From 8a26c2a33c005a15994bf940db8b2c7ed70305ec Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 25 Jun 2026 11:02:32 +0200 Subject: [PATCH] authentik: roll server + ldap-outpost to 2026.5.3, pin chart to match Bumps the samba-bridge fork images 2026.2.3 -> 2026.5.3 (built from authentik-samba-bridge#f02b945 / PR #1) and pins the Helm chart to 2026.5.3 so chart appVersion and the running app image are in lockstep. - global.image.tag: 2026.2.3-b06668e -> 2026.5.3-f02b945 - ldap-outpost container_image: 2026.2.3-0140972 -> 2026.5.3-f02b945 - chart version: ">=2025.12.0" (floated to 2026.5.3) -> pinned "2026.5.3" Both images verified present in the gitea registry. The fork bump validated the samba patch and server build assumptions (TENANT_APPS sed, ManagedAppConfig, python3.14 venv, ldap runtime contract) against upstream version/2026.5.3 before building. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/authentik/blueprints-configmap.yaml | 2 +- kubernetes/apps/authentik/helmrelease.yaml | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 5ed558dc..a5c8f713 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -555,7 +555,7 @@ data: # return entries instead of short-circuiting. Built from # the samba-bridge repo at # gitea.renner.uno/k.renner/authentik-samba-bridge . - container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.2.3-0140972 + container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.5.3-f02b945 object_naming_template: "ak-outpost-%(name)s" kubernetes_namespace: authentik kubernetes_replicas: 1 diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml index 439dc815..8069a3a3 100644 --- a/kubernetes/apps/authentik/helmrelease.yaml +++ b/kubernetes/apps/authentik/helmrelease.yaml @@ -17,7 +17,10 @@ spec: chart: spec: chart: authentik - version: ">=2025.12.0" + # Pinned to match the samba-bridge fork's app image (server.Dockerfile + # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a + # floating range drifts the chart ahead of the pinned app image. + version: "2026.5.3" sourceRef: kind: HelmRepository name: authentik @@ -49,7 +52,7 @@ spec: # 2. Pinning means the deployed binary is traceable to a # specific repo commit. Bump the tag whenever a new build # is published from gitea.renner.uno/k.renner/authentik-samba-bridge . - tag: "2026.2.3-b06668e" + tag: "2026.5.3-f02b945" envFrom: # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET # consumed by the bridge module at Django app startup. Missing