Retire Tandoor rather than migrate to Keycloak
Date: 2026-07-03 Status: Accepted Decision: hl-3328 Deciders: Sean Brandt
Context
Section titled “Context”During Keycloak Phase-2 OIDC-cutover scoping (epic hl-5g05, 2026-06-29), Tandoor was one of the Authentik OIDC apps enumerated for migration. The cluster already runs Mealie, a second recipe manager, making Tandoor redundant. The choice was made to exclude Tandoor from the migration and retire it entirely rather than build it a Keycloak client — but this was never recorded as a decision; it surfaced only as a grounding note inside the epic. This ADR closes that gap (design bead hl-nknn).
Decision
Section titled “Decision”Retire Tandoor outright instead of migrating it to Keycloak. Mealie is the designated successor recipe manager, and no keycloak_openid_client is built for Tandoor. The full decommission (ArgoCD app, CNPG database, Authentik client, Vault paths, agentgateway virtual key, uptime-kuma monitor, docs) is specified in the 2026-07-03 Tandoor decommission design + plan.
Rationale
Section titled “Rationale”- Mealie already covers the recipe-manager capability, so migrating Tandoor’s auth would preserve redundant infrastructure with no functional gain.
- Excluding Tandoor shrinks the surface area (OIDC clients, trust boundaries) the Keycloak migration must guarantee parity for.
- Parallel-run policy (Authentik stays live) made exclusion low-risk: Tandoor kept authenticating against Authentik harmlessly until retirement.
Alternatives Considered
Section titled “Alternatives Considered”- Retire Tandoor, consolidate on Mealie (chosen): eliminates a redundant service and its entire dependency footprint (OIDC client never built, CNPG DB, Vault policy/paths, agentgateway key, monitor); shrinks the trust/dependency graph the Keycloak migration must cover. Cost: Tandoor’s recipe data is discarded (later formalized as hard-delete in the decommission design).
- Migrate Tandoor to Keycloak / keep it running (rejected): preserves a working app and its data with no user-facing loss and is uniform with cutting over the other OIDC apps, but perpetuates a redundant recipe manager alongside Mealie and adds ongoing OIDC-client, CNPG, Vault, and trust-boundary maintenance for no added capability.
Consequences
Section titled “Consequences”- Positive: one fewer OIDC client / trust boundary to migrate and maintain long-term; the cluster converges on a single recipe manager (Mealie).
- Negative: Tandoor’s recipe data is ultimately discarded (no migration path was built; hard-delete per the decommission design).
- Neutral: Tandoor kept authenticating against Authentik, unaffected, until this decommission.