The authorize step is a browser redirect, so the issuer must present a
publicly-trusted cert; identity.k8s.syd1.au.unkin.net serves an internal-CA
cert that no user's browser trusts.
- Point OAUTH2_PROXY_OIDC_ISSUER_URL at identity.unkin.net
- Drop the combine-certs initContainer, its volumes/mounts and
PROVIDER_CA_FILES: the pod's only other upstream is plain-HTTP in-cluster
Cross-route path precedence is untested on this Traefik gateway; the single
route already resolves /ui before / today.
- Fold the /ui and /oauth2 rules back into api-route on both listeners.
- Drop the separate ui-route and ui-http-redirect routes.
Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.
- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
redirect); everything else to the api Service on both listeners.
unkin-agent