From f39b4afc431de15a15f5e3ef716ec69f9cd1bf1d Mon Sep 17 00:00:00 2001
From: Agents Agent <agents@jorisjonkers.dev>
Date: Fri, 26 Jun 2026 13:51:25 +0200
Subject: [PATCH] fix(agents-api): wire CREDENTIAL_INGEST_BEARER so credential
 ingest authenticates

Posting a captured credential to /api/v1/internal/credentials returned 401
Unauthorized. The endpoint is guarded by InternalBearerAuthFilter, which
compares the request's bearer against CREDENTIAL_INGEST_BEARER. The agents-api
Deployment never set that variable, so the filter had no expected token and
rejected every request as "Internal endpoint not configured".

The agents-login worker already presents the shared agents-login-internal
token as its bearer. Both agents-api Deployments now source
CREDENTIAL_INGEST_BEARER from the same secret key, so the presented and
expected tokens match.
---
 .../stateless/agents-api/deployment-enschede-ws.yaml     | 9 +++++++++
 .../flux/apps/stateless/agents-api/deployment.yaml       | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml b/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
index 37d34419..99c792af 100644
--- a/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
+++ b/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
@@ -192,6 +192,15 @@ spec:
                   name: agents-login-internal
                   key: token
                   optional: true
+            # Bearer the worker presents when posting captured credentials to
+            # /api/v1/internal/credentials. Same shared secret as INTERNAL_TOKEN;
+            # without it the ingest filter has no expected token and 401s.
+            - name: CREDENTIAL_INGEST_BEARER
+              valueFrom:
+                secretKeyRef:
+                  name: agents-login-internal
+                  key: token
+                  optional: true
           ports:
             - containerPort: 8082
               name: http
diff --git a/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml b/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
index e83454d0..ee03af95 100644
--- a/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
+++ b/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
@@ -209,6 +209,15 @@ spec:
                   name: agents-login-internal
                   key: token
                   optional: true
+            # Bearer the worker presents when posting captured credentials to
+            # /api/v1/internal/credentials. Same shared secret as INTERNAL_TOKEN;
+            # without it the ingest filter has no expected token and 401s.
+            - name: CREDENTIAL_INGEST_BEARER
+              valueFrom:
+                secretKeyRef:
+                  name: agents-login-internal
+                  key: token
+                  optional: true
           ports:
             - containerPort: 8082
               name: http