fix(authelia): load rotated client verifier from secret file

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

sso-mfa/k8s/authelia/configmap.yaml

@@ -9,10 +9,10 @@
 #   AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE
 #   AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE
 #   AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE
-#   AUTHELIA_IDENTITY_PROVIDERS_OIDC_CLIENTS_0_SECRET_FILE
 #
 # The *_FILE convention tells Authelia to read the secret from a file path
-# (mounted from the authelia-secrets K8s Secret — see deployment.yaml).
+# (mounted from the authelia-secrets K8s Secret — see deployment.yaml). The
+# OIDC client verifier is a list entry and is loaded with the template filter.
 #
 # Access control policy is deliberately set to one_factor (password only).
 # MFA is handled out-of-band by KeyCape via the privacyIDEA adapter AFTER
@@ -120,8 +120,10 @@ data:
         clients:
           - id: keycape
             description: "KeyCape IAM Orchestration Layer"
-            # bcrypt hash of the KeyCape OIDC client secret (hash is not sensitive — safe in ConfigMap)
-            secret: "$2b$12$W/ct2nasY4wruQrFVh33UO5qgoxYTBNVvTBqfZHMwBVll13ZeCli."
+            # OIDC clients are a list, so Authelia's *_FILE environment
+            # mechanism cannot override this field. The template filter reads
+            # the bcrypt verifier from the Secret-mounted file at startup.
+            secret: '{{ secret "/run/secrets/authelia/keycape_client_secret_hash" }}'
             public: false
             authorization_policy: one_factor
             consent_mode: implicit

sso-mfa/k8s/authelia/deployment.yaml

@@ -11,8 +11,8 @@
 #   4. This file
 #   5. ingress.yaml
 #
-# Sensitive values are passed as *_FILE env vars pointing to Secret-mounted files.
-# See configmap.yaml for the full list of injected secrets.
+# Sensitive values are passed as *_FILE env vars or the template filter,
+# pointing to Secret-mounted files. See configmap.yaml for the full list.
 
 apiVersion: apps/v1
 kind: Deployment
@@ -67,6 +67,10 @@ spec:
               value: /run/secrets/authelia/oidc_hmac_secret
             - name: AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE
               value: /run/secrets/authelia/oidc_issuer_private_key
+            # Required for the templated OIDC client verifier in
+            # authelia-config; list entries cannot use *_FILE overrides.
+            - name: X_AUTHELIA_CONFIG_FILTERS
+              value: template
 
           volumeMounts:
             # Config from ConfigMap