fix: use external Authentik URL for MinIO OIDC config discovery

2026-09-04 21:25:30 -07:00
parent 449c2a9109
commit 539ef848d0
1 changed files with 4 additions and 1 deletions
@@ -100,7 +100,10 @@ spec:
  # public URLs embedded in the OIDC metadata response (issuer stays public).
  env:
    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
-      value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration"
+      # Must use external URL — well-known response contains external issuer/jwks_uri.
+      # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
+      # Hairpins through ingress-nginx but stays in-cluster.
+      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
      value: "minio"
    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET