unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

traefik-internal: add ldaps :636 entrypoint for authentik LDAPS #345

Merged
unkinben merged 1 commits from benvin/traefik-ldaps-entrypoint into main 2026-08-08 23:19:19 +10:00
Conversation 0 Commits 1 Files Changed 1
+6
unkinben commented 2026-08-08 23:17:02 +10:00
Owner
Copy Link
Copy Source

Why

  • traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's two 636/TLS passthrough listeners are invalid and the entire Gateway is rejected (Accepted: False), taking LDAPS down.
  • The traefik-internal LoadBalancer publishes only 80/443, so nothing reaches the Authentik LDAP outpost on 636.

How

  • Add an ldaps entrypoint on :636 (raw TCP, no TLS termination) to the traefik-internal helm values so 636/TLS passthrough streams pass through to the LDAP outpost.
  • Expose 636 on the traefik-internal LoadBalancer via the port's expose.default, keeping the pinned 198.18.200.4 / common group unchanged.
## Why - traefik-internal has no `636` entrypoint, so the `authentik-ldap` Gateway's two `636/TLS` passthrough listeners are invalid and the entire Gateway is rejected (`Accepted: False`), taking LDAPS down. - The traefik-internal LoadBalancer publishes only `80/443`, so nothing reaches the Authentik LDAP outpost on `636`. ## How - Add an `ldaps` entrypoint on `:636` (raw TCP, no TLS termination) to the traefik-internal helm values so `636/TLS` passthrough streams pass through to the LDAP outpost. - Expose `636` on the traefik-internal LoadBalancer via the port's `expose.default`, keeping the pinned `198.18.200.4` / `common` group unchanged.
unkinben added 1 commit 2026-08-08 23:17:03 +10:00
traefik-internal: add ldaps :636 entrypoint for authentik LDAPS
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
ef4f5f68a0 
Why:
- traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's
  636/TLS passthrough listeners are invalid and the whole Gateway is
  rejected (Accepted: False), taking LDAPS down.
- The traefik-internal LoadBalancer only publishes 80/443, so nothing
  reaches the Authentik LDAP outpost on 636.

How:
- Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the
  traefik-internal helm values so 636/TLS passthrough streams pass through
  to the LDAP outpost.
- Expose 636 on the traefik-internal LoadBalancer via the port's
  `expose.default`, keeping the pinned 198.18.200.4 / common group.
unkinben merged commit 5e409f5f06 into main 2026-08-08 23:19:19 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#345
Delete Branch "benvin/traefik-ldaps-entrypoint"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?