refactor(authentik): fold seed-authentik into the authentik KS — retire the seed layer (stage 2) #411

2026-07-26T06:00:53Z

claude-bot commented

2026-07-26 06:00:53 +00:00

The final fold. authentik was the last app on the transitional seed layer — this folds its ak-pg CNPG backend into the existing dedicated authentik KS and, since it's the last holdout, fully retires kubernetes/seed/.

The fold

git mv the 5 CNPG manifests seed/authentik/ → apps/authentik/ (no PVCs — all state is in ak-pg).
authentik KS: drop dependsOn: seed-authentik, add infrastructure-cnpg-barman, add CNPG Cluster healthCheckExprs.
Delete seed-authentik.yaml + the now-empty seed/authentik/.

Seed-layer retirement (`kubernetes/seed/` is now empty)

git mv seed/RECOVERY.md → kubernetes/RECOVERY.md (sibling to the MIGRATION-* docs); fix its stale seed-authentik reconcile example → authentik.
e2e-test.sh: drop the last seed-* check.
bootstrap.sh: rewrite the obsolete seed-<app> gating comment (app KSes now own their CNPG DBs directly) + de-seed the wait labels (the one-shot seed Jobs are long gone).
opentofu/object_storage.tf: fix the ObjectStore path comment (seed/* → apps/*).

Safe transfer + verified restorability

All 5 seed/authentik objects carry prune: disabled (#407), so deleting seed-authentik skips them in GC and authentik adopts them in place. No CNPG/app restart. Restore-test passed first: ak-pg restored cleanly (25 users, 368 tables, 1225 MB) via the corrected #404 recipe, clean no-leak teardown.

Verified: build has Cluster/ak-pg + exactly 5 prune-protected; bash -n bootstrap+e2e OK; kubernetes/seed/ fully removed; no stale seed file-paths remain.

Post-merge check

seed-authentik gone; authentik KS Ready; ak-pg adopted (owner→authentik) with RESTARTS=0; nothing pruned. This completes the seed→apps migration for all 7 apps.

**The final fold.** authentik was the last app on the transitional `seed` layer — this folds its `ak-pg` CNPG backend into the existing dedicated `authentik` KS and, since it's the last holdout, **fully retires `kubernetes/seed/`.** ### The fold - `git mv` the 5 CNPG manifests `seed/authentik/` → `apps/authentik/` (no PVCs — all state is in `ak-pg`). - `authentik` KS: drop `dependsOn: seed-authentik`, add `infrastructure-cnpg-barman`, add CNPG Cluster `healthCheckExprs`. - Delete `seed-authentik.yaml` + the now-empty `seed/authentik/`. ### Seed-layer retirement (`kubernetes/seed/` is now empty) - `git mv seed/RECOVERY.md → kubernetes/RECOVERY.md` (sibling to the MIGRATION-* docs); fix its stale `seed-authentik` reconcile example → `authentik`. - `e2e-test.sh`: drop the last `seed-*` check. - `bootstrap.sh`: rewrite the obsolete `seed-<app>` gating comment (app KSes now own their CNPG DBs directly) + de-`seed` the wait labels (the one-shot seed Jobs are long gone). - `opentofu/object_storage.tf`: fix the ObjectStore path comment (`seed/*` → `apps/*`). ### Safe transfer + verified restorability All 5 `seed/authentik` objects carry `prune: disabled` (#407), so deleting `seed-authentik` skips them in GC and `authentik` adopts them in place. No CNPG/app restart. **Restore-test passed first**: `ak-pg` restored cleanly (25 users, 368 tables, 1225 MB) via the corrected #404 recipe, clean no-leak teardown. **Verified:** build has `Cluster/ak-pg` + exactly 5 prune-protected; `bash -n` bootstrap+e2e OK; `kubernetes/seed/` fully removed; no stale seed file-paths remain. ### Post-merge check `seed-authentik` gone; `authentik` KS Ready; `ak-pg` adopted (owner→`authentik`) with `RESTARTS=0`; nothing pruned. **This completes the seed→apps migration for all 7 apps.**

claude-bot added 1 commit 2026-07-26 06:00:53 +00:00

refactor(authentik): fold seed-authentik into the authentik KS — retire the seed layer (stage 2)

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

91f5baf661

The last app in the seed->apps migration. Folds authentik's ak-pg CNPG backend
into the existing dedicated authentik KS and, since authentik was the final
holdout, fully retires kubernetes/seed/.

- git mv seed/authentik/{cluster,objectstore,scheduled-backup,barman-creds-
  externalsecret,hetzner-creds-externalsecret}.yaml -> apps/authentik/, add to
  apps/authentik/kustomization.yaml (authentik has no data PVCs — all state is
  in ak-pg).
- authentik KS: drop 'dependsOn: seed-authentik', add
  'dependsOn: infrastructure-cnpg-barman', add the CNPG Cluster healthCheckExprs.
- Delete clusters/homelab/seed-authentik.yaml and the now-empty seed/authentik/.

Seed-layer retirement cleanup (kubernetes/seed/ is now empty):
- git mv seed/RECOVERY.md -> kubernetes/RECOVERY.md (sibling to the MIGRATION-*
  docs); fix its stale 'flux reconcile kustomization seed-authentik' example to
  'authentik'.
- e2e-test.sh: drop the last seed-* readiness check (seed-authentik).
- bootstrap.sh: rewrite the obsolete 'per-app seed-<app> KSes' gating comment to
  reflect that app KSes now own their CNPG DBs directly, and de-'seed' the
  wait-description labels (the one-shot rsync/pg_restore seed Jobs are long gone).
- opentofu/object_storage.tf: fix the CNPG ObjectStore path comment
  (kubernetes/seed/* -> kubernetes/apps/*).

Safe ownership transfer (nothing pruned): all 5 seed/authentik objects carry
prune: disabled (from stage 1 #407), so deleting seed-authentik skips them in GC
and the authentik KS adopts them in place. No CNPG restart, no app restart.
Restore-test passed first: ak-pg backup restored cleanly (25 users, 368 tables,
1225 MB) using the corrected RECOVERY.md recipe, with a clean no-leak teardown.

Verified: kubectl kustomize apps/authentik builds with Cluster/ak-pg + exactly
5 prune-protected; bash -n bootstrap.sh + e2e-test.sh OK; kubernetes/seed/ fully
removed; no stale seed file-path references remain.

Left intentionally: barman/hetzner ExternalSecrets still read OpenBao keys under
seed/authentik/... (vault paths, not repo paths).

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-07-26 06:04:49 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 91f5baf66142ea0c79e2ad83c67755c842386151.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR folds the last remaining seed-<app> Kustomization (seed-authentik) into the dedicated authentik KS, retiring kubernetes/seed/ entirely. It's a mechanical git mv of 5 CNPG manifests plus dependency/health-check wiring and doc/script cleanup, and it follows the exact same pattern already used successfully for the other 6 apps (immich, paperless, audiobookshelf, music-assistant, influxdb, woodpecker — confirmed by their existing clusters/homelab/*.yaml comments). I verified the checkout after the change: kubernetes/seed/ no longer exists, all 5 moved objects carry kustomize.toolkit.fluxcd.io/prune: disabled (so deleting seed-authentik can't GC them), no other Flux Kustomization or script still references seed-authentik or kubernetes/seed, and the new authentik.yaml KS (dependsOn/healthCheckExprs) is byte-for-byte structurally identical to the already-live immich.yaml KS. No blocking issues found.

🟡 Suggestions

kubernetes/RECOVERY.md:138 — the fix from seed-authentik → authentik in the flux reconcile kustomization authentik --with-source example is correct and necessary (the old target no longer exists after this PR), but it's a good example of how easy this kind of doc drift is: worth a quick sanity pass over the rest of RECOVERY.md's per-cluster tables (im-pg/pprl-pg rows) next time either of those KSes gets touched, since they'll eventually need the same treatment if not already done.

Tests

No automated tests exist for this kind of Flux/GitOps manifest change (consistent with the rest of the repo), and none would be expected here. The PR body states a restore-test was performed against the live cluster (ak-pg restored cleanly, clean teardown) and that bash -n was run on bootstrap.sh/e2e-test.sh — I couldn't re-run either the cluster restore-test or bash -n myself in this sandboxed review (shell execution for scripts was blocked), but I read both scripts' changed sections directly and the edits are simple label/comment text changes with correct quoting and no altered control flow, so I have no reason to doubt the syntax claim.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `91f5baf66142ea0c79e2ad83c67755c842386151`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR folds the last remaining `seed-<app>` Kustomization (`seed-authentik`) into the dedicated `authentik` KS, retiring `kubernetes/seed/` entirely. It's a mechanical `git mv` of 5 CNPG manifests plus dependency/health-check wiring and doc/script cleanup, and it follows the exact same pattern already used successfully for the other 6 apps (immich, paperless, audiobookshelf, music-assistant, influxdb, woodpecker — confirmed by their existing `clusters/homelab/*.yaml` comments). I verified the checkout after the change: `kubernetes/seed/` no longer exists, all 5 moved objects carry `kustomize.toolkit.fluxcd.io/prune: disabled` (so deleting `seed-authentik` can't GC them), no other Flux Kustomization or script still references `seed-authentik` or `kubernetes/seed`, and the new `authentik.yaml` KS (`dependsOn`/`healthCheckExprs`) is byte-for-byte structurally identical to the already-live `immich.yaml` KS. No blocking issues found. ## 🟡 Suggestions - `kubernetes/RECOVERY.md:138` — the fix from `seed-authentik` → `authentik` in the `flux reconcile kustomization authentik --with-source` example is correct and necessary (the old target no longer exists after this PR), but it's a good example of how easy this kind of doc drift is: worth a quick sanity pass over the rest of `RECOVERY.md`'s per-cluster tables (`im-pg`/`pprl-pg` rows) next time either of those KSes gets touched, since they'll eventually need the same treatment if not already done. ## Tests No automated tests exist for this kind of Flux/GitOps manifest change (consistent with the rest of the repo), and none would be expected here. The PR body states a restore-test was performed against the live cluster (`ak-pg` restored cleanly, clean teardown) and that `bash -n` was run on `bootstrap.sh`/`e2e-test.sh` — I couldn't re-run either the cluster restore-test or `bash -n` myself in this sandboxed review (shell execution for scripts was blocked), but I read both scripts' changed sections directly and the edits are simple label/comment text changes with correct quoting and no altered control flow, so I have no reason to doubt the syntax claim. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

claude-bot commented

2026-07-26 06:15:51 +00:00

Did the sanity pass you suggested rather than defer it — RECOVERY.md is already drift-free. The ak-pg/im-pg/pprl-pg table rows are all cluster/namespace/ObjectStore/barman-S3 facts (im-pg in ns immich, store im-pg-store, s3://renner-uno-k8s-cnpg/im-pg, DB immich) — none of which the seed→apps file move changes, so they stay correct. The other cluster.yaml mentions are relative ("edit the cluster.yaml"), not path-scoped, and the seed-word hits at lines 42-45 are the historical note about the removed one-shot seed Jobs. So line 138 (fixed here) was the only actual stale reference. Merging as-is.

Did the sanity pass you suggested rather than defer it — RECOVERY.md is already drift-free. The `ak-pg`/`im-pg`/`pprl-pg` table rows are all cluster/namespace/ObjectStore/barman-S3 facts (`im-pg` in ns `immich`, store `im-pg-store`, `s3://renner-uno-k8s-cnpg/im-pg`, DB `immich`) — none of which the seed→apps file move changes, so they stay correct. The other `cluster.yaml` mentions are relative ("edit the cluster.yaml"), not path-scoped, and the `seed`-word hits at lines 42-45 are the historical note about the removed one-shot seed Jobs. So line 138 (fixed here) was the only actual stale reference. Merging as-is.

k.renner merged commit 8b1fa7b724 into master

2026-07-26 06:17:22 +00:00

k.renner referenced this issue from a commit

2026-07-26 06:17:24 +00:00

Merge pull request 'refactor(authentik): fold seed-authentik into the authentik KS — retire the seed layer (stage 2)' (#411) from authentik-dedicated-fold into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#411