From 24a105897c3918c7702cab92f961847da208a247 Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Sun, 19 Jul 2026 10:39:29 +1200 Subject: [PATCH] docs: add Authelia file backend watch:true best practice Sessions survive restarts (Redis); K8s Secret volume mounts auto-propagate within ~1 min; one-time restart needed to activate the configmap change itself. Claude-Session: https://claude.ai/code/session_01WYyWd2R75jhAechpqJdcaJ --- kubernetes.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/kubernetes.md b/kubernetes.md index 2bfabd2..92b3a0b 100644 --- a/kubernetes.md +++ b/kubernetes.md @@ -220,3 +220,18 @@ Re-applying a Deployment with a bumped image tag does not reliably trigger a new ## A Correct CiliumNetworkPolicy Egress Rule Won't Help If Ingress Is Gated by a Plain NetworkPolicy When a client pod times out reaching a service despite a correct `CiliumNetworkPolicy` egress rule on the client side, check the target's **ingress** policy — it may be a standard Kubernetes `NetworkPolicy` (not Cilium) that whitelists only specific source namespaces. Cilium and plain NetworkPolicy coexist and are additive; both directions must permit the flow. The ingress policy is often owned by the deploy repo, separate from the application and cluster-bootstrap repos, so grep there first. When debugging cross-namespace connectivity, enumerate both the client's egress rules and every ingress policy selecting the target pod. + +## Authelia File Backend: Always Enable `watch: true` + +Without `watch: true`, Authelia does not monitor its users file for changes — adding or modifying users requires a pod restart to take effect. With `watch: true`, Authelia polls the file and reloads on change, and Kubernetes Secret volume mounts propagate Secret updates automatically (within ~1 minute of the Secret changing). The result is a fully zero-touch flow: edit the SOPS-encrypted users Secret, commit, push → ArgoCD syncs → Authelia hot-reloads — no restart needed. + +```yaml +authentication_backend: + file: + path: '/secrets/users/users.yaml' + watch: true # ← always include this +``` + +**Sessions are safe:** if Authelia is backed by Redis for session storage (the standard setup), restarting the pod does not invalidate any active sessions. Users stay logged in through both deliberate restarts and the one-time restart needed to activate `watch: true` on a cluster where it wasn't previously set. + +**Activation:** adding `watch: true` to the ConfigMap requires one pod restart to take effect (K8s does not auto-restart pods on ConfigMap changes without Reloader). After that single restart it is permanent.