authentik: ClientIP session affinity on server service (#410)

## Why

Tofu applies against authentik hit a cross-replica read-back race: a create lands on one of the 3 server pods and the provider's immediate read-back hits another pod that returns stale data, failing the run with "inconsistent result after apply" (upstream bug goauthentik/terraform-provider-authentik#954, still open). ClientIP session affinity keeps a whole apply run on a single pod, sidestepping the race until the provider is fixed.

## Changes

- Sets `server.service.sessionAffinity: ClientIP` with `sessionAffinityConfig.clientIP.timeoutSeconds: 60` in the au-syd1 authentik overlay values (rendered by the vendored chart's `templates/server/service.yaml`)

Reviewed-on: #410
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #410.

This commit is contained in:

Unkin Agent

2026-08-23 23:13:51 +10:00

committed by

BenVincent

parent 5a23146513

commit aea319cec0

1 changed files with 5 additions and 0 deletions

									
										apps/overlays/au-syd1/authentik/values.yaml
									
		+5
		
												View File
												
					@@ -78,6 +78,11 @@ server:

					    configmap.reloader.stakater.com/auto: "true"

					    configmap.reloader.stakater.com/auto: "true"

					  ingress:

					  ingress:

					    enabled: false

					    enabled: false

					  service:

					    sessionAffinity: ClientIP

					    sessionAffinityConfig:

					      clientIP:

					        timeoutSeconds: 60

					  resources:

					  resources:

					    limits:

					    limits:

					      cpu: "2"

					      cpu: "2"