artifactapi: restore combine-certs + PROVIDER_CA_FILES on oauth2-proxy (#458)

**Fix-forward companion to the #457 rollback. This is NOT the current outage fix — see below.**

## The actual outage

The UI is 503 because the Authentik application slug `artifactapi` **does not exist**. OIDC discovery 404s, so oauth2-proxy exits at startup, the Service has no ready endpoints, and Traefik answers `no available server`.

```
identity.unkin.net              /application/o/artifactapi/…  404
identity.k8s.syd1.au.unkin.net  /application/o/artifactapi/…  404
identity.unkin.net              /application/o/repospawner/…  200
identity.unkin.net              /application/o/argocd/…       200
```

Root cause is upstream in **terraform-authentik**: `ci/woodpecker/push/apply` on main HEAD `4e16401` **failed**. That apply has to succeed before any argocd-apps change can help. **This PR does not fix that.**

## What this PR does fix

#456 dropped the `combine-certs` initContainer and `OAUTH2_PROXY_PROVIDER_CA_FILES`, reasoning that `identity.unkin.net` serves a publicly trusted Let's Encrypt cert and so needs no internal CA. That holds for the browser redirect but not for oauth2-proxy's own back-channel discovery/token calls.

artifactapi is the **only one of six** oauth2-proxies in the estate without it:

| app | issuer host | `PROVIDER_CA_FILES` |
|---|---|---|
| arrproxy | identity.unkin.net | yes |
| logviewer | identity.unkin.net | yes |
| mediamark | identity.unkin.net | yes |
| repospawner | identity.unkin.net | yes |
| watchstate | identity.k8s… | yes |
| **artifactapi** | identity.unkin.net | **no** |

repospawner uses the **same public `identity.unkin.net` issuer** and still needs the internal bundle, which falsifies the removal reasoning. The existing comment on that initContainer states it plainly: *"The Authentik issuer is served behind the internal unkin.net CA."*

## Changes

- Add the `combine-certs` initContainer — byte-identical to repospawner's.
- Mount the combined bundle and set `OAUTH2_PROXY_PROVIDER_CA_FILES`.
- Reload the Deployment when `vault-ca-cert` rotates.

`vault-ca-cert` already exists in the `artifactapi` namespace (`api-deployment.yaml` uses it). `kustomize build apps/base/artifactapi` succeeds.

## Risk

Trust-only and strictly additive — it appends the internal CA to the system roots. Harmless if the back channel turns out to reach a publicly trusted endpoint after all. Expected to remove the *next* blocker, surfacing as x509, once the terraform-authentik apply lands.

## Sequencing

1. Fix and re-run terraform-authentik `push/apply` so the `artifactapi` application exists.
2. Merge this.
3. Confirm `/ui/` returns 200, then close #457 unmerged.

Only merge #457 instead if the UI must come back before step 1 can be done.

Reviewed-on: #458
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/artifactapi/httproute.yaml

@@ -1,4 +1,21 @@
 ---
+# Path split between the authenticated UI and the unauthenticated machine API.
+# Longest matching prefix wins, so the two UI rules take precedence over "/".
+#
+# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
+#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
+#   /ui       the human-facing SPA
+#
+# NOT AUTHENTICATED (artifactapi Service, unchanged):
+#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
+#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
+#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
+#   /v2/*                              Docker Registry V2 (containerd, buildah)
+#   /terraform/v1/providers/*          Terraform provider registry
+#   /.well-known/terraform.json        Terraform service discovery
+#   /health, /version, /               probes and the redirect to /ui/
+# Those clients cannot complete a browser OIDC flow, so they must never be
+# routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -22,7 +39,17 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: ui
+          name: oauth2
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /oauth2
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: oauth2
           port: 80
           weight: 1
       matches:

apps/base/artifactapi/kustomization.yaml

@@ -12,6 +12,8 @@ resources:
   - gateway.yaml
   - httproute.yaml
   - namespace.yaml
+  - oauth2-proxy-configmap.yaml
+  - oauth2-proxy-deployment.yaml
   - redis-deployment.yaml
   - services.yaml
   - ui-deployment.yaml

apps/base/artifactapi/oauth2-proxy-configmap.yaml

@@ -0,0 +1,46 @@
+---
+# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
+# from the oauth-credentials Secret).
+#
+# SCOPE: this proxy fronts the artifactapi web UI ONLY. The HTTPRoute sends just
+# /ui and /oauth2 here; every machine surface (/api/v1, /api/v2, /v2 docker
+# registry, /terraform, /.well-known/terraform.json, /health, /version, /) goes
+# straight to the api Service and is NOT authenticated. yum/dnf, containerd
+# registry mirrors, docker/buildah, terraform init and Woodpecker publish steps
+# cannot complete a browser OIDC flow, so they must never reach this container.
+# Its only upstream is the ui Service -- there is deliberately no api upstream.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: artifactapi-oauth2-env
+  namespace: artifactapi
+data:
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  # Publicly-trusted Authentik host: the authorize step is a browser redirect,
+  # so the issuer must present a cert every user's browser already trusts (the
+  # k8s host serves an internal-CA cert). Slug from terraform-authentik.
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
+  OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
+  OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
+  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
+  # Populate session.Groups from the Authentik hierarchical ak_groups claim.
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
+  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-artifactapi-admin"
+  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  # Authentik hardcodes email_verified=false in the id_token; authorization is
+  # enforced via ak_groups, so accepting the unverified email is safe.
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
+  OAUTH2_PROXY_REVERSE_PROXY: "true"
+  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  # Back-channel discovery/token calls resolve the issuer inside the cluster,
+  # where it is served under the internal unkin.net CA rather than the publicly
+  # trusted cert the browser sees. Trust the bundle the combine-certs init
+  # container assembles, as every other oauth2-proxy in the estate does.
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"

apps/base/artifactapi/oauth2-proxy-deployment.yaml

@@ -0,0 +1,136 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2
+  namespace: artifactapi
+  annotations:
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: oauth2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: oauth2
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4180
+              name: http
+              protocol: TCP
+            - containerPort: 44180
+              name: metrics
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: artifactapi-oauth2-env
+                optional: false
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: cookie_secret
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
+      restartPolicy: Always

apps/base/artifactapi/services.yaml

@@ -16,6 +16,26 @@ spec:
   sessionAffinity: None
   type: ClusterIP
 ---
+# Authenticated front door for the web UI only: api-route sends /ui and /oauth2
+# here, oauth2-proxy authenticates and forwards to the ui Service. Every other
+# path reaches the api Service above directly and stays unauthenticated.
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2
+  namespace: artifactapi
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: oauth2
+  sessionAffinity: None
+  type: ClusterIP
+---
 apiVersion: v1
 kind: Service
 metadata:

apps/base/artifactapi/vaultstaticsecret.yaml

@@ -32,3 +32,26 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+# Authentik OIDC client for the artifactapi UI front door (client_id,
+# client_secret, cookie_secret). Seeded out of band at
+# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
+# k8s auth role already grants the artifactapi/default ServiceAccount read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
+# terraform-vault change is needed. Consumed by the oauth2 Deployment.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: artifactapi
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifactapi/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/artifactapi/vmpodscrape.yaml

@@ -14,3 +14,17 @@ spec:
   podMetricsEndpoints:
     - port: metrics
       path: /metrics
+---
+# Scrape the UI oauth2-proxy (:44180), which exposes sign-in/authz counters.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: oauth2
+  namespace: artifactapi
+spec:
+  selector:
+    matchLabels:
+      app: oauth2
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics