Caddy and Local Radius outposts came over from the Proxmox deployment
with `kubernetes_namespace: default` in their config. The chart-rendered
Role only grants permissions in `authentik`, so the K8s controller's
first GET against `secrets/ak-outpost-{name}` in `default` returned
403. LDAP Outpost worked because its config never had the field set
(falls back to the running pod's namespace).
Pin both to `authentik` via the existing blueprint so the controller
spawns them next to authentik-server.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7
e8c19fbfc7