Meru/meru
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(temporal): re-read Authentik's signing keys every minute #20

Merged
MarioGLealP merged 2 commits from marioglealp/temporal-jwks-refresh AGit into main 2026-10-31 10:37:51 +00:00
Conversation 0 Commits 2 Files Changed 1
+35
MarioGLealP commented 2026-10-31 10:20:24 +00:00
Owner
Copy link
Copy source

The frontend fetches the JWKS once at start and then every
refreshInterval, and a failed fetch waits for the next tick too. After
the 2026-10-31 boot it started before Caddy listened (connection
refused) and refused every token for the following hour: Shikigami sat
in CrashLoopBackOff. 1m bounds that to a minute for one small GET.

Co-Authored-By: Claude Opus 5.5 [email protected]
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei

The frontend fetches the JWKS once at start and then every refreshInterval, and a failed fetch waits for the next tick too. After the 2026-10-31 boot it started before Caddy listened (connection refused) and refused every token for the following hour: Shikigami sat in CrashLoopBackOff. 1m bounds that to a minute for one small GET. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
MarioGLealP added 1 commit 2026-10-31 10:20:24 +00:00
fix(temporal): re-read Authentik's signing keys every minute 4fd3e64588 
The frontend fetches the JWKS once at start and then every
refreshInterval, and a failed fetch waits for the next tick too. After
the 2026-10-31 boot it started before Caddy listened (connection
refused) and refused every token for the following hour: Shikigami sat
in CrashLoopBackOff. 1m bounds that to a minute for one small GET.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
MarioGLealP added 1 commit 2026-10-31 10:36:58 +00:00
fix(temporal): frontend waits for Authentik's keys instead of polling 2ee188b3d1 
Replaces the 1m refresh (one GET a minute forever, to cover a boot-time
race). Temporal fetches the JWKS once at start and only retries on the
refreshInterval tick; an unknown kid triggers nothing. So an init
container makes the frontend wait until the JWKS answers with a key,
backing off 2-4-8-...-60 s, and refreshInterval goes back to 1h for key
rotations. The chart gives every server service the init containers;
for anything but the frontend it exits at once.

Checked: rendered on all five server Deployments; frontend Deployment
and its pod template pass a server-side dry run (Kyverno, restricted
PSS); the script exits 0 for frontend (keys up) and history (no-op) and
backs off as written against an unreachable URL.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
MarioGLealP merged commit b2327a833e into main 2026-10-31 10:37:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
MarioGLealP (Mario Leal)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Meru/meru#20