feat(authentik): Flux image automation tracks the LDAP outpost image #1512

2026-10-28T07:37:26Z

claude-bot commented

2026-10-28 07:37:26 +00:00

The k8s-outposts blueprint pinned the patched LDAP outpost image by hand. Flux setters can't patch text inside the blueprint ConfigMap string, and Gitea's cleanup rule deletes a pinned tag once a newer build ages it out.

clusters/homelab/authentik.yaml: postBuild.substitute.SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE carries the image, with the flux-system:authentik-samba-bridge-ldap-outpost ImagePolicy marker.
blueprints-configmap.yaml: container_image: ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE}. kustomize-controller renders the literal before Authentik reads the file.
helmrelease.yaml: the SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE env var from the earlier !Env attempt is removed. This restarts the authentik server and worker pods once.

flux build kustomization authentik differs from the unsubstituted render only in the container_image line. kubernetes/apps/authentik has no other ${...} literals, so the substitution touches nothing else (scope rule: wiki flux-postbuild-substitute-scope-narrow). The image setter already rewrites non-image string fields in this repo, e.g. the HelmRelease env value in fa9c7ec9.

🤖 Generated with Claude Code

The k8s-outposts blueprint pinned the patched LDAP outpost image by hand. Flux setters can't patch text inside the blueprint ConfigMap string, and Gitea's cleanup rule deletes a pinned tag once a newer build ages it out. - `clusters/homelab/authentik.yaml`: `postBuild.substitute.SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE` carries the image, with the `flux-system:authentik-samba-bridge-ldap-outpost` ImagePolicy marker. - `blueprints-configmap.yaml`: `container_image: ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE}`. kustomize-controller renders the literal before Authentik reads the file. - `helmrelease.yaml`: the `SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE` env var from the earlier `!Env` attempt is removed. This restarts the authentik server and worker pods once. `flux build kustomization authentik` differs from the unsubstituted render only in the `container_image` line. `kubernetes/apps/authentik` has no other `${...}` literals, so the substitution touches nothing else (scope rule: wiki `flux-postbuild-substitute-scope-narrow`). The image setter already rewrites non-image string fields in this repo, e.g. the HelmRelease env value in `fa9c7ec9`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-28 07:37:27 +00:00

feat(authentik): Flux image automation tracks the LDAP outpost image

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

478f39d727

The k8s-outposts blueprint pinned the patched LDAP outpost image by hand.
Flux setters cannot patch text inside the blueprint ConfigMap string, and
Gitea's cleanup rule deletes a pinned tag once a newer build ages it out.

The image now lives in the authentik Flux Kustomization's
postBuild.substitute, with the authentik-samba-bridge-ldap-outpost
ImagePolicy marker, and the blueprint reads ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE}.
kustomize-controller renders the literal before Authentik reads the file.
`flux build kustomization authentik` differs from the unsubstituted render
only in that line; kubernetes/apps/authentik has no other ${...} literals.

The SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE env var in global.env, used by the
earlier !Env attempt, is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 4f8443f3e8 into main

2026-10-28 07:38:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1512