remove: strip all oauth2-proxy deployments

- Delete oauth2-proxy helm releases from helmfile (temporal, kmsvc, longhorn, portainer)
- Remove oauth2-proxy manifests and ingress redirects
- Add direct ingress for kmsvc management service
- Update temporal/portainer/longhorn ingress comments to reflect direct service exposure

Services now accessible without oauth2-proxy layer.

helmfile.yaml.gotmpl

@@ -812,80 +812,6 @@ releases:
               --from-literal=client_secret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
               --dry-run=client -o yaml | kubectl apply -f -
 
-# ── OAuth2-Proxy (Authentik OIDC protection) ──────────────────────────────────
-
-  - name: oauth2-proxy-temporal
-    namespace: temporal
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-temporal.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic temporal-oidc -n temporal \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-kmsvc
-    namespace: sqs
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-kmsvc.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic kmsvc-oidc -n sqs \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_KMSVC_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-longhorn
-    namespace: longhorn-system
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-longhorn.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic longhorn-oidc -n longhorn-system \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_LONGHORN_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-portainer
-    namespace: dashboard
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-portainer.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic portainer-oidc -n dashboard \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_PORTAINER_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
 # ── Ollama LLM Server ────────────────────────────────────────────────────────
 
   - name: ollama

k8s/dashboard/portainer-ingress-oauth2.yaml

@@ -1,25 +0,0 @@
-# Ingress for Portainer container UI — routes to OAuth2-Proxy
-# TLS terminated here; oauth2-proxy handles OIDC auth
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: portainer
-  namespace: dashboard
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: portainer-tls
-    hosts:
-    - portainer.riotpiao.homelab.com
-  rules:
-  - host: portainer.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy-portainer
-            port:
-              number: 4180

k8s/dashboard/portainer-oauth2-proxy.yaml

@@ -1,106 +0,0 @@
-# OAuth2-Proxy for Portainer container management UI
-# Protects container orchestration interface with Authentik OIDC
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: dashboard
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy-portainer
-  namespace: dashboard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy-portainer
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy-portainer
-      annotations:
-        secret.reloader.stakater.com/reload: "portainer-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/portainer/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "portainer"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: portainer-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: portainer-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://portainer.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://portainer:9000"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health|^/api/status"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 200m
-            memory: 256Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy-portainer
-  namespace: dashboard
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy-portainer

k8s/ingress/ingress.yaml

@@ -272,7 +272,7 @@ spec:
 
 ---
 # ── Temporal Web UI ────────────────────────────────────────────────────────────
-# Temporal workflow orchestration Web UI with OIDC authentication
+# Temporal workflow orchestration Web UI
 # TLS: wildcard cert managed by cert-manager, served by nginx default-ssl-certificate
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -295,3 +295,25 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
+
+---
+# ── kmsvc (SQS/Kafka REST API) ────────────────────────────────────────────
+# SQS-compatible messaging API via kmsvc management service
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kmsvc
+  namespace: sqs
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: kmsvc.riotpiao.homelab.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: management-service
+                port:
+                  number: 8080

k8s/sqs/kmsvc-ingress-oauth2.yaml

@@ -1,25 +0,0 @@
-# Ingress for kmsvc REST API — routes to OAuth2-Proxy
-# TLS terminated here; oauth2-proxy handles OIDC auth
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: kmsvc
-  namespace: sqs
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: kmsvc-tls
-    hosts:
-    - kmsvc.riotpiao.homelab.com
-  rules:
-  - host: kmsvc.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy
-            port:
-              number: 4180

k8s/sqs/oauth2-proxy.yaml

@@ -1,106 +0,0 @@
-# OAuth2-Proxy for kmsvc REST API
-# Protects gRPC-gateway (REST) endpoint with Authentik OIDC
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: sqs
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: sqs
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy
-      annotations:
-        secret.reloader.stakater.com/reload: "kmsvc-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/kmsvc/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "kmsvc"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: kmsvc-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: kmsvc-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://kmsvc.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://kmsvc-management-service:8080"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 200m
-            memory: 256Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy
-  namespace: sqs
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy

k8s/storage/longhorn-ingress-oauth2.yaml

@@ -1,25 +0,0 @@
-# Ingress for Longhorn storage UI — routes to OAuth2-Proxy
-# TLS terminated here; oauth2-proxy handles OIDC auth
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: longhorn-tls
-    hosts:
-    - longhorn.riotpiao.homelab.com
-  rules:
-  - host: longhorn.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy
-            port:
-              number: 4180

k8s/storage/longhorn-oauth2-proxy.yaml

@@ -1,106 +0,0 @@
-# OAuth2-Proxy for Longhorn storage UI
-# Protects persistent volume management interface with Authentik OIDC
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy
-      annotations:
-        secret.reloader.stakater.com/reload: "longhorn-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/longhorn/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "longhorn"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: longhorn-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: longhorn-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://longhorn.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://longhorn-frontend:80"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 50m
-            memory: 64Mi
-          limits:
-            cpu: 100m
-            memory: 128Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy

k8s/temporal/oauth2-proxy-values.yaml

@@ -1,45 +0,0 @@
-# OAuth2-Proxy for Temporal UI — protects with Authentik OIDC
-# Deployed via Helm: oauth2-proxy/oauth2-proxy chart
-
-config:
-  clientID: temporal
-  clientSecret: ""  # injected from temporal-oidc secret
-  cookieSecret: ""  # generated; helm --set will override
-  configFile: ""
-
-auth:
-  enabled: true
-
-extraArgs:
-  - --provider=oidc
-  - --oidc-issuer-url=https://authentik.riotpiao.homelab.com/application/o/temporal/
-  - --redirect-url=https://temporal.riotpiao.homelab.com/oauth2/callback
-  - --upstream=http://temporal-web:8080
-  - --cookie-secure=true
-  - --cookie-httponly=true
-  - --cookie-samesite=Lax
-  - --email-domain=*
-  - --skip-auth-regex=^/health
-  - --pass-authorization-header=true
-  - --skip-auth-preflight=true
-
-service:
-  type: ClusterIP
-  port: 4180
-  targetPort: 4180
-
-ingress:
-  enabled: false  # we'll keep temporal's ingress, just route to oauth2-proxy
-
-replicaCount: 1
-
-resources:
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 200m
-    memory: 256Mi
-
-podAnnotations:
-  secret.reloader.stakater.com/reload: "temporal-oidc"

k8s/temporal/oauth2-proxy.yaml

@@ -1,108 +0,0 @@
-# OAuth2-Proxy deployment for Temporal UI
-# Requires: temporal-oidc secret with clientSecret and cookieSecret
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy
-      annotations:
-        secret.reloader.stakater.com/reload: "temporal-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/temporal/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "temporal"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: temporal-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: temporal-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://temporal.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://temporal-web:8080"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_SKIP_AUTH_PREFLIGHT
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 200m
-            memory: 256Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy

k8s/temporal/temporal-ingress-oauth2.yaml

@@ -1,27 +0,0 @@
-# Ingress for Temporal UI — routes to OAuth2-Proxy, which proxies to temporal-web
-# TLS terminated here; oauth2-proxy handles OIDC auth before forwarding to backend
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: temporal
-  namespace: temporal
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: temporal-tls
-    hosts:
-    - temporal.riotpiao.homelab.com
-  rules:
-  - host: temporal.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy
-            port:
-              number: 4180