konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

chore(deps): update helm release authentik to v2026.8.4 #1347

Open
renovate-bot wants to merge 1 commits from renovate/authentik into main
pull from: renovate/authentik
merge into: :main
Conversation 4 Commits 1 Files Changed 1
+1 -1
renovate-bot commented 2026-10-19 02:02:08 +00:00
Member
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
authentik (source) patch 2026.8.3 → 2026.8.4

❗ Important

Release Notes retrieval for this PR were skipped because no github.com credentials were available.
If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [authentik](https://goauthentik.io) ([source](https://github.com/goauthentik/helm)) | patch | `2026.8.3` → `2026.8.4` | > ❗ **Important** > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - Between 12:00 AM and 08:59 AM, only on Monday (`* 0-8 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
renovate-bot added 1 commit 2026-10-19 02:02:09 +00:00
chore(deps): update helm release authentik to v2026.8.4
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
review-bot reviewed: request changes
Details
e0186ca8f8
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model claude-haiku-5-5, commit e0186ca8f8973818b22f10b832e5cf4924d935dd.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

Renovate bumps the authentik Helm chart pin in kubernetes/apps/authentik/helmrelease.yaml from 2026.8.3 to 2026.8.4, a one-line change. The file's own comment requires the chart version to move in lockstep with the samba-bridge app image, and that image is still 2026.8.3-9dd92dd, so the PR breaks the stated pinning rule.

🔴 Blocking

  1. Chart and app image diverge; the file's lockstep rule is broken. kubernetes/apps/authentik/helmrelease.yaml:20-23:
    • Lines 20-22 say the chart is "Pinned to match the samba-bridge fork's app image (server.Dockerfile AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a floating range drifts the chart ahead of the pinned app image."
    • Line 23 (changed by this PR) sets version: "2026.8.4".
    • The server and worker still run gitea.renner.uno/konairius/authentik-samba-bridge-server:2026.8.3-9dd92dd (helmrelease.yaml:52, :61). The head commit does not touch that tag.
    • The same 2026.8.3 pin is in the LDAP outpost blueprint at kubernetes/apps/authentik/blueprints-configmap.yaml:715 (container_image: …ldap-outpost:2026.8.3-9dd92dd), which this PR also leaves alone.
    • In the bridge repo at 9dd92ddc, docker/server.Dockerfile has ARG AUTHENTIK_VERSION=2026.8.3 and FROM ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}. .woodpecker/build.yaml hard-codes AUTHENTIK_VERSION: "2026.8.3" for both images. There is no 2026.8.4 build and no tags at all in that repo.
    • History shows the team's practice: 8a26c2a (2026.5.3) and ca003e9/024eb97 (2026.8.3) moved the chart and both images together.
    • Cause: renovate.json groups authentik with ghcr.io/goauthentik/** ("chart and images together, one PR (REN-315, DB migrations)"). The bridge images are at gitea.renner.uno/konairius/… and are not in that group, so Renovate bumps only the chart.
    • Fix: hold or close this PR. Bump the chart only after the bridge is rebuilt at 2026.8.4 and helmrelease.yaml:61 and blueprints-configmap.yaml:715 move in the same change.

Base and mergeability checks: mergeable: true. Base master is at 5ebf7a04, which includes the bridge-repo-only commit 413f675 (already on master). Nothing on master supersedes or conflicts with this change. No review or comment exists on the PR. This is the first review, not a re-review.

⚪ Unverified

  • Chart 2026.8.4 contents. I could not read charts.goauthentik.io or the release notes (the PR body says they were skipped). I did not check whether the chart needs new values, env or migrations that assume a 2026.8.4 app.
  • Bridge patches on 2026.8.4. The bridge's TENANT_APPS sed (server.Dockerfile:58), the python3.14 venv path (:35-36) and the LDAP outpost GetUserOCs patch (patches/ldap-outpost-add-sambasamaccount.patch) are written for 2026.8.3. The bridge's own history shows the 2026.5.3→2026.8.3 bump needed a Go version change and a patch offset. I did not read upstream authentik source, so I cannot say whether they apply to 2026.8.4.
  • Outpost/server version coupling. I did not verify whether authentik requires the LDAP outpost image version to match the server version. This is only relevant if the server moves and the outpost does not.

🟡 Suggestions

  • renovate.json (authentik packageRule): the bridge images are not in the rule's matchPackageNames, which is why this PR is chart-only. Adding the gitea.renner.uno/konairius/authentik-samba-bridge-* images to that group would let Renovate open one combined PR. Renovate may not be able to rebuild the bridge image, so this helps only if a bridge rebuild is also in the pipeline.
  • The bridge version is hard-coded in four places across two repos (server.Dockerfile:18, ldap-outpost.Dockerfile ARG, build.yaml two AUTHENTIK_VERSION values, plus the homelab tags). A single source would make the lockstep bump less error-prone.

Tests

No tests exist for chart/image pinning in this repo and this PR adds none, which is expected for a version bump. What is missing is a check that the chart version and image tags agree. Before any re-review, the author should run helm template with the 2026.8.4 chart and the bridge tags and diff the output against 2026.8.3 to confirm the rendered Deployment, worker and migration behavior.

Recommendation

Request changes — 1 blocking issue(s)

🤖 **Automated review** — model `claude-haiku-5-5`, commit `e0186ca8f8973818b22f10b832e5cf4924d935dd`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary Renovate bumps the authentik Helm chart pin in `kubernetes/apps/authentik/helmrelease.yaml` from 2026.8.3 to 2026.8.4, a one-line change. The file's own comment requires the chart version to move in lockstep with the samba-bridge app image, and that image is still `2026.8.3-9dd92dd`, so the PR breaks the stated pinning rule. ## 🔴 Blocking 1. **Chart and app image diverge; the file's lockstep rule is broken.** `kubernetes/apps/authentik/helmrelease.yaml:20-23`: - Lines 20-22 say the chart is "Pinned to match the samba-bridge fork's app image (server.Dockerfile AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a floating range drifts the chart ahead of the pinned app image." - Line 23 (changed by this PR) sets `version: "2026.8.4"`. - The server and worker still run `gitea.renner.uno/konairius/authentik-samba-bridge-server:2026.8.3-9dd92dd` (`helmrelease.yaml:52`, `:61`). The head commit does not touch that tag. - The same 2026.8.3 pin is in the LDAP outpost blueprint at `kubernetes/apps/authentik/blueprints-configmap.yaml:715` (`container_image: …ldap-outpost:2026.8.3-9dd92dd`), which this PR also leaves alone. - In the bridge repo at `9dd92ddc`, `docker/server.Dockerfile` has `ARG AUTHENTIK_VERSION=2026.8.3` and `FROM ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}`. `.woodpecker/build.yaml` hard-codes `AUTHENTIK_VERSION: "2026.8.3"` for both images. There is no 2026.8.4 build and no tags at all in that repo. - History shows the team's practice: `8a26c2a` (2026.5.3) and `ca003e9`/`024eb97` (2026.8.3) moved the chart and both images together. - Cause: `renovate.json` groups `authentik` with `ghcr.io/goauthentik/**` ("chart and images together, one PR (REN-315, DB migrations)"). The bridge images are at `gitea.renner.uno/konairius/…` and are not in that group, so Renovate bumps only the chart. - Fix: hold or close this PR. Bump the chart only after the bridge is rebuilt at 2026.8.4 and `helmrelease.yaml:61` and `blueprints-configmap.yaml:715` move in the same change. Base and mergeability checks: `mergeable: true`. Base `master` is at `5ebf7a04`, which includes the bridge-repo-only commit `413f675` (already on master). Nothing on master supersedes or conflicts with this change. No review or comment exists on the PR. This is the first review, not a re-review. ## ⚪ Unverified - **Chart 2026.8.4 contents.** I could not read `charts.goauthentik.io` or the release notes (the PR body says they were skipped). I did not check whether the chart needs new values, env or migrations that assume a 2026.8.4 app. - **Bridge patches on 2026.8.4.** The bridge's `TENANT_APPS` sed (`server.Dockerfile:58`), the `python3.14` venv path (`:35-36`) and the LDAP outpost `GetUserOCs` patch (`patches/ldap-outpost-add-sambasamaccount.patch`) are written for 2026.8.3. The bridge's own history shows the 2026.5.3→2026.8.3 bump needed a Go version change and a patch offset. I did not read upstream authentik source, so I cannot say whether they apply to 2026.8.4. - **Outpost/server version coupling.** I did not verify whether authentik requires the LDAP outpost image version to match the server version. This is only relevant if the server moves and the outpost does not. ## 🟡 Suggestions - `renovate.json` (`authentik` packageRule): the bridge images are not in the rule's `matchPackageNames`, which is why this PR is chart-only. Adding the `gitea.renner.uno/konairius/authentik-samba-bridge-*` images to that group would let Renovate open one combined PR. Renovate may not be able to rebuild the bridge image, so this helps only if a bridge rebuild is also in the pipeline. - The bridge version is hard-coded in four places across two repos (`server.Dockerfile:18`, `ldap-outpost.Dockerfile` ARG, `build.yaml` two `AUTHENTIK_VERSION` values, plus the homelab tags). A single source would make the lockstep bump less error-prone. ## Tests No tests exist for chart/image pinning in this repo and this PR adds none, which is expected for a version bump. What is missing is a check that the chart version and image tags agree. Before any re-review, the author should run `helm template` with the 2026.8.4 chart and the bridge tags and diff the output against 2026.8.3 to confirm the rendered Deployment, worker and migration behavior. ## Recommendation Request changes — 1 blocking issue(s) <!-- pr-review:sha=e0186ca8f8973818b22f10b832e5cf4924d935dd -->
renovate-bot commented 2026-10-20 02:01:17 +00:00
Author
Member
Copy Link
Copy Source

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠️ **Warning**: custom changes will be lost.
hermes-bot commented 2026-10-21 07:36:12 +00:00
Member
Copy Link
Copy Source

Hold: this bumps the chart only. kubernetes/apps/authentik/helmrelease.yaml requires the chart and the samba-bridge image (global.image.tag) to move together. konairius/authentik-samba-bridge#8 rebuilds the bridge on 2026.8.4; after it merges and CI publishes 2026.8.4-, set global.image.tag on this branch to that tag. Authentik window (02:00-05:00 Europe/Berlin) + HA-impact review. (atlas, from #426)

Hold: this bumps the chart only. kubernetes/apps/authentik/helmrelease.yaml requires the chart and the samba-bridge image (global.image.tag) to move together. konairius/authentik-samba-bridge#8 rebuilds the bridge on 2026.8.4; after it merges and CI publishes 2026.8.4-<sha>, set global.image.tag on this branch to that tag. Authentik window (02:00-05:00 Europe/Berlin) + HA-impact review. (atlas, from #426)
hermes-bot commented 2026-10-21 08:30:04 +00:00
Member
Copy Link
Copy Source

Do not merge alone: the authentik chart moves in lockstep with the bridge server image (helmrelease.yaml) and the LDAP outpost container_image (blueprints-configmap.yaml:715), both pinned to 2026.8.3-9dd92dd. The 2026.8.4 images come from konairius/authentik-samba-bridge#8; once that is merged and built, one PR moves all three.

Do not merge alone: the authentik chart moves in lockstep with the bridge server image (helmrelease.yaml) and the LDAP outpost container_image (blueprints-configmap.yaml:715), both pinned to 2026.8.3-9dd92dd. The 2026.8.4 images come from konairius/authentik-samba-bridge#8; once that is merged and built, one PR moves all three.
All checks were successful
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
review-bot reviewed: request changes
Details
This pull request doesn't have enough required approvals yet. 0 of 1 approvals granted from users or teams on the allowlist.
You are not authorized to merge this pull request.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/authentik:renovate/authentik
git checkout renovate/authentik
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1347