ROLLBACK: revert "Put the artifactapi web UI behind Authentik oauth2-proxy (#456)" #457

2026-09-07T22:29:44+10:00

unkin-agent commented

2026-09-07 22:29:44 +10:00

Rollback of #456. Restores unauthenticated UI access at /ui — merge only if we choose to roll back rather than fix forward.

Why

The artifactapi web UI has been down since #456 merged. Probing https://artifactapi.k8s.syd1.au.unkin.net:

path	status
`/version`, `/api/v2/health`, `/.well-known/terraform.json`, `/v2/`	200
`/`	302 (artifactapi's own redirect to `/ui/`)
`/ui/`	503 — `no available server`
`/oauth2/`	503 — `no available server`

no available server is Traefik's response for a Service with no ready endpoints, so the oauth2-proxy pod is not running or not ready. The machine API surface is intact; only the UI and the /oauth2 prefix are down.

What this changes

Point the api-route /ui rule back at the ui Service and drop the /oauth2 rule.
Remove the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
Remove the oauth-credentials VaultStaticSecret.

This is a plain git revert of c98d88c with no conflicts. apps/base/artifactapi is byte-identical to 520da44, the commit immediately before #456 (git diff 520da44 HEAD -- apps/base/artifactapi is empty). Nothing that landed since is touched, and kustomize build apps/base/artifactapi succeeds.

Note

This deliberately restores unauthenticated access to the UI — the same exposure #456 set out to close. It is the safe-state rollback, not the desired end state. If the root cause is a one-line config fix, prefer fixing forward and close this unmerged.

**Rollback of #456. Restores unauthenticated UI access at `/ui` — merge only if we choose to roll back rather than fix forward.** ## Why The artifactapi web UI has been down since #456 merged. Probing `https://artifactapi.k8s.syd1.au.unkin.net`: | path | status | |---|---| | `/version`, `/api/v2/health`, `/.well-known/terraform.json`, `/v2/` | 200 | | `/` | 302 (artifactapi's own redirect to `/ui/`) | | `/ui/` | **503** — `no available server` | | `/oauth2/` | **503** — `no available server` | `no available server` is Traefik's response for a Service with no ready endpoints, so the oauth2-proxy pod is not running or not ready. The machine API surface is intact; only the UI and the `/oauth2` prefix are down. ## What this changes - Point the `api-route` `/ui` rule back at the `ui` Service and drop the `/oauth2` rule. - Remove the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape. - Remove the `oauth-credentials` VaultStaticSecret. This is a plain `git revert` of c98d88c with no conflicts. `apps/base/artifactapi` is byte-identical to 520da44, the commit immediately before #456 (`git diff 520da44 HEAD -- apps/base/artifactapi` is empty). Nothing that landed since is touched, and `kustomize build apps/base/artifactapi` succeeds. ## Note This deliberately restores **unauthenticated** access to the UI — the same exposure #456 set out to close. It is the safe-state rollback, not the desired end state. If the root cause is a one-line config fix, prefer fixing forward and close this unmerged.

unkin-agent added 1 commit 2026-09-07 22:29:44 +10:00

Revert "Put the artifactapi web UI behind Authentik oauth2-proxy (#456 )"

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

297168a398

This reverts commit c98d88c197.

The artifactapi web UI has been down since #456 merged: /ui/ and /oauth2/
both return 503 "no available server", Traefik's response for a Service
with no ready endpoints, so the oauth2-proxy pod is not becoming ready.
The machine API surface (/version, /api/v2/health, /v2/,
/.well-known/terraform.json) is unaffected and still returns 200.

Rolling back restores unauthenticated access to the UI at /ui, served
directly by the ui Service exactly as before.

- Point the api-route /ui rule back at the ui Service and drop the
  /oauth2 rule.
- Remove the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Remove the oauth-credentials VaultStaticSecret.

The apps/base/artifactapi tree is byte-identical to 520da44, the commit
immediately before #456. Nothing that landed since is touched.