fix(authentik-gate-sync): refresh the embedded outpost every minute

Each authentik-server replica's embedded outpost loses its websocket whenever gunicorn recycles the worker holding it (AUTHENTIK_WEB__MAX_REQUESTS). The reconnect backoff never resets (goauthentik/authentik#26463), so a replica then misses gate changes for up to 5 minutes and catches up only on the refresh interval. A 1-minute interval bounds that gap; worker recycling stays as is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci/images/authentik-gate-sync/controller.py

@@ -54,6 +54,7 @@ MANAGER = "authentik-gate-sync"
 MANAGED_BY = {"app.kubernetes.io/managed-by": MANAGER}
 GATE_LABEL = "auth.renner.uno/gate"
 EMBEDDED_OUTPOST = "goauthentik.io/outposts/embedded"
+REFRESH_INTERVAL = "minutes=1"
 TRAEFIK = {"k8s:io.kubernetes.pod.namespace": INGRESS_NS, "app.kubernetes.io/name": "traefik"}
 MIDDLEWARES_ANN = "traefik.ingress.kubernetes.io/router.middlewares"
 
@@ -212,9 +213,13 @@ def resolve_backend(gate, service):
 def embedded_config(config):
     """The embedded outpost's config with the host the gates depend on. The
     embedded outpost builds the sign-in redirect from authentik_host, so it is
-    the public URL, which is also Authentik's default for it."""
+    the public URL, which is also Authentik's default for it.
+
+    A replica whose outpost websocket is down picks up gate changes only on
+    the refresh interval; the reconnect backoff never resets
+    (goauthentik/authentik#26463), so that gap reaches 5 minutes."""
     return {**(config or {}), "authentik_host": AK_BROWSER_URL, "authentik_host_insecure": False,
-            "authentik_host_browser": AK_BROWSER_URL}
+            "authentik_host_browser": AK_BROWSER_URL, "refresh_interval": REFRESH_INTERVAL}
 
 
 def provider_body(gate, flows):

ci/images/authentik-gate-sync/test_controller.py

@@ -167,9 +167,10 @@ class Objects(unittest.TestCase):
         self.assertEqual(c.drift({"a": 1, "b": 2}, {"a": 1, "b": 3}), {"b": 3})
 
     def test_embedded_config_keeps_other_keys(self):
-        cfg = c.embedded_config({"log_level": "debug", "authentik_host": c.AK_URL})
+        cfg = c.embedded_config({"log_level": "debug", "authentik_host": c.AK_URL, "refresh_interval": "minutes=5"})
         self.assertEqual(cfg, {"log_level": "debug", "authentik_host": c.AK_BROWSER_URL,
-                               "authentik_host_insecure": False, "authentik_host_browser": c.AK_BROWSER_URL})
+                               "authentik_host_insecure": False, "authentik_host_browser": c.AK_BROWSER_URL,
+                               "refresh_interval": "minutes=1"})
 
 
 class FakeAuthentik:

kubernetes/apps/authentik/gate-sync.yaml

@@ -105,7 +105,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-23-0748 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-23-0757 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true