Point identity env provider at in-cluster authentik-server ClusterIP #24

2026-08-23T23:07:30+10:00

unkin-agent commented

2026-08-23 23:07:30 +10:00

Why

The authentik terraform provider races against itself when the API is served by multiple replicas behind a load balancer: a write lands on one replica and the immediate read-back can hit another replica that has not yet observed it (goauthentik/terraform-provider-authentik#954). Going through identity.k8s.syd1.au.unkin.net (gateway -> 3 server replicas) exposes exactly that. Companion to the argocd-apps PR adding sessionAffinity: ClientIP to the authentik-server Service — together, in-cluster runs pin to a single replica and the race disappears.

Changes

Parameterises the generated authentik provider url as var.authentik_url, defaulting to the environment's public URL (https://<env dir>) so other/new environments are unchanged
Overrides authentik_url for identity.k8s.syd1.au.unkin.net to http://authentik-server.authentik.svc.cluster.local (the HTTPRoute backends this Service on port 80 plain HTTP, so no TLS/CA knobs needed)

Trade-off: local runs

CI plans/applies run in-cluster and resolve svc DNS fine, but local workstation runs (e.g. import recoveries) cannot resolve *.svc.cluster.local and would fail to reach the API. Terragrunt does not override already-set TF_VAR_* env vars, so local runs work by exporting:

export TF_VAR_authentik_url=https://identity.k8s.syd1.au.unkin.net

(The provider's AUTHENTIK_URL env var does not help here since the provider block sets url explicitly.)

## Why The authentik terraform provider races against itself when the API is served by multiple replicas behind a load balancer: a write lands on one replica and the immediate read-back can hit another replica that has not yet observed it (goauthentik/terraform-provider-authentik#954). Going through identity.k8s.syd1.au.unkin.net (gateway -> 3 server replicas) exposes exactly that. Companion to the argocd-apps PR adding `sessionAffinity: ClientIP` to the authentik-server Service — together, in-cluster runs pin to a single replica and the race disappears. ## Changes - Parameterises the generated authentik provider `url` as `var.authentik_url`, defaulting to the environment's public URL (`https://<env dir>`) so other/new environments are unchanged - Overrides `authentik_url` for identity.k8s.syd1.au.unkin.net to `http://authentik-server.authentik.svc.cluster.local` (the HTTPRoute backends this Service on port 80 plain HTTP, so no TLS/CA knobs needed) ## Trade-off: local runs CI plans/applies run in-cluster and resolve svc DNS fine, but local workstation runs (e.g. import recoveries) cannot resolve `*.svc.cluster.local` and would fail to reach the API. Terragrunt does not override already-set `TF_VAR_*` env vars, so local runs work by exporting: export TF_VAR_authentik_url=https://identity.k8s.syd1.au.unkin.net (The provider's `AUTHENTIK_URL` env var does not help here since the provider block sets `url` explicitly.)

unkin-agent added 1 commit 2026-08-23 23:07:31 +10:00

Point identity env provider at in-cluster authentik-server ClusterIP

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

218a640882

Parameterise the authentik provider url as var.authentik_url (default:
the environment's public URL) and override it for
identity.k8s.syd1.au.unkin.net to
http://authentik-server.authentik.svc.cluster.local. Combined with
sessionAffinity: ClientIP on the Service, in-cluster CI runs pin to a
single server replica, eliminating the cross-replica read-back race
(goauthentik/terraform-provider-authentik#954).

unkinben added 1 commit 2026-08-23 23:20:39 +10:00

ci: move authentik_url ClusterIP override into woodpecker only

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

ae679ab587

Keep local/default terragrunt runs pointed at the real public URL;
set the goauthentik#954 ClusterIP workaround via TF_VAR_authentik_url
in the CI environment blocks instead of as a terragrunt input.

benvin merged commit ef84176633 into main

2026-08-23 23:22:56 +10:00

benvin deleted branch benvin/incluster-provider-url

2026-08-23 23:22:57 +10:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#24