From 55b063b236dd01c21c43be1ae622f07e735edad8 Mon Sep 17 00:00:00 2001
From: nick-gorse <nick@olb42.com>
Date: Mon, 20 Apr 2026 01:05:01 +0100
Subject: [PATCH] Co-locate authentik worker with server

---
 manifest/base/worker-deployment.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/manifest/base/worker-deployment.yaml b/manifest/base/worker-deployment.yaml
index ec60833..d7af15d 100644
--- a/manifest/base/worker-deployment.yaml
+++ b/manifest/base/worker-deployment.yaml
@@ -16,6 +16,13 @@ spec:
         app: authentik-worker
     spec:
       serviceAccountName: authentik-worker
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: authentik-server
+              topologyKey: kubernetes.io/hostname
       securityContext:
         runAsUser: 1000
         runAsGroup: 988