fix(authentik): roll chart forward to 2026.5.5 to match migrated prod DB (#555) - #556
Merged
Merged
Conversation
Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba
Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba
…d prod DB (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba
Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
…match the e2e image (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #555
Problem
The
fuzefrontArgo app is Degraded: the Helm chart pinned the authentik image to2024.12.3, but the prod DB was migrated out-of-band to2026.5.5. Authentik migrations are forward-only, so2024.12.3crashloops against the migrated DB, and Argo selfHeal keeps reverting the live2026.5.5pod back to2024.12.3.Fix (load-bearing, prod)
Roll the chart forward to
2026.5.5so it matches the migrated DB.deploy/helm/fuzefront/values.yaml—authentik.image.tag:2024.12.3->2026.5.5.values-prod.yamldoes not override the authentik image tag (verified), so prod inherits this value. This is the only change needed to un-wedge the rollout.Non-prod alignment was attempted and reverted (with CI proof)
The issue also asked to bump
docker-compose.yml,docker-compose.e2e.yml, anddeploy/e2e/provision-authentik-oidc.shfor consistency. I made those changes, but CI proved the E2E harness cannot run 2026.5.5 without a code change, so I reverted them to keep this PR green and correctly scoped:OIDC Plumbing E2EandE2E (sign-in)failed on2026.5.5(they pass on master @2024.12.3).Unsupported Authentik flow stage: authorize returned HTTP 200 without redirect (consent flow?) (only identification+password is supported server-side)->Authentik rejected credentials->POST /api/v1/security/session -> 503.2026.5.5's server-side flow executor returns the final redirect as an HTTP 200 challenge (type: redirect) instead of an HTTP 302. The security service's headless flow driver only understands identification+password and rejects the 200. This is a security-service code change, out of scope for a chart image-tag bump.Prod's live
2026.5.5pod already works via interactive browser OIDC; only the headless E2E path is affected, so prod is unblocked by thevalues.yamlchange alone.Follow-up tracked separately: migrate the local + E2E authentik harness to
2026.5.5(requires teaching the security-service headless flow driver to handle authentik'sredirectchallenge).Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba