From af1f77618df46b06e2894ced8c24e0a8f029b9e9 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 7 Sep 2026 14:14:31 +1000
Subject: [PATCH] Use the browser-trusted Authentik host for the artifactapi
 OIDC issuer

The authorize step is a browser redirect, so the issuer must present a
publicly-trusted cert; identity.k8s.syd1.au.unkin.net serves an internal-CA
cert that no user's browser trusts.

- Point OAUTH2_PROXY_OIDC_ISSUER_URL at identity.unkin.net
- Drop the combine-certs initContainer, its volumes/mounts and
  PROVIDER_CA_FILES: the pod's only other upstream is plain-HTTP in-cluster
---
 .../artifactapi/oauth2-proxy-configmap.yaml   |  9 ++--
 .../artifactapi/oauth2-proxy-deployment.yaml  | 45 +------------------
 2 files changed, 5 insertions(+), 49 deletions(-)

diff --git a/apps/base/artifactapi/oauth2-proxy-configmap.yaml b/apps/base/artifactapi/oauth2-proxy-configmap.yaml
index 79f525c..672b4be 100644
--- a/apps/base/artifactapi/oauth2-proxy-configmap.yaml
+++ b/apps/base/artifactapi/oauth2-proxy-configmap.yaml
@@ -18,10 +18,10 @@ data:
   OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
   OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
   OAUTH2_PROXY_PROVIDER: "oidc"
-  # Internal-CA-served Authentik host (trusted via PROVIDER_CA_FILES below);
-  # Authentik issues the discovery document under the requested host, so the
-  # issuer is self-consistent. Slug from terraform-authentik.
-  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.k8s.syd1.au.unkin.net/application/o/artifactapi/"
+  # Publicly-trusted Authentik host: the authorize step is a browser redirect,
+  # so the issuer must present a cert every user's browser already trusts (the
+  # k8s host serves an internal-CA cert). Slug from terraform-authentik.
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
   OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
   OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
   OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
@@ -37,6 +37,5 @@ data:
   OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
   OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
   OAUTH2_PROXY_REVERSE_PROXY: "true"
-  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
   OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
   OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
diff --git a/apps/base/artifactapi/oauth2-proxy-deployment.yaml b/apps/base/artifactapi/oauth2-proxy-deployment.yaml
index 74644d5..765135e 100644
--- a/apps/base/artifactapi/oauth2-proxy-deployment.yaml
+++ b/apps/base/artifactapi/oauth2-proxy-deployment.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: artifactapi
   annotations:
     configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+    secret.reloader.stakater.com/reload: "oauth-credentials"
 spec:
   replicas: 2
   selector:
@@ -30,36 +30,6 @@ spec:
         fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        # identity.k8s.syd1.au.unkin.net serves a Vault-PKI cert; combine the
-        # system roots with the internal CA so oauth2-proxy's OIDC client
-        # trusts the discovery/token endpoints.
-        - name: combine-certs
-          image: alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
       containers:
         - name: oauth2-proxy
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
@@ -91,10 +61,6 @@ spec:
                 secretKeyRef:
                   name: oauth-credentials
                   key: cookie_secret
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
           livenessProbe:
             httpGet:
               path: /ping
@@ -124,13 +90,4 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}
       restartPolicy: Always