The chart still deploys the pre-plan-101 topology, and its default install crashloops

[tada5hi]

The chart's appVersion is 1.0.0-beta.63. Authup beta.64 changes the process topology, configuration document, and image filesystem layout, so the next chart release must move all three together.

Release blockers

1. Retire the old admin-console workload

adminConsole.enabled currently deploys the retired client/admin-console process. Replace that workload and remove _admin-console-env.tpl, the NUXT_PUBLIC_* / NUXT_API_URL wiring, the second-origin URL model, and the TRUSTED_ORIGINS auto-append for that origin.

The supported CLI roles are:

• authup start: API plus every enabled console on one listener (the default)
• authup start core: API and IdP only
• authup start worker: background worker only; no listener and no migrations
• authup start console [admin|account|auth]: one console service, or every enabled console, on the configured console ports

Do not emit the retired server/core prefix. Do not use authup core, authup worker, authup console ..., or authup start --worker; all exit 1.

2. Mount the configuration where beta.64 reads it

Both configuration ConfigMaps must use the key authup.yml and mount it as:

mountPath: /etc/authup/authup.yml
subPath: authup.yml

The image runs from /opt/authup and passes --configDirectory /etc/authup, so keeping the old mount path leaves server.configuration unread. The document uses unprefixed sections (core:, adminConsole:, accountConsole:, authConsole:, theme:); server.core.* and the rest of the server.* namespace are retired.

3. Move provisioning and log storage to the new paths

• Replace WRITABLE_DIRECTORY_PATH with PROVISIONING_DIRECTORY_PATH and mount operator-authored provisioning at /etc/authup/provisioning (the variable names the directory itself).
• Set LOG_DIRECTORY_PATH=/var/log/authup and provide a writable volume there when readOnlyRootFilesystem is enabled.
• Remove /var/lib/authup and WRITABLE_DIRECTORY_PATH from reserved values and templates.

Without these changes file provisioning silently stops and file logging violates the chart's read-only-root claim.

Decided topology

• Keep the single authup start Deployment as the default. It needs no split routing and works without Redis at one replica.
• Repurpose templates/admin-console/ and add sibling account-console/ and auth-console/ workloads. Each runs authup start console <name> and exposes its configured console port.
• Console services hold no credential, database, Redis connection, migrations, or worker components. They serve at the root of their listener, so ingress rules must strip /console/<name> before forwarding.
• Keep these cookie-login routes on the API workload with exact-match precedence: /console/admin/login/start, /console/admin/callback, /console/account/login/start, and /console/account/callback.
• Route every other path under each console URL to that console service. Mount the theme ConfigMap on the console pods.
• On every split console workload set INTERNAL_URL=http://<server-fullname>:<core-port>. authup start console deliberately does not derive this value; without it server-side console calls go through the public ingress and can 502.
• Redis remains required when the API workload has multiple replicas; sqlite cannot be used for a split deployment.

Worker and migration ownership

Implement the worker workload tracked by #28 with authup start worker.

• The worker pod sets WORKER_ENABLED=true and has no HTTP probes or port.
• API pods set WORKER_ENABLED=false while the dedicated worker is enabled.
• When the migration hook is enabled, API pods set MIGRATION_ENABLED=false; the migration Job remains the one DDL owner.
• The worker does not run migrations and must start after the migration Job.

NetworkPolicy

The same rewrite must update templates/server/networkpolicy.yaml:

• remove the in-cluster ingress selector for the retired component=admin-console workload;
• add the new console/worker traffic actually required by the selected topology;
• preserve The server NetworkPolicy does not select the migration Job pod, so the hook has no egress in a default-deny namespace #22's migration-Job egress requirement (the migration pod is component=migration and otherwise receives no database/DNS allowance in a default-deny namespace).

Work

• Replace both configuration ConfigMap keys and mounts with /etc/authup/authup.yml.
• Replace writable-directory provisioning and add the /var/log/authup volume/mount.
• Remove the retired admin-console process and Nuxt environment wiring.
• Implement the three optional console workloads and prefix-stripping routes.
• Keep the four cookie-login routes on the API workload.
• Set INTERNAL_URL only on split console workloads.
• Implement Add the worker workload: authup start worker, with WORKER_ENABLED=false on API replicas #28's worker workload and the WORKER_ENABLED env pair.
• Set MIGRATION_ENABLED=false on the server Deployment when the migration hook is enabled.
• Update NetworkPolicy selectors/egress while preserving The server NetworkPolicy does not select the migration Job pod, so the hook has no egress in a default-deny namespace #22.
• Update values, schema, validations, README, NOTES, DESIGN.md, and .agents/references/authup.md.
• Add a split-topology values fixture and run make docs schema plus make test.

This issue supersedes #25 and #26. #22 remains the detailed pre-existing migration NetworkPolicy report; its fix belongs in this same template rewrite.