chore(authentik): pre-stage prune:disabled on the ak-pg CNPG objects (stage 1) #407

2026-07-25T09:13:01Z

claude-bot commented

2026-07-25 09:13:01 +00:00

Stage 1 of folding seed-authentik into the existing dedicated authentik KS — the last app in the seed-layer retirement and the highest blast radius (ak-pg backs the SSO identity provider).

Adds kustomize.toolkit.fluxcd.io/prune: disabled in place to the 5 CNPG objects under seed/authentik/:

Cluster/ak-pg (HA, 2 instances — pruning deletes the identity DB's data PVCs)
ObjectStore/ak-pg-store, ScheduledBackup/ak-pg-daily
ExternalSecret/barman-cloud-creds, ExternalSecret/hetzner-s3-creds

authentik has no data PVCs in seed/ (all state is in ak-pg). Metadata-only → no CNPG restart.

Verified: kubectl kustomize seed/authentik → 5 objects, all 5 prune-protected; ak-pg healthy (2/2, RESTARTS=0); 30 completed barman backups (last ~6.7h).

A restore-test is running now against ak-pg (corrected #404 recipe: spec.plugins + isWALArchiver: false) to prove the identity DB is restorable before the Stage 2 fold.

**Stage 1** of folding `seed-authentik` into the existing dedicated `authentik` KS — the **last** app in the seed-layer retirement and the highest blast radius (`ak-pg` backs the SSO identity provider). Adds `kustomize.toolkit.fluxcd.io/prune: disabled` in place to the 5 CNPG objects under `seed/authentik/`: - `Cluster/ak-pg` (HA, 2 instances — pruning deletes the identity DB's data PVCs) - `ObjectStore/ak-pg-store`, `ScheduledBackup/ak-pg-daily` - `ExternalSecret/barman-cloud-creds`, `ExternalSecret/hetzner-s3-creds` authentik has **no data PVCs** in `seed/` (all state is in `ak-pg`). **Metadata-only → no CNPG restart.** **Verified:** `kubectl kustomize seed/authentik` → 5 objects, all 5 prune-protected; `ak-pg` healthy (2/2, `RESTARTS=0`); 30 completed barman backups (last ~6.7h). A **restore-test is running now** against `ak-pg` (corrected #404 recipe: `spec.plugins` + `isWALArchiver: false`) to prove the identity DB is restorable before the Stage 2 fold.

claude-bot added 1 commit 2026-07-25 09:13:01 +00:00

chore(authentik): pre-stage prune:disabled on the ak-pg CNPG objects (stage 1)

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

833a2ca274

Stage 1 of folding seed-authentik into the existing dedicated authentik KS — the
last app in the seed-layer retirement, and the highest blast radius (ak-pg backs
the SSO identity provider). Adds prune: disabled, in place, to the 5 CNPG DB
objects under seed/authentik/ so the ownership handoff can never prune them:

- Cluster/ak-pg (HA, 2 instances — pruning deletes the identity DB's data PVCs)
- ObjectStore/ak-pg-store, ScheduledBackup/ak-pg-daily
- ExternalSecret/barman-cloud-creds, ExternalSecret/hetzner-s3-creds

authentik has no data PVCs in seed/ (all state is in ak-pg). Metadata-only; no
CNPG restart. ak-pg has 30 completed barman backups (last ~6.7h) as a backstop,
and a restore-test is running against it now (corrected #404 recipe) before the
stage 2 fold.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-07-25 09:15:11 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 833a2ca2741d9f5c2bb35b9d8b814c38ed6811cf.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This is stage 1 of folding seed-authentik into the dedicated authentik Kustomization: it adds kustomize.toolkit.fluxcd.io/prune: disabled annotations to the 5 CNPG-related objects under kubernetes/seed/authentik/ (Cluster/ak-pg, ObjectStore/ak-pg-store, ScheduledBackup/ak-pg-daily, and the two ExternalSecret barman/hetzner-creds objects). It is a metadata-only change (no spec touched), and it is byte-for-byte the same pattern already applied and proven for the paperless and immich migrations (kubernetes/apps/paperless/cluster.yaml, kubernetes/apps/immich/cluster.yaml, etc.). No blocking issues found.

🟡 Suggestions

None of substance — the change is a faithful repeat of a pattern that's already shipped twice in this repo.

🟢 Nits

kubernetes/seed/authentik/barman-creds-externalsecret.yaml:10 / hetzner-creds-externalsecret.yaml:41 / objectstore.yaml:55 / scheduled-backup.yaml:69: these four comments are single-line ("Prune-disabled ahead of the seed->authentik-KS handoff (...)") while cluster.yaml:24-27's comment is the fuller "CRITICAL data-guard ... Kept permanently as a standing guard" version. That mirrors the asymmetry already present in the paperless/immich precedents (only cluster.yaml gets the long-form comment there too), so this is consistent with established style, not a defect — just noting it in case a future pass wants to unify comment verbosity across all 5 files.

Tests

No automated tests apply to this kind of change — the PR body documents manual verification (kubectl kustomize seed/authentik producing 5 prune-protected objects, ak-pg healthy 2/2, and an in-flight restore test). I independently confirmed:

All 5 resources listed in kubernetes/seed/authentik/kustomization.yaml (barman-creds-externalsecret, hetzner-creds-externalsecret, objectstore, cluster, scheduled-backup) received the annotation — none were missed.
The annotation and placement exactly match the pattern already live in kubernetes/apps/paperless/*.yaml and kubernetes/apps/immich/*.yaml, which back the kustomize.toolkit.fluxcd.io pruning mechanism used by the seed-authentik Kustomization (prune: true in kubernetes/clusters/homelab/seed-authentik.yaml) — so the annotation will in fact do what the PR claims (protect these objects from deletion when they're later removed from the seed path during the stage-2 fold).
No data-plane (spec) fields were modified in any of the 5 files, consistent with the "metadata-only → no CNPG restart" claim.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `833a2ca2741d9f5c2bb35b9d8b814c38ed6811cf`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This is stage 1 of folding `seed-authentik` into the dedicated `authentik` Kustomization: it adds `kustomize.toolkit.fluxcd.io/prune: disabled` annotations to the 5 CNPG-related objects under `kubernetes/seed/authentik/` (`Cluster/ak-pg`, `ObjectStore/ak-pg-store`, `ScheduledBackup/ak-pg-daily`, and the two `ExternalSecret` barman/hetzner-creds objects). It is a metadata-only change (no `spec` touched), and it is byte-for-byte the same pattern already applied and proven for the `paperless` and `immich` migrations (`kubernetes/apps/paperless/cluster.yaml`, `kubernetes/apps/immich/cluster.yaml`, etc.). No blocking issues found. ## 🟡 Suggestions - None of substance — the change is a faithful repeat of a pattern that's already shipped twice in this repo. ## 🟢 Nits - `kubernetes/seed/authentik/barman-creds-externalsecret.yaml:10` / `hetzner-creds-externalsecret.yaml:41` / `objectstore.yaml:55` / `scheduled-backup.yaml:69`: these four comments are single-line ("Prune-disabled ahead of the seed->authentik-KS handoff (...)") while `cluster.yaml:24-27`'s comment is the fuller "CRITICAL data-guard ... Kept permanently as a standing guard" version. That mirrors the asymmetry already present in the paperless/immich precedents (only `cluster.yaml` gets the long-form comment there too), so this is consistent with established style, not a defect — just noting it in case a future pass wants to unify comment verbosity across all 5 files. ## Tests No automated tests apply to this kind of change — the PR body documents manual verification (`kubectl kustomize seed/authentik` producing 5 prune-protected objects, `ak-pg` healthy 2/2, and an in-flight restore test). I independently confirmed: - All 5 resources listed in `kubernetes/seed/authentik/kustomization.yaml` (barman-creds-externalsecret, hetzner-creds-externalsecret, objectstore, cluster, scheduled-backup) received the annotation — none were missed. - The annotation and placement exactly match the pattern already live in `kubernetes/apps/paperless/*.yaml` and `kubernetes/apps/immich/*.yaml`, which back the `kustomize.toolkit.fluxcd.io` pruning mechanism used by the `seed-authentik` Kustomization (`prune: true` in `kubernetes/clusters/homelab/seed-authentik.yaml`) — so the annotation will in fact do what the PR claims (protect these objects from deletion when they're later removed from the seed path during the stage-2 fold). - No data-plane (`spec`) fields were modified in any of the 5 files, consistent with the "metadata-only → no CNPG restart" claim. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 8d6857d394 into master

2026-07-26 05:52:53 +00:00

k.renner referenced this issue from a commit

2026-07-26 05:52:55 +00:00

Merge pull request 'chore(authentik): pre-stage prune:disabled on the ak-pg CNPG objects (stage 1)' (#407) from authentik-prune-protect into master

claude-bot referenced this issue from a commit

2026-07-26 06:00:37 +00:00

refactor(authentik): fold seed-authentik into the authentik KS — retire the seed layer (stage 2)

claude-bot referenced this pull request

2026-07-26 06:00:53 +00:00

refactor(authentik): fold seed-authentik into the authentik KS — retire the seed layer (stage 2) #411

Sign in to join this conversation.