From 30f9c63c9bc342447392f52806853f8e33a0b1f3 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Sun, 13 Sep 2026 11:39:35 +0200 Subject: [PATCH] authentik: spell out API-defaulted fields on the LDAP route and listeners The API server defaults group on allowedRoutes.kinds and certificateRefs, and group, kind and weight on the TCPRoute backendRefs. Omitting them left both ArgoCD apps permanently OutOfSync against the live objects. Matches what authentik-httproute.yaml already does. --- applications/authentik/ldap/tcproute.yaml | 3 +++ .../authentik/authentik-ldap-gateway-patch.yaml | 9 ++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/applications/authentik/ldap/tcproute.yaml b/applications/authentik/ldap/tcproute.yaml index 33d66b3..ba33022 100644 --- a/applications/authentik/ldap/tcproute.yaml +++ b/applications/authentik/ldap/tcproute.yaml @@ -20,3 +20,6 @@ spec: - backendRefs: - name: authentik-ldap port: 3389 + kind: Service + group: "" + weight: 1 diff --git a/infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml b/infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml index 6fbdc0c..a2cef10 100644 --- a/infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml +++ b/infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml @@ -8,7 +8,8 @@ port: 389 allowedRoutes: kinds: - - kind: TCPRoute + - group: gateway.networking.k8s.io + kind: TCPRoute namespaces: from: Selector selector: @@ -24,12 +25,14 @@ tls: mode: Terminate certificateRefs: - - kind: Secret + - group: "" + kind: Secret name: authentik-ldap-tls namespace: envoy-gateway allowedRoutes: kinds: - - kind: TCPRoute + - group: gateway.networking.k8s.io + kind: TCPRoute namespaces: from: Selector selector: