Update Authentik deployment to 2026.8.4

install.sh

@@ -2,7 +2,7 @@
 
 set -eu
 
-chart_version=2026.8.3
+chart_version=2026.8.4
 project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 secret_file=${AUTHENTIK_SECRET_FILE:-$project_dir/authentik-secrets.env}
 

update-outpost-images.sh

@@ -10,9 +10,9 @@ fi
 # Authentik stores managed outpost image pins in its database. Keep them on
 # the same release as the server; changing the Helm chart alone does not do so.
 for entry in \
-  'ldap ghcr.io/goauthentik/ldap:2026.8.3' \
-  'radius ghcr.io/goauthentik/radius:2026.8.3' \
-  'rac ghcr.io/goauthentik/rac:2026.8.3'
+  'ldap ghcr.io/goauthentik/ldap:2026.8.4' \
+  'radius ghcr.io/goauthentik/radius:2026.8.4' \
+  'rac ghcr.io/goauthentik/rac:2026.8.4'
 do
   name=${entry%% *}
   image=${entry#* }
@@ -30,7 +30,7 @@ do
   # The outpost controller may recreate the Deployment during reconciliation,
   # which makes `kubectl rollout status` fail with "object has been deleted".
   attempt=0
-  while [ "$(kubectl --namespace authentik get "deployment/ak-outpost-$name" --output='jsonpath={.status.availableReplicas}' 2>/dev/null)" != '1' ]; do
+  while [ "$(kubectl --namespace authentik get "deployment/ak-outpost-$name" --output='jsonpath={.status.updatedReplicas}/{.status.readyReplicas}/{.status.availableReplicas}' 2>/dev/null)" != '1/1/1' ]; do
     attempt=$((attempt + 1))
     if [ "$attempt" -ge 180 ]; then
       echo "Timed out waiting for the $name outpost to become available." >&2