The embedded outpost's config is Authentik's own and does not depend on authentik-gate-sync. A blueprint update of an existing outpost is partial (importer: partial=True unless MUST_CREATED), so the entry sets config without providers and the gates the controller attached stay. config is replaced whole; the entry mirrors the live row (authentik_outposts_outpost, 2026-10-23) with refresh_interval minutes=1. kubernetes_namespace stays default: the outpost has the Local Kubernetes Cluster connection, and the authentik namespace would let the worker create an ak-outpost Service for it. The controller drops embedded_config/ensure_embedded_config and only attaches providers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>