From f9654986ad16be2f10749394374ebd359d2518b5 Mon Sep 17 00:00:00 2001 From: rock Date: Thu, 3 Sep 2026 23:15:19 -0700 Subject: [PATCH] fix(minio): use in-cluster URL for OIDC config fetch MinIO pod was getting 503 from public URL at startup. Use in-cluster authentik-server.iam.svc for metadata fetch; browser redirects still use public URLs from OIDC metadata response. --- k8s/infra/minio/minio-tenant.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml index b4dcbbf..28f6a21 100644 --- a/k8s/infra/minio/minio-tenant.yaml +++ b/k8s/infra/minio/minio-tenant.yaml @@ -96,9 +96,11 @@ spec: console: https://minio.riotpiao.com # ── OIDC via Authentik (server-side env, valid in v2 schema) ──────────────── + # Use in-cluster URL for config fetch (pod→authentik); browser redirects use + # public URLs embedded in the OIDC metadata response (issuer stays public). env: - name: MINIO_IDENTITY_OPENID_CONFIG_URL - value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration" + value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration" - name: MINIO_IDENTITY_OPENID_CLIENT_ID value: "minio" - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET