Thore Cimbal
c9a3ae60f5
Both steps are verified: migrations applied without inconsistency, blueprints unchanged, and a real login recorded server-side on each version. Outside a migration window an automatic rollback is the right behaviour, so remediation goes back to three retries.
120 lines
3.4 KiB
YAML
120 lines
3.4 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
# Zweite und letzte Stufe des Sprungs (management #0051, Gate 2).
|
|
# Der Weg war 2026.2.3 -> 2026.5.6 -> 2026.8.0: Authentik verlangt die
|
|
# letzte Minor-Fassung jeder Reihe und verbietet das Ueberspringen von
|
|
# Fassungsreihen.
|
|
#
|
|
# An den Images gemessen, nicht geschaetzt (CRITICAL / HIGH):
|
|
# 2026.2.3 27 / 477 2026.5.6 5 / 92 2026.8.0 5 / 21
|
|
# Die Zwischenstufe trug den gesamten CRITICAL-Gewinn, diese Stufe die
|
|
# restlichen 71 HIGH. Was bleibt, sind perl-base und libxml2 ohne Fix.
|
|
version: "2026.8.0"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
# Waehrend des Sprungs 2026.2.3 -> 2026.5.6 -> 2026.8.0 stand hier 0, damit
|
|
# Flux ein misslingendes Upgrade nicht selbsttaetig auf die alte Fassung
|
|
# zurueckrollt - der Rueckweg war dort eine Datenbank-Wiederherstellung,
|
|
# keine Fassungsruecknahme (management #0051). Sprung ist durch, also
|
|
# wieder scharf: im Normalbetrieb ist die Behebung richtig.
|
|
retries: 3
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
# Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
|
|
# Provider's client_secret can be captured as code without ever
|
|
# inlining the live credential into a plain (non-SOPS) ConfigMap.
|
|
env:
|
|
- name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: mas-oidc-client-secret
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
# Chart's own generated policy allows ANY pod in ANY namespace on 5432
|
|
# (see issue #37) - disabled in favor of our own scoped policy in
|
|
# apps/authentik/networkpolicy.yaml.
|
|
networkPolicy:
|
|
enabled: false
|