bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases Wiki Activity

fix(distribution): revert OIDC enforcement — enabling it gated /healthz probe (service down)

Browse Source 
Flipping Auth__Enabled=true gated the /healthz readiness probe (302->NotReady->
no endpoints->distribution.iamworkin.lan down, healthz=000). Classic
feedback_k8s_probes_behind_auth_middleware. Revert to false (OIDC env block kept,
gate off) to restore service. Proper fix (AllowAnonymous /healthz + CA-trust +
idempotent Editions seed + OIDC-challenge wiring + browser-proof) -> falcon OIDC lane.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Andrew Stoltz
2026-06-03 23:47:29 -05:00
parent 9a58fd2af6
commit 13f9bb7710
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/fc-distribution/fc-distribution.yaml
View File

@@ -132,8 +132,11 @@ spec:
value: "false" value: "false"
# Authentik/OIDC enforcement (flipped ON 2026-06-04, no-live-proof per operator; # Authentik/OIDC enforcement (flipped ON 2026-06-04, no-live-proof per operator;
# public read/entitlement + Method() allowlist stay open — OIDC gates admin only). # public read/entitlement + Method() allowlist stay open — OIDC gates admin only).
# Auth__Enabled reverted to false 2026-06-04: enabling it gated the
# /healthz readiness probe (probe->302->NotReady->endpoints drop->down).
# Re-enable once /healthz is AllowAnonymous (falcon OIDC lane).
- name: FlowerCore__Auth__Enabled - name: FlowerCore__Auth__Enabled
value: "true" value: "false"
- name: FlowerCore__Auth__Oidc__Enabled - name: FlowerCore__Auth__Oidc__Enabled
value: "true" value: "true"
- name: FlowerCore__Auth__Oidc__Authority - name: FlowerCore__Auth__Oidc__Authority