From 218a640882a5981b4f285d5b4130ad58c404c904 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 23:07:04 +1000
Subject: [PATCH] Point identity env provider at in-cluster authentik-server
 ClusterIP

Parameterise the authentik provider url as var.authentik_url (default:
the environment's public URL) and override it for
identity.k8s.syd1.au.unkin.net to
http://authentik-server.authentik.svc.cluster.local. Combined with
sessionAffinity: ClientIP on the Service, in-cluster CI runs pin to a
single server replica, eliminating the cross-replica read-back race
(goauthentik/terraform-provider-authentik#954).
---
 .../identity.k8s.syd1.au.unkin.net/terragrunt.hcl        | 3 +++
 environments/root.hcl                                    | 9 ++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
index c85bbe7..3c6ba9b 100644
--- a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
+++ b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl
@@ -17,6 +17,9 @@ terraform {
 }
 
 inputs = {
+  # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954); local
+  # runs must export TF_VAR_authentik_url=https://identity.k8s.syd1.au.unkin.net
+  authentik_url     = "http://authentik-server.authentik.svc.cluster.local"
   groups            = local.config.groups
   permission_groups = local.config.permission_groups
   role_groups       = local.config.role_groups
diff --git a/environments/root.hcl b/environments/root.hcl
index 8667a77..d370148 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -3,7 +3,7 @@ generate "backend" {
   if_exists = "overwrite"
   contents  = <<EOF
 provider "authentik" {
-  url   = "https://${path_relative_to_include()}"
+  url   = var.authentik_url
   token = var.authentik_token
 }
 
@@ -19,6 +19,13 @@ variable "authentik_token" {
   sensitive = true
 }
 
+# Defaults to the environment's public URL; an exported TF_VAR_authentik_url
+# takes precedence over terragrunt inputs.
+variable "authentik_url" {
+  type    = string
+  default = "https://${path_relative_to_include()}"
+}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"