From ae679ab5877a6af48ed4267973b6e0d817add169 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 23 Aug 2026 23:20:32 +1000 Subject: [PATCH] ci: move authentik_url ClusterIP override into woodpecker only Keep local/default terragrunt runs pointed at the real public URL; set the goauthentik#954 ClusterIP workaround via TF_VAR_authentik_url in the CI environment blocks instead of as a terragrunt input. --- .woodpecker/apply.yaml | 2 ++ .woodpecker/plan.yaml | 2 ++ environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl | 3 --- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml index 1af462c..6a3727f 100644 --- a/.woodpecker/apply.yaml +++ b/.woodpecker/apply.yaml @@ -8,6 +8,8 @@ steps: environment: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" + # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954). + TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local commands: - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml index 3f982dc..e7932b7 100644 --- a/.woodpecker/plan.yaml +++ b/.woodpecker/plan.yaml @@ -7,6 +7,8 @@ steps: environment: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" + # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954). + TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local commands: - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan diff --git a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl index 3c6ba9b..c85bbe7 100644 --- a/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl +++ b/environments/identity.k8s.syd1.au.unkin.net/terragrunt.hcl @@ -17,9 +17,6 @@ terraform { } inputs = { - # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954); local - # runs must export TF_VAR_authentik_url=https://identity.k8s.syd1.au.unkin.net - authentik_url = "http://authentik-server.authentik.svc.cluster.local" groups = local.config.groups permission_groups = local.config.permission_groups role_groups = local.config.role_groups