Upgrade Authentik to 2026.2.3

2026-10-22 17:42:32 +00:00
parent 2f0e10a10b
commit ffd5bde344
3 changed files with 11 additions and 3 deletions
@@ -38,6 +38,11 @@ authentik:
      # CA; CloudNativePG rotates its private in-cluster certificates itself.
      - name: AUTHENTIK_POSTGRESQL__SSLMODE
        value: require
+      # Authentik 2026.8 only honors forwarded HTTPS and client-address headers
+      # from explicit trusted proxies. This is the smallest aggregate covering
+      # all current node Pod subnets, so ingress-nginx stays trusted if moved.
+      - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
+        value: 10.244.0.0/21

    # The same Longhorn claim carries three restored source directories. Each
    # subPath is mounted where the upstream container expects it.