revert(authentik-gate-sync): roll back OIDC clients (#1535, #1536), gates are being deleted #1537

2026-11-01T10:44:24Z

hermes-bot commented

2026-11-01 10:44:24 +00:00

Rollback: #1536 did not stop the outage, so this reverts #1536 and #1535. The controller goes back to the code of image 2026-10-29-1349, the last one without OIDC.

Log of image 2026-11-01-1014 (with #1536), 10:43Z:

INFO navidrome-navidrome-5ba52d: removed OIDC client from Authentik
...
INFO reconciled: 14 gates, 0 OIDC clients, 0 failed, 14 objects removed

Why #1536 was wrong: OAuth2ProviderViewSet.queryset = OAuth2Provider.objects.all() (2026.8.4) has no select_subclasses(). A proxy provider listed there is therefore serialized as the parent OAuth2Provider model, and its meta_model_name is authentik_providers_oauth2.oauth2provider too. The filter matched nothing. My test fake assumed otherwise.

Merging this lets image automation pick up the new build (newest tag = old code), and the gates come back on its first pass. The OIDCClient CRD stays in the cluster (prune: disabled). #1534 has to wait for a corrected controller PR.

Verified: the controller directory equals its state before #1535 (git diff 09a03dfd^1 is empty), and the 33 unit tests of that version pass.

**Rollback: #1536 did not stop the outage, so this reverts #1536 and #1535.** The controller goes back to the code of image `2026-10-29-1349`, the last one without OIDC. Log of image `2026-11-01-1014` (with #1536), 10:43Z: ``` INFO navidrome-navidrome-5ba52d: removed OIDC client from Authentik ... INFO reconciled: 14 gates, 0 OIDC clients, 0 failed, 14 objects removed ``` Why #1536 was wrong: `OAuth2ProviderViewSet.queryset = OAuth2Provider.objects.all()` (2026.8.4) has no `select_subclasses()`. A proxy provider listed there is therefore serialized as the parent `OAuth2Provider` model, and its `meta_model_name` is `authentik_providers_oauth2.oauth2provider` too. The filter matched nothing. My test fake assumed otherwise. Merging this lets image automation pick up the new build (newest tag = old code), and the gates come back on its first pass. The `OIDCClient` CRD stays in the cluster (`prune: disabled`). #1534 has to wait for a corrected controller PR. Verified: the controller directory equals its state before #1535 (`git diff 09a03dfd^1` is empty), and the 33 unit tests of that version pass.

hermes-bot added 2 commits 2026-11-01 10:44:25 +00:00

Revert "Merge pull request 'fix(authentik-gate-sync): stop sweeping every gate as an OIDC client' (#1536 ) from fix/gate-sync-proxy-sweep into main" 8fa68bc9cd

This reverts commit 60dfcf5382, reversing
changes made to 1a99c02996.

Revert "Merge pull request 'feat(authentik-gate-sync): OIDC clients from OIDCClient resources' (#1535 ) from feat/gate-sync-oidc into main"

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

8c85a49ae5

This reverts commit 09a03dfd76, reversing
changes made to e518b46045.

k.renner merged commit 88576f7022 into main

2026-11-01 10:59:30 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1537