Thore Cimbal
df6d291d81
The release carried upgrade remediation with three retries and no strategy. The Flux CRD is explicit: the strategy defaults to rollback, remediation runs between each attempt, and the last failure is remediated as well whenever retries exceed zero. A failing upgrade would therefore have rolled Helm back to the old version up to four times, against a database Django had already migrated forward — the migration inconsistency Authentik's own documentation warns about, triggered by this line. Here the way back is a database restore, not a version rollback, so an automatic rollback cannot help and can only deepen the damage. It goes back to three once the jump is done; outside a migration window the remediation is right. Nothing else changes: the chart version, the values and the install remediation are untouched.
116 lines
3.3 KiB
YAML
116 lines
3.3 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
version: "2026.2.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
# ⚠️ Waehrend des Authentik-Sprungs 2026.2.3 -> 2026.5.6 -> 2026.8.0 auf 0.
|
|
# Die Flux-CRD sagt: strategy defaults to 'rollback', Remediation laeuft
|
|
# ZWISCHEN jedem Versuch, und remediateLastFailure ist bei retries>0
|
|
# ebenfalls scharf. Ein misslingendes Upgrade wuerde damit bis zu viermal
|
|
# auf die alte Fassung zurueckgerollt - gegen eine Datenbank, die Django
|
|
# schon nach vorne migriert hat. Genau der Zustand 'migration inconsistency',
|
|
# vor dem Authentiks Anleitung warnt, ausgeloest von dieser Zeile.
|
|
# Der Rueckweg ist hier eine Datenbank-Wiederherstellung, keine
|
|
# Fassungsruecknahme (management #0051).
|
|
# NACH dem Sprung zurueck auf 3 - im Normalbetrieb ist die Behebung richtig.
|
|
retries: 0
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
# Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
|
|
# Provider's client_secret can be captured as code without ever
|
|
# inlining the live credential into a plain (non-SOPS) ConfigMap.
|
|
env:
|
|
- name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: mas-oidc-client-secret
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
# Chart's own generated policy allows ANY pod in ANY namespace on 5432
|
|
# (see issue #37) - disabled in favor of our own scoped policy in
|
|
# apps/authentik/networkpolicy.yaml.
|
|
networkPolicy:
|
|
enabled: false
|