skynet/best-practices
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add Authelia file backend watch:true best practice

Browse Source 
Sessions survive restarts (Redis); K8s Secret volume mounts
auto-propagate within ~1 min; one-time restart needed to activate
the configmap change itself.

Claude-Session: https://claude.ai/code/session_01WYyWd2R75jhAechpqJdcaJ
This commit is contained in:
Paul O'Reilly
2026-07-19 10:39:29 +12:00
parent c8691368e4
commit 24a105897c
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
kubernetes.md
View File

@@ -220,3 +220,18 @@ Re-applying a Deployment with a bumped image tag does not reliably trigger a new
## A Correct CiliumNetworkPolicy Egress Rule Won't Help If Ingress Is Gated by a Plain NetworkPolicy ## A Correct CiliumNetworkPolicy Egress Rule Won't Help If Ingress Is Gated by a Plain NetworkPolicy
When a client pod times out reaching a service despite a correct `CiliumNetworkPolicy` egress rule on the client side, check the target's **ingress** policy — it may be a standard Kubernetes `NetworkPolicy` (not Cilium) that whitelists only specific source namespaces. Cilium and plain NetworkPolicy coexist and are additive; both directions must permit the flow. The ingress policy is often owned by the deploy repo, separate from the application and cluster-bootstrap repos, so grep there first. When debugging cross-namespace connectivity, enumerate both the client's egress rules and every ingress policy selecting the target pod. When a client pod times out reaching a service despite a correct `CiliumNetworkPolicy` egress rule on the client side, check the target's **ingress** policy — it may be a standard Kubernetes `NetworkPolicy` (not Cilium) that whitelists only specific source namespaces. Cilium and plain NetworkPolicy coexist and are additive; both directions must permit the flow. The ingress policy is often owned by the deploy repo, separate from the application and cluster-bootstrap repos, so grep there first. When debugging cross-namespace connectivity, enumerate both the client's egress rules and every ingress policy selecting the target pod.
## Authelia File Backend: Always Enable `watch: true`
Without `watch: true`, Authelia does not monitor its users file for changes — adding or modifying users requires a pod restart to take effect. With `watch: true`, Authelia polls the file and reloads on change, and Kubernetes Secret volume mounts propagate Secret updates automatically (within ~1 minute of the Secret changing). The result is a fully zero-touch flow: edit the SOPS-encrypted users Secret, commit, push → ArgoCD syncs → Authelia hot-reloads — no restart needed.
```yaml
authentication_backend:
file:
path: '/secrets/users/users.yaml'
watch: true # ← always include this
```
**Sessions are safe:** if Authelia is backed by Redis for session storage (the standard setup), restarting the pod does not invalidate any active sessions. Users stay logged in through both deliberate restarts and the one-time restart needed to activate `watch: true` on a cluster where it wasn't previously set.
**Activation:** adding `watch: true` to the ConfigMap requires one pod restart to take effect (K8s does not auto-restart pods on ConfigMap changes without Reloader). After that single restart it is permanent.