From 72b3d6cc6cd0ed088f65354869edfad67a7194ac Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Sun, 18 Oct 2026 23:25:46 +0200
Subject: [PATCH] Complete Authentik Argo adoption

---
 apps/authentik/verify-outposts.sh | 4 +++-
 bootstrap/authentik.yaml          | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/authentik/verify-outposts.sh b/apps/authentik/verify-outposts.sh
index a99bfee..4a461cc 100755
--- a/apps/authentik/verify-outposts.sh
+++ b/apps/authentik/verify-outposts.sh
@@ -16,7 +16,9 @@ pins=$(kubectl --namespace authentik exec deployment/authentik-worker -- \
   ak shell --command \
   'from authentik.outposts.models import Outpost; [print(f"{o.name}={o.config.container_image}") for o in Outpost.objects.filter(name__in=["ldap", "radius", "rac"]).order_by("name")]')
 printf '%s\n' "$pins"
-if printf '%s\n' "$pins" | grep -Ev '^(ldap|rac|radius)=None$' >/dev/null; then
+pin_lines=$(printf '%s\n' "$pins" | grep -E '^(ldap|rac|radius)=' || true)
+if [ "$(printf '%s\n' "$pin_lines" | wc -l)" -ne 3 ] || \
+   printf '%s\n' "$pin_lines" | grep -Ev '^(ldap|rac|radius)=None$' >/dev/null; then
   echo "A managed outpost still has an explicit database image override." >&2
   exit 1
 fi
diff --git a/bootstrap/authentik.yaml b/bootstrap/authentik.yaml
index 927611b..4645b10 100644
--- a/bootstrap/authentik.yaml
+++ b/bootstrap/authentik.yaml
@@ -25,7 +25,7 @@ spec:
   syncPolicy:
     automated:
       enabled: true
-      prune: false
+      prune: true
       selfHeal: true
     syncOptions:
     - CreateNamespace=true