Enhance Authentik integration in noble cluster setup by adding support for OAuth2 flow primary keys in configuration. Update README with troubleshooting steps for common API errors and improve deployment reliability with tasks to wait for Authentik worker rollout and API readiness. Adjust Helm chart values for Grafana and Headlamp to accommodate new OIDC settings, ensuring seamless authentication and authorization processes.

clusters/noble/bootstrap/headlamp/values-authentik-oidc.yaml

@@ -1,4 +1,7 @@
 # OIDC with Authentik — credentials live in Secret **headlamp-oidc** (envFrom), created by **noble_authentik**.
+#
+# With **externalSecret**, the Headlamp chart only adds **-oidc-callback-url** / **-oidc-use-pkce** args when these
+# values are set here (or under **env:**). The Secret alone is not enough — without them, login can fail or Authentik returns errors.
 
 config:
   oidc:
@@ -7,3 +10,5 @@ config:
     externalSecret:
       enabled: true
       name: headlamp-oidc
+    callbackURL: "https://headlamp.apps.noble.lab.pcenicni.dev/oidc-callback"
+    usePKCE: true