From aea319cec0909d77bc119f98f059e5a8719a3dab Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 23 Aug 2026 23:13:51 +1000 Subject: [PATCH] authentik: ClientIP session affinity on server service (#410) ## Why Tofu applies against authentik hit a cross-replica read-back race: a create lands on one of the 3 server pods and the provider's immediate read-back hits another pod that returns stale data, failing the run with "inconsistent result after apply" (upstream bug goauthentik/terraform-provider-authentik#954, still open). ClientIP session affinity keeps a whole apply run on a single pod, sidestepping the race until the provider is fixed. ## Changes - Sets `server.service.sessionAffinity: ClientIP` with `sessionAffinityConfig.clientIP.timeoutSeconds: 60` in the au-syd1 authentik overlay values (rendered by the vendored chart's `templates/server/service.yaml`) Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/410 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/overlays/au-syd1/authentik/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/overlays/au-syd1/authentik/values.yaml b/apps/overlays/au-syd1/authentik/values.yaml index d2710e9..89be724 100644 --- a/apps/overlays/au-syd1/authentik/values.yaml +++ b/apps/overlays/au-syd1/authentik/values.yaml @@ -78,6 +78,11 @@ server: configmap.reloader.stakater.com/auto: "true" ingress: enabled: false + service: + sessionAffinity: ClientIP + sessionAffinityConfig: + clientIP: + timeoutSeconds: 60 resources: limits: cpu: "2"