Authentik on Kubernetes

Authentik 2026.8.0 is rendered from the pinned official chart. values.yaml contains only public configuration; the ignored legacy authentik-values.yaml is retained locally. Runtime credentials live in authentik-runtime and the existing PostgreSQL Secret, and neither is readable by CI.

authentik-blueprints declaratively creates the Argo CD OIDC application, provider, and group claim. Its client secret comes from ARGOCD_OIDC_CLIENT_SECRET in authentik-runtime; install.sh generates it once when absent and mirrors it into the labeled argocd-oidc Secret. Only the existing authentik Admins group is mapped to Argo CD administrator access.

Copy authentik-secrets.env.example to the ignored authentik-secrets.env, preserve the existing values, and run ./install.sh for administrator secret updates. Run ./test.sh for a secret-free render and schema validation. The installer refuses a PostgreSQL password mismatch instead of attempting a blind rotation; rotate the database role and both Kubernetes Secrets together during a dedicated maintenance window.

Run ./create-ci-kubeconfig.sh and store its final line as the Gitea Actions secret KUBE_CONFIG_BASE64. CI can update only exact existing Authentik chart, Ingress, Middleware, and event-filter objects; it cannot read Secrets, create objects, delete objects, or manage the Ceph object user.

authentik-client-credentials-event-filter is a local compatibility patch introduced on 2026-08-30. It replaces Authentik's private providers/oauth2/token/client_credentials.py module to retain application password grants while suppressing loopback (::1) login-event noise. Recheck or remove it on every Authentik upgrade because it is not an upstream chart feature or supported extension interface.