From ffd5bde3448b9f782890d4518bf01d09a20c03e7 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Thu, 22 Oct 2026 17:42:32 +0000
Subject: [PATCH] Upgrade Authentik to 2026.2.3

---
 apps/authentik/Chart.yaml                | 6 +++---
 apps/authentik/templates/postgresql.yaml | 3 +++
 apps/authentik/values.yaml               | 5 +++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/apps/authentik/Chart.yaml b/apps/authentik/Chart.yaml
index 72930ab..690f9dd 100644
--- a/apps/authentik/Chart.yaml
+++ b/apps/authentik/Chart.yaml
@@ -9,8 +9,8 @@ type: application
 
 dependencies:
   - name: authentik
-    # Match the source Docker deployment for the migration. Upgrade only after
-    # the restored installation has been verified in Kubernetes.
-    version: 2026.2.1
+    # Pin each release explicitly: Authentik database migrations require
+    # sequential, verified upgrades through every release train.
+    version: 2026.2.3
     repository: https://charts.goauthentik.io
     condition: authentikDeployment.enabled
diff --git a/apps/authentik/templates/postgresql.yaml b/apps/authentik/templates/postgresql.yaml
index 058bc0d..6c8af5d 100644
--- a/apps/authentik/templates/postgresql.yaml
+++ b/apps/authentik/templates/postgresql.yaml
@@ -78,6 +78,9 @@ spec:
 
   plugins:
     - name: barman-cloud.cloudnative-pg.io
+      # CloudNativePG defaults this to true. Keeping it explicit prevents Argo
+      # CD from reporting harmless drift between Git and the live resource.
+      enabled: true
       isWALArchiver: true
       parameters:
         barmanObjectName: authentik-backups
diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml
index c581e80..396751a 100644
--- a/apps/authentik/values.yaml
+++ b/apps/authentik/values.yaml
@@ -38,6 +38,11 @@ authentik:
       # CA; CloudNativePG rotates its private in-cluster certificates itself.
       - name: AUTHENTIK_POSTGRESQL__SSLMODE
         value: require
+      # Authentik 2026.8 only honors forwarded HTTPS and client-address headers
+      # from explicit trusted proxies. This is the smallest aggregate covering
+      # all current node Pod subnets, so ingress-nginx stays trusted if moved.
+      - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
+        value: 10.244.0.0/21
 
     # The same Longhorn claim carries three restored source directories. Each
     # subPath is mounted where the upstream container expects it.