remove: strip all oauth2-proxy deployments

- Delete oauth2-proxy helm releases from helmfile (temporal, kmsvc, longhorn, portainer)
- Remove oauth2-proxy manifests and ingress redirects
- Add direct ingress for kmsvc management service
- Update temporal/portainer/longhorn ingress comments to reflect direct service exposure

Services now accessible without oauth2-proxy layer.

k8s/temporal/oauth2-proxy-values.yaml

@@ -1,45 +0,0 @@
-# OAuth2-Proxy for Temporal UI — protects with Authentik OIDC
-# Deployed via Helm: oauth2-proxy/oauth2-proxy chart
-
-config:
-  clientID: temporal
-  clientSecret: ""  # injected from temporal-oidc secret
-  cookieSecret: ""  # generated; helm --set will override
-  configFile: ""
-
-auth:
-  enabled: true
-
-extraArgs:
-  - --provider=oidc
-  - --oidc-issuer-url=https://authentik.riotpiao.homelab.com/application/o/temporal/
-  - --redirect-url=https://temporal.riotpiao.homelab.com/oauth2/callback
-  - --upstream=http://temporal-web:8080
-  - --cookie-secure=true
-  - --cookie-httponly=true
-  - --cookie-samesite=Lax
-  - --email-domain=*
-  - --skip-auth-regex=^/health
-  - --pass-authorization-header=true
-  - --skip-auth-preflight=true
-
-service:
-  type: ClusterIP
-  port: 4180
-  targetPort: 4180
-
-ingress:
-  enabled: false  # we'll keep temporal's ingress, just route to oauth2-proxy
-
-replicaCount: 1
-
-resources:
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 200m
-    memory: 256Mi
-
-podAnnotations:
-  secret.reloader.stakater.com/reload: "temporal-oidc"

k8s/temporal/oauth2-proxy.yaml

@@ -1,108 +0,0 @@
-# OAuth2-Proxy deployment for Temporal UI
-# Requires: temporal-oidc secret with clientSecret and cookieSecret
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy
-      annotations:
-        secret.reloader.stakater.com/reload: "temporal-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/temporal/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "temporal"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: temporal-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: temporal-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://temporal.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://temporal-web:8080"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_SKIP_AUTH_PREFLIGHT
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 200m
-            memory: 256Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy
-  namespace: temporal
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy

k8s/temporal/temporal-ingress-oauth2.yaml

@@ -1,27 +0,0 @@
-# Ingress for Temporal UI — routes to OAuth2-Proxy, which proxies to temporal-web
-# TLS terminated here; oauth2-proxy handles OIDC auth before forwarding to backend
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: temporal
-  namespace: temporal
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: temporal-tls
-    hosts:
-    - temporal.riotpiao.homelab.com
-  rules:
-  - host: temporal.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy
-            port:
-              number: 4180