What pull request #1 did for team-bravo

What we wanted

team-bravo runs a nightly report exporter: a job with no user present that calls internal APIs as itself. That is an OAuth client credentials client, which means a real secret.

What the pull request contained

One commit (976f8ce), one new file, 14 lines, on branch request/team-bravo-report-exporter:

# requests/team-bravo/report-exporter.yaml
apiVersion: courier.sororlab.dev/v1alpha1
kind: OAuthClient
metadata:
  name: report-exporter
  namespace: team-bravo
spec:
  displayName: "team-bravo: nightly report exporter"
  clientType: confidential
  grantTypes:
    - client_credentials
  scopes:
    - openid
    - profile
    - groups

Review: the policy check failed until the security-approved label was added (20:51:53), then passed (20:53:29). The PR merged at 21:40:39 as de172bd. Details in the walkthrough.

What happened on merge

Assembled from five independent records: ArgoCD's sync history, Kubernetes object timestamps, the controller's status, Authentik's event log and Vault's audit log.

1. 21:40:39 · GitHub

   PR #1 merged into main as de172bd.

2. 21:41:38 · ArgoCD

   ApplicationSet courier-requests generated Application courier-requests-team-bravo for the new directory and started syncing. Namespace team-bravo was created.

3. 21:41:40 · Kubernetes

   OAuthClient team-bravo/report-exporter created (generation 1). Sync finished: successfully synced (all tasks run).

4. 21:41:41 · Vault

   Controller identity kubernetes-courier-system-courier-controller-manager (policy courier) created version 1 of the credentials entry: the new secret, state: pending.

5. 21:41:42 · Authentik

   User courier-controller created OAuth2 provider courier-team-bravo-report-exporter with that secret, plus its application and a binding to group team-bravo.

6. 21:41:45 · Vault

   Same controller identity patched the entry to version 2: state: active, client_id and endpoints. The secret was not read or resent.

7. 21:41:45 · Kubernetes

   OAuthClient condition Ready=True, reason Delivered.

8. 21:42:24 · Vault

   Access check: jwt-courier-svc-alpha (team-alpha) denied; jwt-courier-svc-bravo (team-bravo) read ok.

What was created, platform by platform

GitHub

ArgoCD

Kubernetes

OAuthClient status

clientId:             8BhnTaEg83o1lfhlwLSbBqHL6N5rMGOdsUi9rfA9
credentialsDelivered: true
identityProvider:     authentik
lastSecretIssued:     2026-09-13T21:41:45Z
observedGeneration:   1
secretPath:           kv/teams/team-bravo/oauth-clients/team-bravo-report-exporter
conditions:
  - Ready=True  reason=Delivered  since 21:41:45
    "credentials are available at kv/teams/team-bravo/oauth-clients/team-bravo-report-exporter"

Nothing else was created in the namespace: no Secret, no workload. The only other objects are the ones Kubernetes adds to every namespace (ServiceAccount default, ConfigMap kube-root-ca.crt).

Authentik

OAuth2 provider (pk 12)

Application and access

Authentik event log for this client

21:41:42  model_created  by courier-controller  oauth2provider  courier-team-bravo-report-exporter
21:51:48  model_updated  by courier-controller  oauth2provider  courier-team-bravo-report-exporter
21:51:48  model_updated  by courier-controller  application     team-bravo: nightly report exporter
22:01:51  model_updated  by courier-controller  oauth2provider  courier-team-bravo-report-exporter
22:01:52  model_updated  by courier-controller  application     team-bravo: nightly report exporter

Every change is attributed to the scoped courier-controller account, not to an administrator. The updates every ten minutes are the controller's routine drift repair, discussed below.

Vault

The credentials entry

Path kv/teams/team-bravo/oauth-clients/team-bravo-report-exporter

Who can read it

# policy team-bravo
path "kv/data/teams/team-bravo/*"      { capabilities = ["read"] }
path "kv/metadata/teams/team-bravo/*"  { capabilities = ["read", "list"] }
path "kv/metadata/teams/team-bravo"    { capabilities = ["list"] }

# granted through identity groups mapped from the IdP group team-bravo
identity group team-bravo       alias team-bravo on oidc/  →  policy team-bravo   # people
identity group team-bravo-jwt   alias team-bravo on jwt/   →  policy team-bravo   # workloads

Vault audit log for this path

Three things stand out. The controller never reads the entry; it only creates and patches. The only successful data read is team-bravo's. And an administrator's access is recorded like anyone else's, which is why the broad vault-admin policy is on the hardening checklist.

What team-bravo can do now

Added since: two ready-made ways to consume

Details and full output: Use your credentials.

After delivery

Every ten minutes the controller re-applies each ready request. The records show exactly what that did:

• Authentik: provider and application model_updated at 21:51 and 22:01. This is intended: it restores any settings changed by hand in the console. Because nothing had changed, the updates were no-ops, though they add entries to the event log.
• Vault: patches at 21:51:49 and 22:01:52 created versions 3 and 4 with identical content. This was not intended.

The vault's own version history confirms the fix. Versions 1 and 2 are the delivery (pending, then active). Versions 3 to 6 are resyncs, exactly ten minutes apart. The fixed controller rolled out at about 22:27 UTC, and no version has been written since.

Reproduce the inventory

Every table on this page came from one script, run after the merge:

deploy/phase2/inventory.sh team-bravo report-exporter

It reads each platform directly: the namespace and OAuthClient; the ArgoCD application and sync history; the Authentik provider, application, bindings and event log; and the Vault entry metadata, fields (secret shown only as present with its length), access policy, identity groups and audit log.