Automate authentik token rotation (adopt FuzeInfra rotate-sealed-secret) — kill the manual reseal from #104/#105

[izzywdev]

Automate the authentik token rotation — kill the manual reseal step (ADLC)

Why: FuzeFront #104 (handed off from FuzeInfra#103) was root-caused + code-fixed in #105 (whitespace-scrubbing seal path + trim). But #105 still requires a human to manually reseal the live AUTHENTIK_BOOTSTRAP_TOKEN and redeploy — a manual runbook step, which our agentic SDLC does not accept. Secret rotation must be a hands-off automated primitive.

FuzeInfra just shipped the family-standard rotation workflow to close this gap:

• Template: https://github.com/izzywdev/FuzeInfra/blob/main/.github/workflows/rotate-sealed-secret.yml
• Docs: https://github.com/izzywdev/FuzeInfra/blob/main/docs/SECRETS_MANAGEMENT.md (§5)

It generates a fresh value, seals it offline against the cluster's published public cert (no cluster access, plaintext never logged) via seal-secret.sh, opens an auto-merging PR → Argo syncs the SealedSecret → controller decrypts. FuzeFront seals against the same cluster controller, so the same approach applies.

Tasks (@claude)

1. Merge fix(authentik): scrub whitespace from sealed tokens — fix malformed outpost Authorization header #105 first (the hardened seal path must be in place before rotating).
2. Replicate rotate-sealed-secret.yml into FuzeFront — mirror the FuzeInfra template, pointed at FuzeFront's deploy/scripts/seal-secret.sh and the fuzefront/fuzefront-secrets SealedSecret manifest (deploy/contabo/sealed/fuzefront-secrets.yaml). Keep the env-not-${{ }} input handling + validation.
3. Wire automatic reload on authentik-server / authentik-worker so a Secret change restarts them with no human: a stakater/reloader annotation or a Helm checksum/secret pod annotation. (If reloader isn't installed cluster-side, prefer the checksum annotation, or use the workflow's reload_argocd_app input.)
4. Run the rotation for AUTHENTIK_BOOTSTRAP_TOKEN (scope fuzefront/fuzefront-secrets) to clear 🚨 authentik outpost token malformed — config-fetch error loop (handed off from FuzeInfra #103) #104's loop, and confirm the outpost stops emitting invalid header field value for "Authorization".

Acceptance

• rotate-sealed-secret.yml exists in FuzeFront and a rotation runs end-to-end (PR auto-merges → Argo syncs) with no manual seal-secret.sh.
• authentik pods auto-restart on the Secret change.
• The 3s outpost config-fetch error loop is gone.

STATE

• done: FuzeInfra#103 closed/handed off → FF#104 triggered → FF#105 (code fix) opened; FuzeInfra family-standard rotate-sealed-secret.yml merged (feat(secrets): hands-off SealedSecret rotation workflow (family-standard) FuzeInfra#111).
• remaining: this issue — FF rotation workflow + reloader wiring + the actual token rotation.
• refs: FuzeInfra#103, FF#104, FF#105, FuzeInfra#111.

@claude please implement tasks 1–4 above, open the PR(s), run the rotation, and report back here when triggered, merged, rotated, and the loop is confirmed cleared.

[claude]

Claude finished @izzywdev's task in 6m 22s —— View job • claude/issue-106-20260629-0348 • Create PR ➔

---

Automate authentik token rotation — code in place; cluster/merge steps need a human

I implemented the parts that live in this repo, and committed them to this branch. The steps that require merging PRs, writing under .github/workflows/, or operating the cluster are outside what I'm permitted to do here — flagged clearly below.

• Gather context (seal script, sealed secret, authentik chart, Argo app)
• [~] Task 1 — Merge fix(authentik): scrub whitespace from sealed tokens — fix malformed outpost Authorization header #105: I can't merge PRs (security limitation). Needs a maintainer.
• Task 2 — Replicate rotate-sealed-secret.yml (authored; staged — see below)
• Task 3 — Auto-reload authentik-server / authentik-worker (stakater/Reloader wired)
• [~] Task 4 — Run the rotation: I can't trigger workflows or operate the cluster (GitOps/no creds). Needs a maintainer after Tasks 1–2 land.

What I changed (this branch)

• deploy/helm/fuzefront/templates/authentik.yaml — secret.reloader.stakater.com/reload: "fuzefront-secrets" annotation on both the authentik-server and authentik-worker Deployments, gated by authentik.reloader.enabled.
• deploy/helm/fuzefront/values.yaml — new authentik.reloader.enabled: true toggle (documented).
• deploy/ci/rotate-sealed-secret.yml — the rotation workflow (mirrors FuzeInfra#111): workflow_dispatch, default scope fuzefront/fuzefront-secrets, generates/accepts a value, seals offline via deploy/scripts/seal-secret.sh (plaintext never logged, fed through a 0600 temp file --in), opens an auto-merging PR, plus a reload_argocd_app fallback input. Inputs flow through env: (injection-safe, not ${{ }} in shell bodies) with key/scope validation — as requested.
• deploy/ci/README.md + deploy/contabo/SEAL_PROD_SECRETS.md — install + run instructions and a rotation note replacing the manual reseal.

Why Reloader, not checksum/secret

In prod the chart does not render the Secret — values-prod.yaml sets secret.existingSecret: fuzefront-secrets, and the value comes from the fuzefront-sealed Argo app decrypting the SealedSecret. A Helm checksum/secret is computed from chart values, so it would never change on rotation. stakater/Reloader watches the live Secret object, so it's the correct primitive here. The annotation is inert (harmless) if Reloader isn't installed cluster-side — fall back to the workflow's reload_argocd_app input.

⚠️ Two manual steps I can't do for you

1. Move the workflow into place — GitHub App tokens can't write under .github/workflows/, so I staged it at deploy/ci/. A maintainer must:

   git mv deploy/ci/rotate-sealed-secret.yml .github/workflows/rotate-sealed-secret.yml

   (It does not run from deploy/ci/.) The squash-merge is signed by GitHub, satisfying master's required_signatures.
2. Merge fix(authentik): scrub whitespace from sealed tokens — fix malformed outpost Authorization header #105 first, then this PR, then run the rotation (Actions → Rotate sealed secret → key=AUTHENTIK_BOOTSTRAP_TOKEN, scope=fuzefront/fuzefront-secrets, value_mode=generate) — in a deploy window, since master is deploy-on-push. On merge: Argo syncs → controller decrypts → Reloader rolls authentik → the invalid header field value for "Authorization" loop clears.

Note on tooling in this run

helm template, gh, network fetches, and python -c all required interactive approval that wasn't available, so I couldn't render the chart or fetch the FuzeInfra template to diff against. The workflow is modeled on the issue's spec + this repo's seal-secret.sh interface and infra-dispatch.yml/auto-merge.yml conventions — please reconcile it against FuzeInfra#111 before/at merge.

• branch: claude/issue-106-20260629-0348