From 78e788abb3ef90fca79e3a57e82fe0122131d2ad Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:15:43 -0700
Subject: [PATCH] (fix): fix sigV4 oidc issue when sign-in with authentik

---
 k8s/infra/minio/minio-tenant.yaml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml
index 190d0de..9a06d68 100644
--- a/k8s/infra/minio/minio-tenant.yaml
+++ b/k8s/infra/minio/minio-tenant.yaml
@@ -83,11 +83,16 @@ spec:
   # 'default' and fail the reconcile).
 
   # Public hostnames the tenant serves (S3 + console via the cluster ingress).
+  # Must match actual ingress backends: the "minio" Ingress (host
+  # minio.riotpiao.com) routes to minio-cluster-console:9090, and "minio-api"
+  # (host minio-api.riotpiao.com) routes to minio:9000. Previously these were
+  # swapped, so MinIO's own console-domain validation rejected the OIDC
+  # callback arriving on minio.riotpiao.com's Host header.
   features:
     domains:
       minio:
-        - https://minio.riotpiao.com
-      console: https://minio-console.riotpiao.com
+        - https://minio-api.riotpiao.com
+      console: https://minio.riotpiao.com
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env: