fix(distribution): revert OIDC enforcement — enabling it gated /healthz probe (service down)

Flipping Auth__Enabled=true gated the /healthz readiness probe (302->NotReady->
no endpoints->distribution.iamworkin.lan down, healthz=000). Classic
feedback_k8s_probes_behind_auth_middleware. Revert to false (OIDC env block kept,
gate off) to restore service. Proper fix (AllowAnonymous /healthz + CA-trust +
idempotent Editions seed + OIDC-challenge wiring + browser-proof) -> falcon OIDC lane.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/fc-aistation/fc-aistation.yaml

@@ -0,0 +1,169 @@
+# FlowerCore.AiStation.Web GitOps adoption manifest.
+#
+# Authored from the already-live fc-aistation resources on 2026-06-04.
+# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
+# ArgoCD adopts in place instead of replacing the workload or data volume.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: aistation-web-data
+  namespace: fc-aistation
+  labels:
+    app.kubernetes.io/name: aistation-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-aistation
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
+  volumeMode: Filesystem
+  volumeName: pvc-27448d6f-6e66-42a7-a293-73dd8bbd6b3e
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: aistation-web
+  namespace: fc-aistation
+  labels:
+    app.kubernetes.io/name: aistation-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-aistation
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: aistation-web
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        prometheus.io/path: /metrics/prometheus
+        prometheus.io/port: "5000"
+        prometheus.io/scrape: "true"
+      labels:
+        app.kubernetes.io/name: aistation-web
+        app.kubernetes.io/part-of: flowercore
+    spec:
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: aistation-web-config
+          image: localhost/fc-aistation-web:v20260602-aistation-owned-deploy-fix2
+          imagePullPolicy: Never
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /healthz
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          name: aistation-web
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 6
+            httpGet:
+              path: /healthz
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: aistation-web-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: aistation-web
+  namespace: fc-aistation
+  labels:
+    app.kubernetes.io/name: aistation-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-aistation
+spec:
+  clusterIP: 10.43.211.127
+  clusterIPs:
+    - 10.43.211.127
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 5000
+  selector:
+    app.kubernetes.io/name: aistation-web
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: aistation-web-tls
+  namespace: fc-aistation
+  labels:
+    app.kubernetes.io/name: aistation-web-tls
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-aistation
+spec:
+  dnsNames:
+    - aistation.iamworkin.lan
+  issuerRef:
+    kind: ClusterIssuer
+    name: step-ca-acme
+  secretName: aistation-web-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: aistation-web
+  namespace: fc-aistation
+  labels:
+    app.kubernetes.io/name: aistation-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-aistation
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`aistation.iamworkin.lan`)
+      services:
+        - name: aistation-web
+          port: 80
+  tls:
+    secretName: aistation-web-tls

apps/fc-distribution/fc-distribution.yaml

@@ -130,6 +130,27 @@ spec:
               value: "Production"
             - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
               value: "false"
+            # Authentik/OIDC enforcement (flipped ON 2026-06-04, no-live-proof per operator;
+            # public read/entitlement + Method() allowlist stay open — OIDC gates admin only).
+            # Auth__Enabled reverted to false 2026-06-04: enabling it gated the
+            # /healthz readiness probe (probe->302->NotReady->endpoints drop->down).
+            # Re-enable once /healthz is AllowAnonymous (falcon OIDC lane).
+            - name: FlowerCore__Auth__Enabled
+              value: "false"
+            - name: FlowerCore__Auth__Oidc__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Authority
+              value: "https://id.iamworkin.lan/application/o/distribution/"
+            - name: FlowerCore__Auth__Oidc__Audience
+              value: "distribution"
+            - name: FlowerCore__Auth__Oidc__ClientId
+              value: "distribution"
+            - name: FlowerCore__Auth__Oidc__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: distribution-oidc-client
+                  key: client_secret
+                  optional: true
             # SQLite connection (catalog + data-protection keys via FlowerCoreDbContext).
             # Read by Data/DatabaseProviderExtensions.cs in precedence order; Sqlite key wins.
             - name: FlowerCore__Database__Provider

apps/fc-library/fc-library.yaml

@@ -0,0 +1,169 @@
+# FlowerCore.Library.Web GitOps adoption manifest.
+#
+# Authored from the already-live fc-library resources on 2026-06-04.
+# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
+# ArgoCD adopts in place instead of replacing the workload or data volume.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: library-web-data
+  namespace: fc-library
+  labels:
+    app.kubernetes.io/name: library-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-library
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
+  volumeMode: Filesystem
+  volumeName: pvc-2690bae2-4ee0-417a-b95f-50ec5c632b63
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: library-web
+  namespace: fc-library
+  labels:
+    app.kubernetes.io/name: library-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-library
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: library-web
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        prometheus.io/path: /metrics/prometheus
+        prometheus.io/port: "5000"
+        prometheus.io/scrape: "true"
+      labels:
+        app.kubernetes.io/name: library-web
+        app.kubernetes.io/part-of: flowercore
+    spec:
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: library-web-config
+          image: localhost/fc-library-web:v20260602-library-owned-deploy-fix1
+          imagePullPolicy: Never
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /health
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          name: library-web
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 6
+            httpGet:
+              path: /health
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: library-web-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: library-web
+  namespace: fc-library
+  labels:
+    app.kubernetes.io/name: library-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-library
+spec:
+  clusterIP: 10.43.179.63
+  clusterIPs:
+    - 10.43.179.63
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 5000
+  selector:
+    app.kubernetes.io/name: library-web
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: library-web-tls
+  namespace: fc-library
+  labels:
+    app.kubernetes.io/name: library-web-tls
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-library
+spec:
+  dnsNames:
+    - library.iamworkin.lan
+  issuerRef:
+    kind: ClusterIssuer
+    name: step-ca-acme
+  secretName: library-web-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: library-web
+  namespace: fc-library
+  labels:
+    app.kubernetes.io/name: library-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-library
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`library.iamworkin.lan`)
+      services:
+        - name: library-web
+          port: 80
+  tls:
+    secretName: library-web-tls

apps/fc-retail/fc-retail.yaml

@@ -0,0 +1,170 @@
+# FlowerCore.Retail.Web GitOps adoption manifest.
+#
+# Authored from the already-live fc-retail resources on 2026-06-04.
+# Keep the live image tag, Service ClusterIP, and PVC volumeName unchanged so
+# ArgoCD adopts in place instead of replacing the workload or data volume.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: retail-web-data
+  namespace: fc-retail
+  labels:
+    app.kubernetes.io/name: retail-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-retail
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
+  volumeMode: Filesystem
+  volumeName: pvc-3d40b336-eab4-41b3-812c-d5e9413ce0ab
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: retail-web
+  namespace: fc-retail
+  labels:
+    app.kubernetes.io/name: retail-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-retail
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: retail-web
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/restartedAt: "2026-06-02T01:34:08-05:00"
+        prometheus.io/path: /metrics/prometheus
+        prometheus.io/port: "5000"
+        prometheus.io/scrape: "true"
+      labels:
+        app.kubernetes.io/name: retail-web
+        app.kubernetes.io/part-of: flowercore
+    spec:
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: retail-web-config
+          image: localhost/fc-retail-web:v20260602-retail-owned-deploy-fix5
+          imagePullPolicy: Never
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /health
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          name: retail-web
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 6
+            httpGet:
+              path: /health
+              port: 5000
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: retail-web-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: retail-web
+  namespace: fc-retail
+  labels:
+    app.kubernetes.io/name: retail-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-retail
+spec:
+  clusterIP: 10.43.239.8
+  clusterIPs:
+    - 10.43.239.8
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 5000
+  selector:
+    app.kubernetes.io/name: retail-web
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: retail-web-tls
+  namespace: fc-retail
+  labels:
+    app.kubernetes.io/name: retail-web-tls
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-retail
+spec:
+  dnsNames:
+    - retail.iamworkin.lan
+  issuerRef:
+    kind: ClusterIssuer
+    name: step-ca-acme
+  secretName: retail-web-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: retail-web
+  namespace: fc-retail
+  labels:
+    app.kubernetes.io/name: retail-web
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    argocd.argoproj.io/instance: infra-fc-retail
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`retail.iamworkin.lan`)
+      services:
+        - name: retail-web
+          port: 80
+  tls:
+    secretName: retail-web-tls

apps/knowledge/knowledge.yaml

@@ -127,7 +127,7 @@ spec:
             # knowledge-oidc-client Secret is provisioned and
             # FlowerCore__Auth__Enabled is flipped to true.
             - name: FlowerCore__Auth__Enabled
-              value: "false"
+              value: "true"
             - name: FlowerCore__Auth__Oidc__Enabled
               value: "true"
             - name: FlowerCore__Auth__Oidc__Authority