Complete Authentik Argo adoption

apps/authentik/verify-outposts.sh

@@ -16,7 +16,9 @@ pins=$(kubectl --namespace authentik exec deployment/authentik-worker -- \
   ak shell --command \
   'from authentik.outposts.models import Outpost; [print(f"{o.name}={o.config.container_image}") for o in Outpost.objects.filter(name__in=["ldap", "radius", "rac"]).order_by("name")]')
 printf '%s\n' "$pins"
-if printf '%s\n' "$pins" | grep -Ev '^(ldap|rac|radius)=None$' >/dev/null; then
+pin_lines=$(printf '%s\n' "$pins" | grep -E '^(ldap|rac|radius)=' || true)
+if [ "$(printf '%s\n' "$pin_lines" | wc -l)" -ne 3 ] || \
+   printf '%s\n' "$pin_lines" | grep -Ev '^(ldap|rac|radius)=None$' >/dev/null; then
   echo "A managed outpost still has an explicit database image override." >&2
   exit 1
 fi

bootstrap/authentik.yaml

@@ -25,7 +25,7 @@ spec:
   syncPolicy:
     automated:
       enabled: true
-      prune: false
+      prune: true
       selfHeal: true
     syncOptions:
     - CreateNamespace=true