fix: deploy Authentik server startup protection #67

Merged

morten-olsen merged 1 commit from fix/3f88f077-authentik-rollout into main

2026-10-24 21:19:44 +02:00

morten-olsen commented

2026-10-24 19:57:07 +02:00

Owner

Summary

Pin authentik-operator 0.1.2 to deploy the generated server startup probe. Publish homelab-core chart 0.1.7. This is rollout phase 2, stacked on core #66.

Do not merge until phase 1's postgres 0.0.19 operator is verified live, authentik-operator #1 has published approved 0.1.2 artifacts, and Morten approves this core publication. After #66 merges, retarget this PR to main. The Authentik application image stays 2026.8.3; only its operator is upgraded.

Evidence

Canonical scripts/ci/validate-charts.sh passes: Helm lint and core/shared/monitor render and rule tests.
Rendered Authentik ArgoCD Application passes kubectl apply --dry-run=server at targetRevision 0.1.2.
Operator CI is green at a8c93fc: unit, lint and all four Kind E2E specs, including the generated startup probe.
Woodpecker PR pipeline 132 passes; the corresponding push pipeline also passes. No live state was changed.

Merge danger

Door: one-way publication. Main packages and republishes the Helm repository, including new homelab-core 0.1.7. Release approval is required; ArgoCD also reconciles this Git change immediately.

Blast radius: household. The new operator reconciles the Authentik server startup probe and rolls its pod; login to NetBird and Coder depends on Authentik.

Rollback and verification

Roll back: restore the Authentik operator pin to 0.1.0 through GitOps with a fresh core chart version. Preserve postgres 0.0.19 and all database data/PVCs. Published artifacts remain.
Verify: CI, mirror/main revision, ArgoCD authentik at 0.1.2, actual operator digest/readiness, server startupProbe and replicas, DB lock queues, live/ready HTTP 200 and actual NetBird OIDC discovery, NetBird management and Coder availability.
Reviewers: self-review; no RBAC, exposure, secret or image-source expansion.

## Summary Pin authentik-operator 0.1.2 to deploy the generated server startup probe. Publish homelab-core chart 0.1.7. This is rollout phase 2, stacked on [core #66](https://code.olsen.cloud/homelab/core/pulls/66). Do not merge until phase 1's postgres 0.0.19 operator is verified live, [authentik-operator #1](https://code.olsen.cloud/homelab/authentik-operator/pulls/1) has published approved 0.1.2 artifacts, and Morten approves this core publication. After #66 merges, retarget this PR to main. The Authentik application image stays 2026.8.3; only its operator is upgraded. ## Evidence - Canonical scripts/ci/validate-charts.sh passes: Helm lint and core/shared/monitor render and rule tests. - Rendered Authentik ArgoCD Application passes kubectl apply --dry-run=server at targetRevision 0.1.2. - Operator CI is green at a8c93fc: unit, lint and all four Kind E2E specs, including the generated startup probe. - Woodpecker PR pipeline [132](https://woodpecker.olsen.cloud/repos/6/pipeline/132) passes; the corresponding push pipeline also passes. No live state was changed. ## Merge danger **Door:** one-way publication. Main packages and republishes the Helm repository, including new homelab-core 0.1.7. Release approval is required; ArgoCD also reconciles this Git change immediately. **Blast radius:** household. The new operator reconciles the Authentik server startup probe and rolls its pod; login to NetBird and Coder depends on Authentik. ## Rollback and verification - **Roll back:** restore the Authentik operator pin to 0.1.0 through GitOps with a fresh core chart version. Preserve postgres 0.0.19 and all database data/PVCs. Published artifacts remain. - **Verify:** CI, mirror/main revision, ArgoCD authentik at 0.1.2, actual operator digest/readiness, server startupProbe and replicas, DB lock queues, live/ready HTTP 200 and actual NetBird OIDC discovery, NetBird management and Coder availability. - **Reviewers:** self-review; no RBAC, exposure, secret or image-source expansion.

morten-olsen added 1 commit

2026-10-24 19:57:07 +02:00