From 478f39d72785178accb95c11e935b7cd560a950f Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 28 Oct 2026 08:37:17 +0100 Subject: [PATCH] feat(authentik): Flux image automation tracks the LDAP outpost image The k8s-outposts blueprint pinned the patched LDAP outpost image by hand. Flux setters cannot patch text inside the blueprint ConfigMap string, and Gitea's cleanup rule deletes a pinned tag once a newer build ages it out. The image now lives in the authentik Flux Kustomization's postBuild.substitute, with the authentik-samba-bridge-ldap-outpost ImagePolicy marker, and the blueprint reads ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE}. kustomize-controller renders the literal before Authentik reads the file. `flux build kustomization authentik` differs from the unsubstituted render only in that line; kubernetes/apps/authentik has no other ${...} literals. The SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE env var in global.env, used by the earlier !Env attempt, is removed. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/authentik/blueprints-configmap.yaml | 5 +++-- kubernetes/apps/authentik/helmrelease.yaml | 4 ---- kubernetes/clusters/homelab/authentik.yaml | 5 +++++ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 5d60a4d2..9fdef09b 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -705,8 +705,9 @@ data: # AND (&(sambaDomainName=...)(objectClass=sambaDomain)) # return entries instead of short-circuiting. Built from # the samba-bridge repo at - # gitea.renner.uno/konairius/authentik-samba-bridge . - container_image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655 + # gitea.renner.uno/konairius/authentik-samba-bridge ; Flux + # substitutes the image from clusters/homelab/authentik.yaml. + container_image: ${SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE} object_naming_template: "ak-outpost-%(name)s" kubernetes_namespace: authentik kubernetes_replicas: 1 diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml index 98069163..dcb80362 100644 --- a/kubernetes/apps/authentik/helmrelease.yaml +++ b/kubernetes/apps/authentik/helmrelease.yaml @@ -92,10 +92,6 @@ spec: secretKeyRef: name: ldap-outpost-tls key: tls.key - # Patched LDAP outpost image, set via `!Env` in the k8s-outposts - # blueprint (blueprints-configmap.yaml). - - name: SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE - value: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"} # Key of the authentik-gate-sync API token, set via `!Env` in the # gate-sync blueprint (gate-sync.yaml). - name: AUTHENTIK_GATE_SYNC_TOKEN diff --git a/kubernetes/clusters/homelab/authentik.yaml b/kubernetes/clusters/homelab/authentik.yaml index b197270a..8c6a3fe8 100644 --- a/kubernetes/clusters/homelab/authentik.yaml +++ b/kubernetes/clusters/homelab/authentik.yaml @@ -16,6 +16,11 @@ spec: path: ./kubernetes/apps/authentik prune: true wait: true + # Substitutes every ${VAR} under kubernetes/apps/authentik; that path has + # no other ${...} literals. Flux image automation keeps the tag current. + postBuild: + substitute: + SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026-10-28-0655 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"} # decryption block dropped 2026-07-14: path is sops-free — secrets come # from OpenBao via ESO (MIGRATION-sops-openbao.md). This was the LAST # sops consumer; phase 4 (age-key retirement) may proceed after soak. -- 2.54.0