Skip to content

stages: use managed secrets for email and CAPTCHA - #26103

Open
dominic-r wants to merge 26 commits into
dominic/rotation-mfa-stagesfrom
dominic/rotation-email-captcha
Open

dominic-r wants to merge 26 commits into
dominic/rotation-mfa-stagesfrom
dominic/rotation-email-captcha

Conversation

@dominic-r

@dominic-r dominic-r commented Sep 14, 2026 •

Copy link
Copy Markdown
Member

Details

Part of the managed secrets stack, see #25415.

What does this PR change?

Email, authenticator email and CAPTCHA stages store their SMTP passwords and private keys as secrets.

Why is this change needed?

Each credential becomes a secret with its own permissions, rotation and audit trail. See #25415.

How was this tested?

Ran the email, authenticator email, CAPTCHA, identification and blueprint tests.

Linked issues


Checklist

  • The project has been linted, built, and tested (make all)
  • The documentation has been updated and formatted (make docs)
  • I have read the AI usage policy.

@dominic-r
dominic-r requested review from a team as code owners September 14, 2026 00:46
@dominic-r dominic-r added this to the Release 2026.11.0: Required milestone Sep 14, 2026
@dominic-r dominic-r self-assigned this Sep 14, 2026
@dominic-r
dominic-r added this pull request to stack #26110 September 14, 2026 00:49
@netlify

netlify Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 38e0ee6
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6acaaaf0f394f700083f18cb
😎 Deploy Preview https://deploy-preview-26103--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 0dadcf4 to caf808c Compare September 14, 2026 02:00
@codecov

codecov Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
4733 1 4732 14
View the top 1 failed test(s) by shortest run time
600-providers.test.ts::Provider Wizard › Complete OAuth2 Provider
Stack Traces | 85s run time
Client Secret should be visible when Client Type is Confidential

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from caf808c to 3b03b64 Compare September 14, 2026 02:18
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 3b03b64 to 15ddd33 Compare September 14, 2026 02:28
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 15ddd33 to 7d5db11 Compare September 14, 2026 02:48
@github-actions

github-actions Bot commented Sep 14, 2026 •

Copy link
Copy Markdown
Contributor

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-1723273b440d1517a8a9c5a1e979d1ab8eabf0c5
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-1723273b440d1517a8a9c5a1e979d1ab8eabf0c5

Afterwards, run the upgrade commands from the latest release notes.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 7d5db11 to 24b46a2 Compare September 14, 2026 03:32
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 24b46a2 to 8f10c15 Compare September 14, 2026 03:59
…l-captcha

# Conflicts:
#	packages/client-ts/src/apis/StagesApi.ts
#	packages/client-ts/src/models/AuthenticatorEmailStage.ts
#	packages/client-ts/src/models/AuthenticatorEmailStageRequest.ts
#	packages/client-ts/src/models/CaptchaStage.ts
#	packages/client-ts/src/models/CaptchaStageRequest.ts
#	packages/client-ts/src/models/EmailStage.ts
#	packages/client-ts/src/models/EmailStageRequest.ts
#	packages/client-ts/src/models/PatchedAuthenticatorEmailStageRequest.ts
#	packages/client-ts/src/models/PatchedCaptchaStageRequest.ts
#	packages/client-ts/src/models/PatchedEmailStageRequest.ts
@netlify

netlify Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for authentik-integrations ready!

Name Link
🔨 Latest commit 38e0ee6
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/6acaaaf0817d36000731ac07
😎 Deploy Preview https://deploy-preview-26103--authentik-integrations.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for authentik-storybook ready!

Name Link
🔨 Latest commit 38e0ee6
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/6acaaaf0104cd90008f04be8
😎 Deploy Preview https://deploy-preview-26103--authentik-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions

github-actions Bot commented Sep 20, 2026 •

Copy link
Copy Markdown
Contributor

Playwright e2e

Download this run's HTML report and traces, then open the report:

gh run download 38088918869 -D playwright-artifacts
npx playwright show-report playwright-artifacts/playwright-report

Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-12b40b01cd06a3683149a7c1803203bc0aade161
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-12b40b01cd06a3683149a7c1803203bc0aade161

Afterwards, run the upgrade commands from the latest release notes.

db_column="private_key", help_text="Private key, acquired your captcha Provider."
),
),
migrations.RenameField(

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go thru entire stack and get rid of renames. (do like oauth thingy which just adds _ref)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dk why some have this and some dont

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 1690be4 to 0eea168 Compare October 5, 2026 17:57
@dominic-r
dominic-r removed this pull request from stack #26110 October 10, 2026 21:17
@dominic-r
dominic-r added this pull request to stack #26820 October 10, 2026 21:17

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant