unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

authentik: ClientIP session affinity on server service #410

Merged
benvin merged 1 commits from benvin/authentik-session-affinity into main 2026-08-23 23:13:51 +10:00
Conversation 0 Commits 1 Files Changed 1
+5
unkin-agent commented 2026-08-23 23:06:16 +10:00
Member
Copy Link
Copy Source

Why

Tofu applies against authentik hit a cross-replica read-back race: a create lands on one of the 3 server pods and the provider's immediate read-back hits another pod that returns stale data, failing the run with "inconsistent result after apply" (upstream bug goauthentik/terraform-provider-authentik#954, still open). ClientIP session affinity keeps a whole apply run on a single pod, sidestepping the race until the provider is fixed.

Changes

  • Sets server.service.sessionAffinity: ClientIP with sessionAffinityConfig.clientIP.timeoutSeconds: 60 in the au-syd1 authentik overlay values (rendered by the vendored chart's templates/server/service.yaml)
## Why Tofu applies against authentik hit a cross-replica read-back race: a create lands on one of the 3 server pods and the provider's immediate read-back hits another pod that returns stale data, failing the run with "inconsistent result after apply" (upstream bug goauthentik/terraform-provider-authentik#954, still open). ClientIP session affinity keeps a whole apply run on a single pod, sidestepping the race until the provider is fixed. ## Changes - Sets `server.service.sessionAffinity: ClientIP` with `sessionAffinityConfig.clientIP.timeoutSeconds: 60` in the au-syd1 authentik overlay values (rendered by the vendored chart's `templates/server/service.yaml`)
unkin-agent added 1 commit 2026-08-23 23:06:17 +10:00
authentik: ClientIP session affinity on server service
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
21e2b7b580 
Tofu/terraform applies against authentik race across the 3 server
replicas: a create on one pod followed by an immediate read-back on
another returns stale data ("inconsistent result after apply",
goauthentik/terraform-provider-authentik#954). ClientIP affinity pins
an apply run to a single pod until the upstream bug is fixed.

- Set server.service.sessionAffinity: ClientIP with
  clientIP.timeoutSeconds: 60 in the au-syd1 authentik overlay
benvin merged commit aea319cec0 into main 2026-08-23 23:13:51 +10:00
benvin deleted branch benvin/authentik-session-affinity 2026-08-23 23:13:51 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#410
Delete Branch "benvin/authentik-session-affinity"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?