Keep local/default terragrunt runs pointed at the real public URL;
set the goauthentik#954 ClusterIP workaround via TF_VAR_authentik_url
in the CI environment blocks instead of as a terragrunt input.
Parameterise the authentik provider url as var.authentik_url (default:
the environment's public URL) and override it for
identity.k8s.syd1.au.unkin.net to
http://authentik-server.authentik.svc.cluster.local. Combined with
sessionAffinity: ClientIP on the Service, in-cluster CI runs pin to a
single server replica, eliminating the cross-replica read-back race
(goauthentik/terraform-provider-authentik#954).
unkin-agent