From 0c889bc36b370f3cf2cb902402b9ab0685118792 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 12:06:02 +0200 Subject: [PATCH] authentik: move auth.renner.uno public edge off Cloudflare tunnel to NetBird proxy Drop the external-dns/cloudflare label from the Authentik ingress (helm values) and remove the auth.renner.uno cloudflared route. auth must be served with NO proxy auth (it is the IdP every other SSO redirects to). This is the last of the 8 public names; cloudflared now routes nothing but a 404 catch-all. MERGE ONLY AFTER the auth proxy service + DNS are live, then roll cloudflared, or all SSO logins break in the gap. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/authentik/helmrelease.yaml | 2 -- kubernetes/infrastructure/cloudflared/configmap.yaml | 5 ----- 2 files changed, 7 deletions(-) diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml index 8069a3a3..e5f4f22e 100644 --- a/kubernetes/apps/authentik/helmrelease.yaml +++ b/kubernetes/apps/authentik/helmrelease.yaml @@ -132,8 +132,6 @@ spec: ingress: enabled: true ingressClassName: traefik - labels: - external-dns/cloudflare: "true" annotations: cert-manager.io/cluster-issuer: letsencrypt-cluster hosts: diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml index 8733c64c..9f7a25a2 100644 --- a/kubernetes/infrastructure/cloudflared/configmap.yaml +++ b/kubernetes/infrastructure/cloudflared/configmap.yaml @@ -11,10 +11,5 @@ data: no-autoupdate: true ingress: - - hostname: auth.renner.uno - service: https://traefik.ingress.svc.cluster.local:443 - originRequest: - noTLSVerify: true - # Catch-all - service: http_status:404 -- 2.54.0