Skip to content

chore(deps): update helm release authentik to v2026.8.0 - #173

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/authentik-2026.x
Open

chore(deps): update helm release authentik to v2026.8.0#173
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/authentik-2026.x

Conversation

@renovate

@renovate renovate Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
authentik (source) minor 2026.5.6 → 2026.8.0

Release Notes

goauthentik/helm (authentik)

v2026.8.0

Compare Source

authentik is an open-source Identity Provider focused on flexibility and versatility

See https://docs.goauthentik.io/releases/2026.8

What's Changed

New Contributors

Full Changelog: goauthentik/helm@authentik-2026.5.6...authentik-2026.8.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown

Helm Template Diff — authentik — 2026.5.6 → 2026.8.0

38 changed lines 
--- /tmp/old.yaml	2026-08-28 08:04:41.699410927 +0000
+++ /tmp/new.yaml	2026-08-28 08:04:40.112379796 +0000
@@ -6,12 +6,12 @@
   name: authentik
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 data:  
   AUTHENTIK_DISABLE_STARTUP_ANALYTICS: "dHJ1ZQ=="
   AUTHENTIK_DISABLE_UPDATE_CHECK: "ZmFsc2U="
@@ -42,13 +42,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   type: ClusterIP
   ports:
@@ -73,13 +73,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -91,21 +91,21 @@
   template:
     metadata:
       labels:
-        helm.sh/chart: "authentik-2026.5.6"
+        helm.sh/chart: "authentik-2026.8.0"
         app.kubernetes.io/name: "authentik"
         app.kubernetes.io/instance: "authentik"
         app.kubernetes.io/component: "server"
         app.kubernetes.io/managed-by: "Helm"
         app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.5.6"
+        app.kubernetes.io/version: "2026.8.0"
         custom.network/postgresdb: egress
       annotations:
-        checksum/secret: 5a4f27f1d4d8c7b39bb4bc912d8f7a7b960099a87007062875f98acede6ac9e5
+        checksum/secret: 04aecd4e99880e50a20c9f1ae827389e52803fa6759863bb335bd6500e677523
     spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: server
-          image: ghcr.io/goauthentik/server:2026.5.6
+          image: ghcr.io/goauthentik/server:2026.8.0
           imagePullPolicy: IfNotPresent
           args:
             - server
@@ -189,13 +189,13 @@
   name: authentik-worker
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "worker"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -207,21 +207,21 @@
   template:
     metadata:
       labels:
-        helm.sh/chart: "authentik-2026.5.6"
+        helm.sh/chart: "authentik-2026.8.0"
         app.kubernetes.io/name: "authentik"
         app.kubernetes.io/instance: "authentik"
         app.kubernetes.io/component: "worker"
         app.kubernetes.io/managed-by: "Helm"
         app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.5.6"
+        app.kubernetes.io/version: "2026.8.0"
         custom.network/postgresdb: egress
       annotations:
-        checksum/secret: 5a4f27f1d4d8c7b39bb4bc912d8f7a7b960099a87007062875f98acede6ac9e5
+        checksum/secret: 04aecd4e99880e50a20c9f1ae827389e52803fa6759863bb335bd6500e677523
     spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: worker
-          image: ghcr.io/goauthentik/server:2026.5.6
+          image: ghcr.io/goauthentik/server:2026.8.0
           imagePullPolicy: IfNotPresent
           args:
             - worker
@@ -305,13 +305,13 @@
   name: authentik-server
   namespace: "authentik"
   labels:
-    helm.sh/chart: "authentik-2026.5.6"
+    helm.sh/chart: "authentik-2026.8.0"
     app.kubernetes.io/name: "authentik"
     app.kubernetes.io/instance: "authentik"
     app.kubernetes.io/component: "server"
     app.kubernetes.io/managed-by: "Helm"
     app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.5.6"
+    app.kubernetes.io/version: "2026.8.0"
   annotations:
     cert-manager.io/cluster-issuer: step-ca-internal
     traefik.ingress.kubernetes.io/router.middlewares: traefik-common-internal-access-allowlist@kubernetescrd

@lunarys Claude

lunarys commented Aug 28, 2026

Copy link
Copy Markdown
Owner

Renovate Review: authentik 2026.5.6 → 2026.8.0 (minor, authentik app)

Risk: 🟢 LOW

Check Result
Inputs Complete — ### Release Notes section present and a matching rendered-diff comment (03-apps-apps-authentik).
Description vs. diff Consistent — 03_apps/apps/authentik/app.yaml helm.version changed 2026.5.6 → 2026.8.0, exactly matching the table; single file, no scope creep.
Rendered diff Full, no truncation — 38 changed lines across ConfigMap, Server Service, Server Deployment, and Worker Deployment: helm.sh/chart/app.kubernetes.io/version label bumps, the ghcr.io/goauthentik/server image tag, and a checksum/secret annotation change on both Deployments (see Details). No resources added/removed.
Changelog vs. config No overlap — repeated postgresql chart tag bumps (v18.8.1 → v18.8.11) target the chart's bundled Postgres/Redis subcharts, which this deployment doesn't use: 03_apps/apps/authentik/values.yaml provisions Postgres externally via a PostgresDatabase CRD (additionalObjects) and file-mounted creds (authentik.postgresql.host/user/password: file:///mnt/pgcreds/...), and confirmed by the rendered diff itself showing zero Postgres/Redis resources. The two genuine chart-template changes (render automountServiceAccountToken when set to false, avoid mounting envFrom secret if secret configuration disabled) don't intersect live config either — serviceAccount.create: false is set but no automountServiceAccountToken key is overridden, and this deployment's secret config is enabled (AUTHENTIK_SECRET_KEY via global.env secretKeyRef), so neither behavior change applies here.

Details:

  • checksum/secret annotation moved 5a4f27f1... → 04aecd4e... on both authentik-server and authentik-worker Deployments — this is the standard Helm "restart pods when the templated Secret content changes" pattern. Since no secret values changed in this repo's own diff (only the chart version), this is consistent with the chart's own envFrom secret template logic changing between 2026.5.6 and 2026.8.0 (per the avoid mounting envFrom secret if secret configuration disabled changelog item) rather than a live secret rotation — expect a one-time rolling restart of both Deployments on merge, not a config-value change.
  • No Role/ClusterRole/CRD resources appear in the diff — nothing to flag under §4.5/§6.6.

Why LOW: cosmetic/annotation-only rendered diff, no breaking changelog items, and the changelog's only non-trivial items (bundled Postgres bumps) target a subchart this deployment doesn't use.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lunarys