From 539ef848d023d53733708c45e860d8b5374056e2 Mon Sep 17 00:00:00 2001 From: rock Date: Fri, 4 Sep 2026 21:25:30 -0700 Subject: [PATCH] fix: use external Authentik URL for MinIO OIDC config discovery --- k8s/infra/minio/minio-tenant.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml index 28f6a21..31a8255 100644 --- a/k8s/infra/minio/minio-tenant.yaml +++ b/k8s/infra/minio/minio-tenant.yaml @@ -100,7 +100,10 @@ spec: # public URLs embedded in the OIDC metadata response (issuer stays public). env: - name: MINIO_IDENTITY_OPENID_CONFIG_URL - value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration" + # Must use external URL — well-known response contains external issuer/jwks_uri. + # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch. + # Hairpins through ingress-nginx but stays in-cluster. + value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration" - name: MINIO_IDENTITY_OPENID_CLIENT_ID value: "minio" - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET