Thore Cimbal
a252ac0f09
Authentik's documentation forbids skipping major releases and requires the latest minor of each before moving on, so 2026.5.6 comes before 2026.8.0 rather than being an optional stop. It is also where the benefit is. Measured on the images rather than assumed: 2026.2.3 carries 27 critical and 477 high findings, 2026.5.6 carries 5 and 92. This one step removes every critical finding that can be removed here; what remains is perl-base and libxml2, neither of which has a fix. The second step adds high findings only. Both breaking changes of this release were checked against our state and do not apply: the deprecated Postgres connection options are not set anywhere, and there are no outposts whose version would have to match. A manual backup was taken immediately before this, because the nightly one is hours old and the way back is a database restore rather than a version rollback.
124 lines
3.8 KiB
YAML
124 lines
3.8 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
# 2026.5.6 ist die LETZTE 2026.5 - Authentik verlangt "always upgrade to the
|
|
# latest minor version before upgrading to the next major version", und
|
|
# Fassungsreihen duerfen nicht uebersprungen werden. Naechster Schritt nach
|
|
# gruener Pruefung: 2026.8.0 (management #0051, Gate 2).
|
|
#
|
|
# Am Zielimage gemessen, nicht geschaetzt: 2026.2.3 traegt 27 CRITICAL und
|
|
# 477 HIGH, 2026.5.6 nur noch 5 und 92. Die Zwischenstufe bringt damit den
|
|
# gesamten CRITICAL-Gewinn; 2026.8.0 liefert danach nur noch HIGH.
|
|
version: "2026.5.6"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
# ⚠️ Waehrend des Authentik-Sprungs 2026.2.3 -> 2026.5.6 -> 2026.8.0 auf 0.
|
|
# Die Flux-CRD sagt: strategy defaults to 'rollback', Remediation laeuft
|
|
# ZWISCHEN jedem Versuch, und remediateLastFailure ist bei retries>0
|
|
# ebenfalls scharf. Ein misslingendes Upgrade wuerde damit bis zu viermal
|
|
# auf die alte Fassung zurueckgerollt - gegen eine Datenbank, die Django
|
|
# schon nach vorne migriert hat. Genau der Zustand 'migration inconsistency',
|
|
# vor dem Authentiks Anleitung warnt, ausgeloest von dieser Zeile.
|
|
# Der Rueckweg ist hier eine Datenbank-Wiederherstellung, keine
|
|
# Fassungsruecknahme (management #0051).
|
|
# NACH dem Sprung zurueck auf 3 - im Normalbetrieb ist die Behebung richtig.
|
|
retries: 0
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
# Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
|
|
# Provider's client_secret can be captured as code without ever
|
|
# inlining the live credential into a plain (non-SOPS) ConfigMap.
|
|
env:
|
|
- name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: mas-oidc-client-secret
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
# Chart's own generated policy allows ANY pod in ANY namespace on 5432
|
|
# (see issue #37) - disabled in favor of our own scoped policy in
|
|
# apps/authentik/networkpolicy.yaml.
|
|
networkPolicy:
|
|
enabled: false
|