Move all 8 Authentik OIDC client_secrets out of plaintext git

Completes the 'make the repo proper' cleanup from earlier this session -
these were flagged but deliberately not touched in 185e9c2 given the
blast radius (live SSO for 8 apps). User confirmed: fix all 8 now.

infrastructure/authentik/{argocd,gitlab,nextcloud,grafana,n8n,guacamole,
rancher,vault}-blueprint.yaml: converted from plain ConfigMap (client_secret
hardcoded) to ExternalSecret with a templated blueprint body
(client_secret: "{{ .clientSecret }}") pulling from Vault. Chart already
supports mounting blueprints from Secrets (blueprints.secrets, alongside
blueprints.configMaps) - infrastructure/authentik/values.yaml updated to
route these 8 there instead.

For argocd/nextcloud/n8n/guacamole/rancher: Vault already had the matching
value at secret/<app>-oauth (the APP side was already Vault-backed via its
own ExternalSecret) - the blueprint was the only remaining plaintext copy.

For gitlab/grafana/vault: Vault had no copy at all yet - created
secret/{gitlab,grafana,vault}-oauth with the EXISTING live values (not
rotated - these are the actual working credentials right now, rotating
would break login until every consumer is updated in lockstep, which is
out of scope for a cleanup pass). Also fixed the OTHER plaintext copies
that existed for these three specifically:
  - apps/gitlab/manifests/external-secret-oidc.yaml (new): replaces a
    manually kubectl-created, never-git-tracked gitlab-oidc-secret.
  - infrastructure/grafana/manifests/grafana-oauth-secret.yaml: was a
    plain Secret whose own comment said 'hardcoded from blueprint'.
  - infrastructure/vault/manifests/vault-init-{configmap,job}.yaml: this
    one COULDN'T be converted to the same ExternalSecret-from-Vault
    pattern - it's the PostSync Job that grants ESO's own Kubernetes-auth
    role in Vault, so ESO can't yet authenticate to pull anything from
    Vault at the point this script runs (genuinely circular). Sourced
    from a new vault-oidc-bootstrap Secret instead - created once
    manually (kubectl, not git, matching how Vault's own root/unseal
    material is already handled), independent of the ESO pipeline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/gitlab/manifests/external-secret-oidc.yaml

@@ -0,0 +1,31 @@
+# gitlab-oidc-secret was a manually kubectl-created plain Secret (never
+# git-tracked, never rotatable, no record of what it was) - found and
+# fixed 2026-08-20 alongside infrastructure/authentik/gitlab-blueprint.yaml
+# (same value, same Vault path - see that file for the full story).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitlab-oidc
+  namespace: gitlab
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: gitlab-oidc-secret
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      data:
+        GITLAB_OIDC_CLIENT_ID: "{{ .clientId }}"
+        GITLAB_OIDC_CLIENT_SECRET: "{{ .clientSecret }}"
+  data:
+    - secretKey: clientId
+      remoteRef:
+        key: gitlab-oauth
+        property: client-id
+    - secretKey: clientSecret
+      remoteRef:
+        key: gitlab-oauth
+        property: client-secret

infrastructure/authentik/argocd-blueprint.yaml

@@ -1,12 +1,35 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20 (user: "make the repo proper and not have
+# sensitive things in the files"). The value itself was already the
+# genuine live secret ArgoCD's own OIDC client uses (apps/argocd/
+# manifests/external-secret.yaml pulls the same value from Vault at
+# secret/argocd-oauth) - Vault was already the source of truth on the
+# APP side, this blueprint (the Authentik PROVIDER side) just had its own
+# separate hardcoded plaintext copy instead of also reading from Vault.
+#
+# Converted ConfigMap -> ExternalSecret (chart supports mounting
+# blueprints from Secrets too - see blueprints.secrets in values.yaml).
+# client_id stays inline - it's not a secret, same convention as every
+# other blueprint here.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-argocd
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-argocd
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         argocd.yaml: |-
           version: 1
           metadata:
@@ -20,7 +43,7 @@ data:
               attrs:
                 name: ArgoCD
                 client_id: 3791058a7de278045e5ec36be29f7a33d635119b8c786f20c86b185139c28841
-          client_secret: f787416822f5bf4c46fe9170e63d1bf9520bab7703d53341aaaec107c8c4ba253d96c30b70d23a1c0b5a401ae1ae4bfb5db06092d338e29e0b0f04cd29bc0b36
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -47,3 +70,8 @@ data:
                 slug: argocd
                 policy_engine_mode: any
                 provider: !KeyOf argocd-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: argocd-oauth
+        property: client-secret

infrastructure/authentik/gitlab-blueprint.yaml

@@ -1,12 +1,32 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20 (user: "make the repo proper and not have
+# sensitive things in the files"). Unlike argocd/n8n/etc, Vault had NO
+# copy of this at all before this fix - the ONLY place it existed was
+# here and in gitlab-oidc-secret (a manually kubectl-created Secret in
+# the gitlab namespace, apps/gitlab/values.yaml:166 - also fixed
+# alongside this). Created secret/gitlab-oauth in Vault with the existing
+# live value (not rotated - this is GitLab's actual working OIDC
+# credential right now, changing it would break login until both sides
+# are updated in lockstep).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-gitlab
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-gitlab
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         gitlab.yaml: |-
           # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
           version: 1
@@ -22,7 +42,7 @@ data:
               attrs:
                 name: GitLab
                 client_id: 70b9da5c8166cea0ba504a869824020bce6636
-          client_secret: 2e9c0c5b7a8969eb782d08bf1bf3d50ad96f8a73d9c18d1e4141816aebe14a622e8064bf5a5bce835d80e89cdc5f4cc6cf4a8c8234556647dc8884888866bd7d
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -51,3 +71,8 @@ data:
                 slug: gitlab
                 policy_engine_mode: any
                 provider: !KeyOf gitlab-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: gitlab-oauth
+        property: client-secret

infrastructure/authentik/grafana-blueprint.yaml

@@ -1,12 +1,29 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Unlike argocd/nextcloud, Vault had NO copy of
+# this at all - the only places it existed were here AND in
+# infrastructure/grafana/manifests/grafana-oauth-secret.yaml (also fixed
+# alongside this, same Vault path). Created secret/grafana-oauth with the
+# existing live value (not rotated - changing it would break login until
+# both sides are updated together).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-grafana
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-grafana
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         grafana.yaml: |-
           version: 1
           metadata:
@@ -66,7 +83,7 @@ data:
               attrs:
                 name: Grafana
                 client_id: bd03e9139dd2063c6c44c4d2f65f51d69de3ba0b6d6b1b9b41c255d2376d2dcc
-          client_secret: 6b6f2deecfe8fd56cae9c512cc71eedd463d67ff08f24c816b15b15e78ce36bc4f06a2276c5ffe3f67799d935994a32ed32cdc02ec674f279c82d7cfe3ca05d5
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -97,3 +114,8 @@ data:
                 slug: grafana
                 policy_engine_mode: any
                 provider: !KeyOf grafana-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: grafana-oauth
+        property: client-secret

infrastructure/authentik/guacamole-blueprint.yaml

@@ -1,12 +1,27 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Same story as argocd-blueprint.yaml: the value
+# was already Vault's source of truth on the app side (secret/
+# guacamole-oauth), this blueprint just had its own separate hardcoded
+# plaintext copy.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-guacamole
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-guacamole
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         guacamole.yaml: |-
           version: 1
           metadata:
@@ -46,7 +61,7 @@ data:
               attrs:
                 name: Guacamole
                 client_id: a55cbe3c6d2ae30c05c86385802ffcfd76a972c22c8d039f000281d4a149fd44
-          client_secret: 718d4c4816aa68767a6a0da0fa4099d492473c700ba236cbeb64d294762b9548acda7e716ba11b2ad7729d6a1c16c7890b227e3b2dcfc35fd4af1eb0d6662b0f
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -81,3 +96,8 @@ data:
                 slug: guacamole
                 policy_engine_mode: any
                 provider: !KeyOf guacamole-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: guacamole-oauth
+        property: client-secret

infrastructure/authentik/n8n-blueprint.yaml

@@ -1,12 +1,26 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Same story as argocd-blueprint.yaml: the value
+# was already Vault's source of truth on the app side (secret/n8n-oauth),
+# this blueprint just had its own separate hardcoded plaintext copy.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-n8n
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-n8n
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         n8n.yaml: |-
           version: 1
           metadata:
@@ -20,7 +34,7 @@ data:
               attrs:
                 name: n8n
                 client_id: e55cbe3c6d2ae30c05c86385802ffcfd76a972c22c8d039f000281d4a149fd44
-          client_secret: 718d4c4816aa68767a6a0da0fa4099d492473c700ba236cbeb64d294762b9548acda7e716ba11b2ad7729d6a1c16c7890b227e3b2dcfc35fd4af1eb0d6662b0f
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -47,3 +61,8 @@ data:
                 slug: n8n
                 policy_engine_mode: any
                 provider: !KeyOf n8n-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: n8n-oauth
+        property: client-secret

infrastructure/authentik/nextcloud-blueprint.yaml

@@ -1,12 +1,27 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Same story as argocd-blueprint.yaml: the value
+# was already Vault's source of truth on the app side (secret/
+# nextcloud-oauth), this blueprint just had its own separate hardcoded
+# plaintext copy.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-nextcloud
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-nextcloud
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         nextcloud.yaml: |-
           version: 1
           metadata:
@@ -20,7 +35,7 @@ data:
               attrs:
                 name: Nextcloud
                 client_id: HmTGnUfhCvjFFbUUAne7JLrucNC2X675JicPbEnQ
-          client_secret: qTUf4NYjzUuAqfNV5D7SFPuuhJJwVltU6U3LAuJVy7dddJWeJSv2B4wKaRxbbHqpIiSfYPDaKujhEysKbOWUnf4n9OHPKJ0bu1I2EzkYtChO1Gq4gUv5EHPTzQlMBPnl
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -50,3 +65,8 @@ data:
                 slug: nextcloud
                 policy_engine_mode: any
                 provider: !KeyOf nextcloud-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: nextcloud-oauth
+        property: client-secret

infrastructure/authentik/rancher-blueprint.yaml

@@ -1,12 +1,27 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Same story as argocd-blueprint.yaml: the value
+# was already Vault's source of truth on the app side (secret/
+# rancher-oauth), this blueprint just had its own separate hardcoded
+# plaintext copy.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-rancher
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-rancher
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         rancher.yaml: |-
           # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
           version: 1
@@ -21,7 +36,7 @@ data:
               attrs:
                 name: Rancher
                 client_id: 94a6beeaa91d0d0407cf8af807e8208a611cf3f25ae42161e697a8dccd563449
-          client_secret: 19ebd4545ba74a93c220d4471af634302c5991204cf650cabd522b0864d7617ded2c59b470ab6de7a5801e7de4c84e4b9741b983170815419c9503d55f849794
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -51,4 +66,8 @@ data:
                 slug: rancher
                 policy_engine_mode: any
                 provider: !KeyOf rancher-provider
-
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: rancher-oauth
+        property: client-secret

infrastructure/authentik/values.yaml

@@ -77,22 +77,26 @@ global:
     - name: AUTHENTIK_POSTGRESQL__PORT
       value: "61432"
 
-# Blueprints - Mount ConfigMaps for auto-discovery
+# Blueprints - Mount ConfigMaps for auto-discovery (no secrets) or
+# Secrets (client_secret-bearing ones, ExternalSecret-templated from
+# Vault - found and fixed 2026-08-20, see each file's own header for
+# what it used to look like).
 blueprints:
   configMaps:
+    - authentik-blueprints-forward-auth
+    - authentik-blueprints-prometheus
+    - authentik-blueprints-ceph
+    - authentik-blueprints-home-assistant
+    - authentik-blueprints-percona-everest
+    - authentik-blueprints-netbird
+  secrets:
     - authentik-blueprints-gitlab
     - authentik-blueprints-nextcloud
     - authentik-blueprints-argocd
     - authentik-blueprints-grafana
-    - authentik-blueprints-forward-auth
-    - authentik-blueprints-prometheus
     - authentik-blueprints-n8n
-    - authentik-blueprints-ceph
-    - authentik-blueprints-home-assistant
     - authentik-blueprints-guacamole
-    - authentik-blueprints-percona-everest
     - authentik-blueprints-rancher
-    - authentik-blueprints-netbird
     - authentik-blueprints-vault
 
 # Enable Prometheus metrics

infrastructure/authentik/vault-blueprint.yaml

@@ -1,12 +1,30 @@
 ---
-apiVersion: v1
+# Was a plain ConfigMap with client_secret hardcoded in plaintext - found
-kind: ConfigMap
+# and fixed 2026-08-20. Unlike argocd/nextcloud, Vault had NO copy of
+# this at all - the only places it existed were here AND in
+# infrastructure/vault/manifests/vault-init-configmap.yaml (embedded in a
+# shell script that runs `vault write auth/oidc/config` once at cluster
+# init - also fixed alongside this, same Vault path). Created
+# secret/vault-oauth with the existing live value (not rotated - this is
+# what Vault's OWN oidc auth method is currently configured with).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: authentik-blueprints-vault
   namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: authentik-blueprints-vault
+    creationPolicy: Owner
+    template:
+      metadata:
         labels:
           goauthentik.io/blueprint: "true"
-data:
+      data:
         vault.yaml: |-
           version: 1
           metadata:
@@ -20,7 +38,7 @@ data:
               attrs:
                 name: Vault
                 client_id: 9816a5ae7e7914b5d18f4ab939d011a98f8c8d6b3bb6777c46431afa06ac4a85
-          client_secret: ed2ba1c6378c7a46341b5162f39a7fab80e37596b01ed387c3719e8e0040344cf1daa307476c2e7a7f75041b3979275b1ebf00bb8bad94c864b4a38ded544f7b
+                client_secret: "{{ .clientSecret }}"
                 authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
                 authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
                 invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
@@ -49,3 +67,8 @@ data:
                 slug: vault
                 policy_engine_mode: any
                 provider: !KeyOf vault-provider
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: vault-oauth
+        property: client-secret

infrastructure/grafana/manifests/grafana-oauth-secret.yaml

@@ -1,12 +1,32 @@
-# infrastructure/grafana/grafana-oauth-secret.yaml
+# Was a plain Secret with the OIDC client_id/client_secret hardcoded in
-# Grafana OAuth secret - hardcoded from blueprint
+# plaintext (the file's own old comment even said "hardcoded from
-
+# blueprint") - found and fixed 2026-08-20 alongside
-apiVersion: v1
+# infrastructure/authentik/grafana-blueprint.yaml (same value, same Vault
-kind: Secret
+# path - see that file for the full story).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: grafana-authentik-oauth
   namespace: grafana
-type: Opaque
+spec:
-stringData:
+  refreshInterval: 1h
-  GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "bd03e9139dd2063c6c44c4d2f65f51d69de3ba0b6d6b1b9b41c255d2376d2dcc"
+  secretStoreRef:
-  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "6b6f2deecfe8fd56cae9c512cc71eedd463d67ff08f24c816b15b15e78ce36bc4f06a2276c5ffe3f67799d935994a32ed32cdc02ec674f279c82d7cfe3ca05d5"
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: grafana-authentik-oauth
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      data:
+        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ .clientId }}"
+        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .clientSecret }}"
+  data:
+    - secretKey: clientId
+      remoteRef:
+        key: grafana-oauth
+        property: client-id
+    - secretKey: clientSecret
+      remoteRef:
+        key: grafana-oauth
+        property: client-secret

infrastructure/vault/manifests/vault-init-configmap.yaml

@@ -173,8 +173,22 @@ data:
       ttl="24h" >/dev/null
 
     # --- OIDC Auth (Authentik SSO) ---
-    OIDC_CLIENT_ID="9816a5ae7e7914b5d18f4ab939d011a98f8c8d6b3bb6777c46431afa06ac4a85"
+    # OIDC_CLIENT_ID/SECRET used to be hardcoded here in plaintext - found
-    OIDC_CLIENT_SECRET="ed2ba1c6378c7a46341b5162f39a7fab80e37596b01ed387c3719e8e0040344cf1daa307476c2e7a7f75041b3979275b1ebf00bb8bad94c864b4a38ded544f7b"
+    # and fixed 2026-08-20. Can't source this from Vault itself the way
+    # every other app's OIDC secret now does (infrastructure/authentik/
+    # vault-blueprint.yaml, secret/vault-oauth) - this job is what GRANTS
+    # ESO's own Kubernetes-auth role a few lines above
+    # (bound_service_account_names="...,external-secrets"), so ESO can't
+    # yet authenticate to Vault at the point this script runs - genuinely
+    # circular. Sourced from vault-oidc-bootstrap instead, a plain Secret
+    # created once manually (kubectl, not git):
+    #   kubectl -n vault create secret generic vault-oidc-bootstrap \
+    #     --from-literal=client_id=<same value as secret/vault-oauth> \
+    #     --from-literal=client_secret=<same value as secret/vault-oauth>
+    # envFrom on the Job (vault-init-job.yaml) injects these as
+    # VAULT_OIDC_CLIENT_ID/VAULT_OIDC_CLIENT_SECRET.
+    OIDC_CLIENT_ID="${VAULT_OIDC_CLIENT_ID:?VAULT_OIDC_CLIENT_ID not set - see vault-oidc-bootstrap secret}"
+    OIDC_CLIENT_SECRET="${VAULT_OIDC_CLIENT_SECRET:?VAULT_OIDC_CLIENT_SECRET not set - see vault-oidc-bootstrap secret}"
     OIDC_DISCOVERY_URL="https://auth.kube.huskypup.net/application/o/vault/"
 
     echo "==> Configuring OIDC auth (Authentik)..."

infrastructure/vault/manifests/vault-init-job.yaml

@@ -16,6 +16,19 @@ spec:
         - name: vault-init
           image: alpine/k8s:1.32.13
           command: ["/bin/bash", "/scripts/vault-init-and-store.sh"]
+          env:
+            # See the matching comment in vault-init-configmap.yaml for
+            # why this can't come from Vault itself via ESO.
+            - name: VAULT_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: vault-oidc-bootstrap
+                  key: client_id
+            - name: VAULT_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: vault-oidc-bootstrap
+                  key: client_secret
           volumeMounts:
             - name: scripts
               mountPath: /scripts