC pattern in
-    # k8s/infra/rbac/ - additive only, existing client-cert auth
-    # (system:masters, this session's own admin@homelab-cluster kubeconfig)
-    # keeps working unchanged; a bad OIDC config just means OIDC logins fail,
-    # not a lockout. Prefixes avoid collision with built-in system:* users
-    # and groups.
-    extraArgs:
-      oidc-issuer-url: https://authentik.riotpiao.com/application/o/kubernetes/
-      oidc-client-id: kubernetes
-      oidc-username-claim: email
-      oidc-groups-claim: groups
-      oidc-username-prefix: "oidc:"
-      oidc-groups-prefix: "oidc:"
+    # No OIDC block. The cluster authenticates with client certificates. An
+    # earlier Authentik-based kube-apiserver OIDC config was removed from the
+    # live nodes, and leaving it here would re-add an issuer that no longer
+    # resolves on any future machine-config render.
     admissionControl:
       - name: PodSecurity
         configuration: