3 Commits

Include renames

Author	SHA1	Message	Date
renovate-bot	f8b98907e8	chore(deps): update ci non-major	2026-10-19 02:01:57 +00:00
claude-botandClaude Opus 5.5	0bb356c955	fix(ci): build authentik-gate-sync independently of other steps ... build-authentik-gate-sync depended on a separate test step, so it only started after the other steps had run, and Woodpecker skips not-yet-started steps once the workflow has a failure: on the #1272 merge build-alpine-jq and build-cni-plugins failed and the image was never built. The unit tests now run as a stage of the image build (the final stage copies the controller out of it), and the step starts with depends_on: [] like the others. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 21:05:09 +02:00
claude-botandClaude Opus 5.5	bbb1582bcf	feat(authentik): authentik-gate ingress class controller ... Adds authentik-gate-sync, an in-house controller (ci/images/authentik-gate-sync, stdlib Python like netbird-service-sync) that implements an `authentik-gate` IngressClass. An Ingress of that class names its real backend; the controller turns it into an Authentik proxy gate and wires the upstream ingress provider: - Authentik: proxy provider, application (meta_publisher marks ownership), outpost on the local Kubernetes connection, optional group binding. - App namespace: ExternalName Service <ingress>-gate -> outpost, Traefik Ingress <ingress>-gate (source hosts/paths/TLS/labels/annotations, backend swapped, cert-manager annotations dropped so only the source issues), and a CNP admitting only this outpost to the backend pods. - authentik namespace: CNP letting the outpost reach only those pods. Annotations: auth.renner.uno/group (members managed in Authentik; none = any user), /login-flow, /authorization-flow (default passkey-stepup-authorization), /skip-path. Fail closed: the Traefik route is applied last and removed when the gate's config is invalid (missing group/flow/backend); transient API errors leave the gate as the last good pass left it. The API token is zero-touch: an ESO Password generator (CreatedOnce) feeds both the controller and AUTHENTIK_GATE_SYNC_TOKEN on server/worker, which the new gate-sync blueprint sets as the key of a non-expiring token for a service account whose role covers only gate objects. No existing gate moves yet; llama is migrated in a follow-up once this runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 20:39:50 +02:00