Merge pull request 'Point identity env provider at in-cluster authentik-server ClusterIP' (#24) from benvin/incluster-provider-url into main

Reviewed-on: #24

.woodpecker/apply.yaml

@@ -8,6 +8,8 @@ steps:
     environment:
       VAULT_AUTH_METHOD: kubernetes
       VAULT_VERSION: "1.20.0"
+      # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954).
+      TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local
     commands:
       - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan

.woodpecker/plan.yaml

@@ -7,6 +7,8 @@ steps:
     environment:
       VAULT_AUTH_METHOD: kubernetes
       VAULT_VERSION: "1.20.0"
+      # ClusterIP + sessionAffinity pins CI to one replica (goauthentik#954).
+      TF_VAR_authentik_url: http://authentik-server.authentik.svc.cluster.local
     commands:
       - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan

environments/root.hcl

@@ -3,7 +3,7 @@ generate "backend" {
   if_exists = "overwrite"
   contents  = <<EOF
 provider "authentik" {
-  url   = "https://${path_relative_to_include()}"
+  url   = var.authentik_url
   token = var.authentik_token
 }
 
@@ -19,6 +19,13 @@ variable "authentik_token" {
   sensitive = true
 }
 
+# Defaults to the environment's public URL; an exported TF_VAR_authentik_url
+# takes precedence over terragrunt inputs.
+variable "authentik_url" {
+  type    = string
+  default = "https://${path_relative_to_include()}"
+}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"