rock
fc63acbcc9
The live cluster has no Authentik workload, no DNS record and no tunnel route, but two declarations still pointed at it. controlplane.tftpl still set kube-apiserver oidc-issuer-url to https://authentik.riotpiao.com/application/o/kubernetes/ and pinned that hostname in extraHostEntries. The live API server carries zero OIDC arguments, so the template and reality had diverged: the next machine-config render would have re-added an issuer that does not resolve. management-service exported KMSVC_AUTHENTIK_ISSUER_URL and KMSVC_AUTHENTIK_AUDIENCE, both empty. Rename them to KMSVC_ZITADEL_* so the names describe the identity provider that actually exists. The CoreDNS Corefile kept one rewrite for authentik.riotpiao.com. The Terraform source file no longer contains it, so the live ConfigMap was stale; that line is removed live and the next render converges without it.
13 lines
479 B
YAML
13 lines
479 B
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: management-service-config
|
|
namespace: {{ .Values.namespace }}
|
|
data:
|
|
KMSVC_KAFKA_BROKERS: {{ .Values.env.kafkaBrokers | quote }}
|
|
KMSVC_REDIS_ADDR: {{ .Values.env.redisAddr | quote }}
|
|
KMSVC_ZITADEL_ISSUER_URL: {{ .Values.env.zitadelIssuerURL | quote }}
|
|
KMSVC_ZITADEL_AUDIENCE: {{ .Values.env.zitadelAudience | quote }}
|
|
KMSVC_GRPC_LISTEN_ADDR: ":{{ .Values.grpcPort }}"
|
|
KMSVC_HTTP_LISTEN_ADDR: ":{{ .Values.httpPort }}"
|