add

deploy/k8s/00-config.yaml

@@ -113,8 +113,12 @@ data:
       # is unset, so a missing secret is a crash loop rather than an
       # unauthenticated console.
       auth:
-        mode: apikey
+        mode: oidc
         api_keys: ["${FANCYDNS_API_KEY}"]
+        oidc_issuer: https://users.k6n.net
+        oidc_audience: https://dns.k6n.net
+        oidc_client_id: fancy-dns
+        oidc_write_roles: [admin]
         trust_loopback: false
 
     metrics:

deploy/k8s/08-secret-apikey.yaml

@@ -4,10 +4,9 @@
 #   kubectl -n dns create secret generic fancy-dns-apikey \
 #     --from-literal=api-key="$(openssl rand -hex 32)"
 #
-# With auth.mode: apikey and api_keys: ["${FANCYDNS_API_KEY}"] in the config,
-# a missing FANCYDNS_API_KEY is a startup error rather than an empty key, so a
-# forgotten secret shows up as a CrashLoopBackOff and not as an unauthenticated
-# console on the network.
+# With api_keys: ["${FANCYDNS_API_KEY}"] in the config, a missing
+# FANCYDNS_API_KEY is a startup error rather than an empty key. These keys
+# remain available for machine clients when the console uses OIDC.
 apiVersion: v1
 kind: Secret
 metadata: