Authentik 2026.8.3 is rendered from the pinned official chart. values.yaml contains only public configuration; the ignored legacy authentik-values.yaml is retained locally. Runtime credentials live in authentik-runtime and the existing PostgreSQL Secret, and neither is readable by CI.

The LDAP, RADIUS, and RAC outposts are managed by Authentik and keep their image pins in its database. install.sh runs update-outpost-images.sh after the chart upgrade so their images match the server release.

authentik-blueprints declaratively creates the Argo CD OIDC application, provider, and group claim. Its client secret comes from ARGOCD_OIDC_CLIENT_SECRET in authentik-runtime; install.sh generates it once when absent and mirrors it into the labeled argocd-oidc Secret. Only the existing authentik Admins group is mapped to Argo CD administrator access.

The same blueprint creates an admin-only forward-auth application for Kubernetes Dashboard. Its proxy provider contains no committed credential and is served by the embedded proxy outpost. install.sh applies the blueprint and idempotently attaches the provider to that outpost; it deliberately does not replace the outpost's complete provider list because other repositories own those applications.

Copy authentik-secrets.env.example to the ignored authentik-secrets.env, preserve the existing values, and run ./install.sh for administrator secret updates. Run ./test.sh for a secret-free render and schema validation. The installer refuses a PostgreSQL password mismatch instead of attempting a blind rotation; rotate the database role and both Kubernetes Secrets together during a dedicated maintenance window.

The public Authentik and embedded-outpost routes have no Traefik request-rate or concurrent-request limit: browser login flows and protected applications can legitimately generate large bursts. Two server replicas, a PodDisruptionBudget, and explicit resource requests keep one busy client or node from removing the only healthy authentication endpoint.

Run ./create-ci-kubeconfig.sh and store its final line as the Gitea Actions secret KUBE_CONFIG_BASE64. CI can update only exact existing Authentik chart, Ingress, Middleware, and event-filter objects; it cannot read Secrets, create objects, delete objects, or manage the Ceph object user.

authentik-client-credentials-event-filter is a local compatibility patch introduced on 2026-08-30 and reviewed against upstream 2026.8.3. It replaces Authentik's private providers/oauth2/token/client_credentials.py module to retain application password grants while suppressing loopback (::1) login-event noise. Recheck or remove it on every Authentik upgrade because it is not an upstream chart feature or supported extension interface.