MinIO ships identity_openid disabled by default. Every MINIO_IDENTITY_OPENID_*
value was already correct, but without MINIO_IDENTITY_OPENID_ENABLE=on the
whole block is inert: the console answered /api/v1/login with
{"loginStrategy":"form"} and never rendered an SSO button.
Also drop MINIO_IDENTITY_OPENID_CLAIM_PREFIX, which was declared with an empty
value. An empty prefix makes the claim resolver prepend nothing and then look
for a nested property that cannot exist, so omitting the key is correct.
ArgoCD owns this Tenant with selfHeal, so the change has to land in git to
survive; a direct kubectl apply was reverted within seconds.
Every consumer SSO login failed for two independent reasons, and neither was
recorded in git.
1. The OIDC client secrets lived only in the cluster. They are written by
scripts/iam/zitadel-provision.py, whose `apply` phase calls
_generate_client_secret for every app on every run. A rotation therefore
invalidated the stored secret in ArgoCD, Grafana, MinIO, Immich and
Paperless, with no git value to compare against. Declaring the five Secrets
as SOPS manifests makes ArgoCD the owner, so the next rotation is a
reviewable diff instead of silent drift.
2. Forgejo, Paperless and Immich store the identity-provider link inside their
own databases, not in Kubernetes. Those rows still carried the Authentik
subject and provider, which produced three different symptoms from one
cause: Forgejo never left /user/link_account, Paperless showed the social
signup page, and Immich answered 400 "email already linked to different
account". The PostSync Job re-points each row at the ZITADEL `sub`,
matching on email or username rather than the numeric ids this was first
observed on, so a re-run converges.
Verified with a real browser login against a live ZITADEL session: Forgejo,
Paperless, Immich, Grafana and ArgoCD all reach their authenticated landing
page. Vault has no UI by design. MinIO remains open: the operator sidecar
serves its console with no OIDC environment, so it advertises form login only.
rock