rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use external Authentik URL for MinIO OIDC config discovery

Browse Source
This commit is contained in:
rock
2026-09-04 21:25:30 -07:00
parent 449c2a9109
commit 539ef848d0
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/minio/minio-tenant.yaml
+4 -1
View File
@@ -100,7 +100,10 @@ spec:
# public URLs embedded in the OIDC metadata response (issuer stays public). # public URLs embedded in the OIDC metadata response (issuer stays public).
env: env:
- name: MINIO_IDENTITY_OPENID_CONFIG_URL - name: MINIO_IDENTITY_OPENID_CONFIG_URL
value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration" # Must use external URL — well-known response contains external issuer/jwks_uri.
# MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
# Hairpins through ingress-nginx but stays in-cluster.
value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
- name: MINIO_IDENTITY_OPENID_CLIENT_ID - name: MINIO_IDENTITY_OPENID_CLIENT_ID
value: "minio" value: "minio"
- name: MINIO_IDENTITY_OPENID_CLIENT_SECRET - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET