From dbd19fa11c09ed76b2e54bc12c735c729856c502 Mon Sep 17 00:00:00 2001 From: cmdoret Date: Tue, 25 Aug 2026 11:06:52 +0200 Subject: [PATCH 1/4] fix(authentik): specify code lifetime --- templates/authentik-blueprints-secret.yaml | 1 + values.yaml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml index de0f452..85e9a48 100644 --- a/templates/authentik-blueprints-secret.yaml +++ b/templates/authentik-blueprints-secret.yaml @@ -63,6 +63,7 @@ stringData: - url: "https://openwebui.{{ .Values.envoy.baseDomain }}/.*" matching_mode: regex redirect_uri_type: authorization + access_code_validity: {{ .Values.authentik.oauthApp.accessCodeValidity | default "minutes=10" }} access_token_validity: {{ .Values.authentik.oauthApp.accessTokenValidity | default "days=30" }} refresh_token_validity: {{ .Values.authentik.oauthApp.refreshTokenValidity | default "days=365" }} signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] diff --git a/values.yaml b/values.yaml index a09c54d..35fb359 100644 --- a/values.yaml +++ b/values.yaml @@ -137,5 +137,7 @@ authentik: name: vllm clientId: clientSecret: + # Lifetime of the device code and the authorization code. + accessCodeValidity: "minutes=10" accessTokenValidity: "days=30" refreshTokenValidity: "days=365" From 3b6a59fc119341054e2a00af706c8fcbd6081783 Mon Sep 17 00:00:00 2001 From: cmdoret Date: Tue, 25 Aug 2026 11:09:58 +0200 Subject: [PATCH 2/4] fix(authentik): reduce token lifetime --- README.md | 2 +- values.yaml | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 956e4e3..1d471af 100644 --- a/README.md +++ b/README.md @@ -146,7 +146,7 @@ Or point any OpenAI client at it: `OpenAI(base_url=f"https://gateway.{DOMAIN}/v1", api_key=TOKEN)`. The token is yours, so rate limits and usage are attributed to you. Access tokens last -`authentik.oauthApp.accessTokenValidity` (30 days by default); the device grant also +`authentik.oauthApp.accessTokenValidity` (8 hours by default); the device grant also returns a refresh token, valid for `refreshTokenValidity`, so a client can renew without a second browser approval. A model that has scaled to zero takes a minute or two to answer the first request. diff --git a/values.yaml b/values.yaml index 35fb359..cfb461d 100644 --- a/values.yaml +++ b/values.yaml @@ -139,5 +139,11 @@ authentik: clientSecret: # Lifetime of the device code and the authorization code. accessCodeValidity: "minutes=10" - accessTokenValidity: "days=30" + accessTokenValidity: "hours=8" refreshTokenValidity: "days=365" + serviceAccount: + # Gates the authentik-remote-cluster subchart (aliased `serviceAccount` in the + # authentik chart's dependencies), which would bind the worker to a Role granting + # get/create/delete/list/patch on namespace secrets, deployments and httproutes. + # Only needed for managed outposts, which this deployment does not use. + create: false From 850fe6f9bbe16878c3aca4c6e23c7e5425c10899 Mon Sep 17 00:00:00 2001 From: cmdoret Date: Tue, 25 Aug 2026 11:10:39 +0200 Subject: [PATCH 3/4] fix(authentik): reduce rbac privilege --- templates/authentik-blueprints-secret.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml index 85e9a48..e9f6416 100644 --- a/templates/authentik-blueprints-secret.yaml +++ b/templates/authentik-blueprints-secret.yaml @@ -51,12 +51,11 @@ stringData: client_type: public client_id: {{ .Values.authentik.oauthApp.clientId }} client_secret: {{ .Values.authentik.oauthApp.clientSecret }} + {{- /* Only what is actually used: authorization_code for OpenWebUI's browser + login, device_code + refresh_token for API clients. Every other grant is + reachable surface on a public client for no benefit. */}} grant_types: - authorization_code - - hybrid - - implicit - - client_credentials - - password - urn:ietf:params:oauth:grant-type:device_code - refresh_token redirect_uris: From c752bc75e37ac07dab1fad6bb940d813fef4813a Mon Sep 17 00:00:00 2001 From: Cyril Matthey-Doret Date: Tue, 25 Aug 2026 11:14:34 +0200 Subject: [PATCH 4/4] fix(authentik): template code lifetime fallback Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- templates/authentik-blueprints-secret.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml index e9f6416..1f4f2df 100644 --- a/templates/authentik-blueprints-secret.yaml +++ b/templates/authentik-blueprints-secret.yaml @@ -63,7 +63,7 @@ stringData: matching_mode: regex redirect_uri_type: authorization access_code_validity: {{ .Values.authentik.oauthApp.accessCodeValidity | default "minutes=10" }} - access_token_validity: {{ .Values.authentik.oauthApp.accessTokenValidity | default "days=30" }} + access_token_validity: {{ .Values.authentik.oauthApp.accessTokenValidity | default "hours=8" }} refresh_token_validity: {{ .Values.authentik.oauthApp.refreshTokenValidity | default "days=365" }} signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] encryption_key: