From b86c69cee05f8cc726080385ba8938b7cb0bd9a0 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Thu, 3 Sep 2026 20:38:28 -0700
Subject: [PATCH] fix: use in-cluster JWKS URL for auth

---
 k8s/configmap.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 3de43b4..a8e4516 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -14,9 +14,10 @@ data:
     # All Authentik providers share same signing key, so any JWKS URL works.
     # Issuer varies per provider (portfolio-agent, memory-agent, local-llm, etc.)
     # Gateway validates: signature + roles claim contains requiredCapability
+    # Use in-cluster URL to avoid external DNS/network issues
     auth:
       enabled: true
-      jwksUrl: "https://authentik.riotpiao.com/application/o/local-llm/jwks/"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/local-llm/jwks/"
       requiredCapability: "llm:inference"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)