chore(deps): update helm release authentik to v2026.8.0

[renovate]

This PR contains the following updates:

Package	Update	Change
authentik (source)	minor	2026.5.6 → 2026.8.0

---

Release Notes

goauthentik/helm (authentik)

v2026.8.0

Compare Source

authentik is an open-source Identity Provider focused on flexibility and versatility

See https://docs.goauthentik.io/releases/2026.8

What's Changed

• charts/authentik: render automountServiceAccountToken when set to false by @​PendaGTP in #​499
• charts/authentik: update postgresql chart tag to v18.8.1 by @​renovate[bot] in #​487
• charts/authentik: avoid mounting envFrom secret if secret configuration disabled by @​baprx in #​497
• charts/authentik: update postgresql chart tag to v18.8.2 by @​renovate[bot] in #​500
• charts/authentik: update postgresql chart tag to v18.8.4 by @​renovate[bot] in #​501
• charts/authentik: update postgresql chart tag to v18.8.5 by @​renovate[bot] in #​502
• charts/authentik: update postgresql chart tag to v18.8.6 by @​renovate[bot] in #​504
• charts/authentik: update postgresql chart tag to v18.8.7 by @​renovate[bot] in #​505
• charts/authentik: update postgresql chart tag to v18.8.8 by @​renovate[bot] in #​506
• charts/authentik: update docker.io/library/postgres Docker tag to v17.11 by @​renovate[bot] in #​507
• charts/authentik: update postgresql chart tag to v18.8.11 by @​renovate[bot] in #​508
• charts/authentik: bump to 2026.8.0 by @​authentik-automation[bot] in #​510

New Contributors

• @​PendaGTP made their first contribution in #​499

Full Changelog: goauthentik/helm@authentik-2026.5.6...authentik-2026.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Helm Template Diff — authentik — 2026.5.6 → 2026.8.0

38 changed lines

--- /tmp/old.yaml	2026-08-28 08:04:41.699410927 +0000
+++ /tmp/new.yaml	2026-08-28 08:04:40.112379796 +0000
@@ -6,12 +6,12 @@
   name: authentik
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 data:  
   AUTHENTIK_DISABLE_STARTUP_ANALYTICS: "dHJ1ZQ=="
   AUTHENTIK_DISABLE_UPDATE_CHECK: "ZmFsc2U="
@@ -42,13 +42,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   type: ClusterIP
   ports:
@@ -73,13 +73,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -91,21 +91,21 @@
   template:
     metadata:
       labels:
-        helm.sh/chart: "authentik-2026.5.6"
+        helm.sh/chart: "authentik-2026.8.0"
         app.kubernetes.io/name: "authentik"
         app.kubernetes.io/instance: "authentik"
         app.kubernetes.io/component: "server"
         app.kubernetes.io/managed-by: "Helm"
         app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.5.6"
+        app.kubernetes.io/version: "2026.8.0"
         custom.network/postgresdb: egress
       annotations:
-        checksum/secret: 5a4f27f1d4d8c7b39bb4bc912d8f7a7b960099a87007062875f98acede6ac9e5
+        checksum/secret: 04aecd4e99880e50a20c9f1ae827389e52803fa6759863bb335bd6500e677523
     spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: server
-          image: ghcr.io/goauthentik/server:2026.5.6
+          image: ghcr.io/goauthentik/server:2026.8.0
           imagePullPolicy: IfNotPresent
           args:
             - server
@@ -189,13 +189,13 @@
   name: authentik-worker
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "worker"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -207,21 +207,21 @@
   template:
     metadata:
       labels:
-        helm.sh/chart: "authentik-2026.5.6"
+        helm.sh/chart: "authentik-2026.8.0"
         app.kubernetes.io/name: "authentik"
         app.kubernetes.io/instance: "authentik"
         app.kubernetes.io/component: "worker"
         app.kubernetes.io/managed-by: "Helm"
         app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.5.6"
+        app.kubernetes.io/version: "2026.8.0"
         custom.network/postgresdb: egress
       annotations:
-        checksum/secret: 5a4f27f1d4d8c7b39bb4bc912d8f7a7b960099a87007062875f98acede6ac9e5
+        checksum/secret: 04aecd4e99880e50a20c9f1ae827389e52803fa6759863bb335bd6500e677523
     spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: worker
-          image: ghcr.io/goauthentik/server:2026.5.6
+          image: ghcr.io/goauthentik/server:2026.8.0
           imagePullPolicy: IfNotPresent
           args:
             - worker
@@ -305,13 +305,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
   annotations:
     cert-manager.io/cluster-issuer: step-ca-internal
     traefik.ingress.kubernetes.io/router.middlewares: traefik-common-internal-access-allowlist@kubernetescrd

[lunarys]

Renovate Review: authentik 2026.5.6 → 2026.8.0 (minor, authentik app)

Risk: 🟢 LOW

Check	Result
Inputs	Complete — ### Release Notes section present and a matching rendered-diff comment (03-apps-apps-authentik).
Description vs. diff	Consistent — 03_apps/apps/authentik/app.yaml helm.version changed 2026.5.6 → 2026.8.0, exactly matching the table; single file, no scope creep.
Rendered diff	Full, no truncation — 38 changed lines across ConfigMap, Server Service, Server Deployment, and Worker Deployment: helm.sh/chart/app.kubernetes.io/version label bumps, the ghcr.io/goauthentik/server image tag, and a checksum/secret annotation change on both Deployments (see Details). No resources added/removed.
Changelog vs. config	No overlap — repeated postgresql chart tag bumps (v18.8.1 → v18.8.11) target the chart's bundled Postgres/Redis subcharts, which this deployment doesn't use: 03_apps/apps/authentik/values.yaml provisions Postgres externally via a PostgresDatabase CRD (additionalObjects) and file-mounted creds (authentik.postgresql.host/user/password: file:///mnt/pgcreds/...), and confirmed by the rendered diff itself showing zero Postgres/Redis resources. The two genuine chart-template changes (render automountServiceAccountToken when set to false, avoid mounting envFrom secret if secret configuration disabled) don't intersect live config either — serviceAccount.create: false is set but no automountServiceAccountToken key is overridden, and this deployment's secret config is enabled (AUTHENTIK_SECRET_KEY via global.env secretKeyRef), so neither behavior change applies here.

Details:

• checksum/secret annotation moved 5a4f27f1... → 04aecd4e... on both authentik-server and authentik-worker Deployments — this is the standard Helm "restart pods when the templated Secret content changes" pattern. Since no secret values changed in this repo's own diff (only the chart version), this is consistent with the chart's own envFrom secret template logic changing between 2026.5.6 and 2026.8.0 (per the avoid mounting envFrom secret if secret configuration disabled changelog item) rather than a live secret rotation — expect a one-time rolling restart of both Deployments on merge, not a config-value change.
• No Role/ClusterRole/CRD resources appear in the diff — nothing to flag under §4.5/§6.6.

Why LOW: cosmetic/annotation-only rendered diff, no breaking changelog items, and the changelog's only non-trivial items (bundled Postgres bumps) target a subchart this deployment doesn't use.

---

Generated by Claude Code