chore(authentik): finish the retirement in Terraform and messaging #78

2026-10-27T20:31:04Z

poimen commented

2026-10-27 20:31:04 +00:00

Remove the dead kube-apiserver OIDC issuer and host pin from the controlplane template, rename the messaging auth variables to ZITADEL.

poimen added 1 commit 2026-10-27 20:31:07 +00:00

chore(authentik): finish the retirement in Terraform and messaging fc63acbcc9

The live cluster has no Authentik workload, no DNS record and no tunnel route,
but two declarations still pointed at it.

controlplane.tftpl still set kube-apiserver oidc-issuer-url to
https://authentik.riotpiao.com/application/o/kubernetes/ and pinned that hostname
in extraHostEntries. The live API server carries zero OIDC arguments, so the
template and reality had diverged: the next machine-config render would have
re-added an issuer that does not resolve.

management-service exported KMSVC_AUTHENTIK_ISSUER_URL and
KMSVC_AUTHENTIK_AUDIENCE, both empty. Rename them to KMSVC_ZITADEL_* so the names
describe the identity provider that actually exists.

The CoreDNS Corefile kept one rewrite for authentik.riotpiao.com. The Terraform
source file no longer contains it, so the live ConfigMap was stale; that line is
removed live and the next render converges without it.

rock merged commit fc63acbcc9 into main

2026-10-27 20:31:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#78