k.rennerandClaude Opus 4.7
00d0c19f9c
Each Authentik proxy outpost has its own session store. Sharing the provider between the embedded outpost and the dedicated gate outpost means the OAuth callback at /outpost.goauthentik.io/callback hits the embedded outpost (which has no in-cluster /auth/nginx exposure), the session is created in the embedded outpost's store, and the dedicated gate outpost — which is what nginx auth_request actually queries — never sees it. Result: an infinite redirect between /authorize and /callback after every OAuth round-trip, surfaced as ERR_TOO_MANY_REDIRECTS in the browser. Add an Ingress in the authentik namespace that routes auth.renner.uno/outpost.goauthentik.io/* to the dedicated outpost's ClusterIP service, and detach the provider from the embedded outpost. The dedicated outpost now serves /start, /callback, AND /auth/nginx in the same process. The Authentik UI flow paths (/if, /application/o, /api, /static, /flows, /media) continue to resolve via the chart's authentik-server Ingress at the broader `/` rule, so 2FA still happens on auth.renner.uno where credentials are bound. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>