feat: add cli config context-delete and TLS support

.github/workflows/ci.yaml

@@ -1312,11 +1312,11 @@ jobs:
           - provider: authentik
             runtime: authentik-compose
             backend: compose
-            command: compose
+            command: test compose
           - provider: authentik
             runtime: authentik-kubernetes
             backend: kubernetes
-            command: k8s
+            command: test k8s
     env:
       NMP_AUTHENTIK_K8S_RUNTIME: kind
       NMP_AUTHENTIK_K8S_NAMESPACE: nemo-authentik

contrib/auth/authentik/README.md

@@ -32,9 +32,9 @@ Runtime details live separately:
 ## Test Harness
 
 `run.sh` is the automation entrypoint for CI-style validation and repeatable
-local test runs. It can run the local Compose stack, run the Compose auth-idp
-contract tests, run the Kubernetes auth-idp contract tests, and clean up local
-resources.
+local test runs. It can start durable Compose or Kubernetes auth-idp
+environments, run the Compose or Kubernetes auth-idp contract tests, and clean
+up local resources.
 
 ```bash
 contrib/auth/authentik/run.sh --help
@@ -43,17 +43,46 @@ contrib/auth/authentik/run.sh --help
 Common commands:
 
 ```bash
-contrib/auth/authentik/run.sh compose
-contrib/auth/authentik/run.sh k8s
+contrib/auth/authentik/run.sh up compose
+contrib/auth/authentik/run.sh up k8s
+contrib/auth/authentik/run.sh test compose
+contrib/auth/authentik/run.sh test k8s
 contrib/auth/authentik/run.sh prepare-local
-contrib/auth/authentik/run.sh run-local
-contrib/auth/authentik/run.sh down
+contrib/auth/authentik/run.sh down compose
+contrib/auth/authentik/run.sh down k8s
+contrib/auth/authentik/run.sh clean
 ```
 
+`up compose` and `up k8s` also create user NeMo CLI contexts named
+`authentik-compose` and `authentik-k8s`. The contexts include the
+local gateway URL, default workspace, and gateway certificate authority so users
+can switch to them with `nemo config use-context`.
+
+Use `--key KEY` with `up` to run a second durable instance. The key derives
+managed names such as `authentik-compose-KEY`, `authentik-k8s-KEY`,
+`authentik-e2e-KEY`, and `nmp-authentik-KEY`, and keyed `up` commands choose
+an available local gateway port by default. Use the same key with `down` to
+remove that instance:
+
+```bash
+contrib/auth/authentik/run.sh up compose --key dev
+contrib/auth/authentik/run.sh down compose --key dev
+```
+
+`up k8s` uses `https://127.0.0.1:18082` by default for a stable manual URL.
+`test k8s` chooses an available local port by default so it can run while other
+local k8s auth-idp workflows are using that stable port. Set
+`NMP_AUTHENTIK_K8S_GATEWAY_PORT` to force a specific test port. The `test`
+actions do not add user NeMo CLI contexts.
+
 The harness keeps generated local inputs in `contrib/auth/authentik/.generated`
 so Compose and Kubernetes test runs can reuse the same workload-token signing
-key. Diagnostics are written under `docker/logs/authentik-*` by default, or
-under `E2E_SERVICES_LOG_DIR` when that environment variable is set.
+key. Durable `up` actions record lifecycle state under
+`contrib/auth/authentik/.generated/instances` by default so `down` and `clean`
+can remove recorded instances later. Override that path with
+`NEMO_AUTHENTIK_STATE_DIR`. Diagnostics are written under
+`docker/logs/authentik-*` by default, or under `E2E_SERVICES_LOG_DIR` when that
+environment variable is set.
 
 For manual startup and walkthroughs, prefer the shared tutorial above.
 

contrib/auth/authentik/helm/values.yaml

@@ -130,6 +130,8 @@ nemo-platform:
   core:
     controller:
       controllerGroup: core
+      startupProbe:
+        failureThreshold: 80
       env:
         NMP_PLATFORM_URL: "https://nemo-platform-envoy.$(POD_NAMESPACE).svc.cluster.local:8080"
         NMP_AUTH_URL: "https://nemo-platform-envoy.$(POD_NAMESPACE).svc.cluster.local:8080"
@@ -141,6 +143,8 @@ nemo-platform:
       create: true
       name: nemo
     serviceGroup: core
+    startupProbe:
+      failureThreshold: 80
     env:
       NMP_AUTH_TOKEN_SIGNING__PRIVATE_KEY_FILE: "/etc/nmp/workload-token/private-key.pem"
     extraVolumes: