Repository navigation
Conversation
dominic-r
added this pull request to stack #26099
September 14, 2026 00:04
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
dominic-r
added
area:backend
area:frontend
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
September 14, 2026 00:44
65b5c3a to
c6c5e11
Compare
dominic-r
removed
the
area:frontend
dominic-r
changed the title
dominic-r
removed this pull request from stack #26099
September 14, 2026 00:48
dominic-r
changed the base branch from
dominic/rotation-sources-stages
to
dominic/rotation-email-captcha
September 14, 2026 00:49
dominic-r
added this pull request to stack #26110
September 14, 2026 00:49
❌ 1 Tests Failed:
View the top 1 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
Contributor
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-cd2bf83bd69e5b7df258e18ba106b5ff78c618b0
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-cd2bf83bd69e5b7df258e18ba106b5ff78c618b0Afterwards, run the upgrade commands from the latest release notes. |
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
September 14, 2026 02:00
c6c5e11 to
43dc0b5
Compare
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
2 times, most recently
from
September 14, 2026 02:28
47d15ae to
75b7dce
Compare
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
September 14, 2026 02:48
75b7dce to
22edda8
Compare
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
September 14, 2026 03:32
22edda8 to
17c692c
Compare
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Playwright e2eDownload this run's HTML report and traces, then open the report: gh run download 38088919769 -D playwright-artifacts
npx playwright show-report playwright-artifacts/playwright-reportInstallation instructionsInstructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ce7a93fe4ef326c38b374a998129e6f2238a6dd9
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-ce7a93fe4ef326c38b374a998129e6f2238a6dd9Afterwards, run the upgrade commands from the latest release notes. |
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
September 23, 2026 21:24
9358327 to
21b98f9
Compare
dominic-r
force-pushed
the
dominic/rotation-connectors
branch
from
October 5, 2026 17:57
21b98f9 to
2971942
Compare
…onnectors # Conflicts: # authentik/crypto/secrets/tests/test_api.py # authentik/crypto/secrets/tests/utils.py # authentik/rbac/tests/test_secret_fields.py
… state Kubeconfigs are JSON secrets now, so the Secret validates their syntax and the connection only checks that it is a usable kubeconfig, and only when the connection's credentials change. Replacing a kubeconfig refreshes the connection's cached state like saving it used to, and a connection without one fails with a clear error. Discovered kubeconfigs get a readable secret name, a transport saved without a webhook URL fails with a transport error, and the consumer tests live with their consumers.
3 tasks
dominic-r
removed this pull request from stack #26110
October 10, 2026 21:17
dominic-r
added this pull request to stack #26820
October 10, 2026 21:17
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
Part of the managed secrets stack, see #25415.
What does this PR change?
Notification transports store their webhook URL and Kubernetes service connections their kubeconfig as secrets.
Why is this change needed?
Each credential becomes a secret with its own permissions, rotation and audit trail. See #25415.
How was this tested?
Added tests for kubeconfig validation, reading it into the Kubernetes client, local connections, state refresh after a replacement, and webhook URL validation.
Linked issues
Checklist
make all)make docs)