# Authentik deployment moved to GitOps

This repository is retained as historical deployment documentation and no
longer writes to Kubernetes. The homelab's Authentik release is reconciled by
Argo CD from the public
[`homelab-gitops/apps/authentik`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/authentik)
directory using Authentik's maintained upstream Helm chart.

The GitOps application pins the chart version, holds public homelab values and
cluster integrations, documents the existing Secret recovery boundary, and
includes the managed-outpost verification procedure. Credentials remain only
in the cluster-managed `authentik-runtime`, `authentik-postgresql`, and
`argocd-oidc` Secrets; they are not stored in either repository.

The LDAP, RADIUS, and RAC Deployments are generated by Authentik's outpost
controller. Their database `container_image` overrides are null, so they follow
the server version supplied by the upstream chart. Argo monitors their
availability without trying to own those generated Deployments.

Use the Git history here only when investigating the retired direct Helm/Gitea
Actions deployment. Do not restore that workflow alongside Argo CD, because it
would create a second writer for the same Kubernetes resources.