chore(deps): update helm chart cert-manager to v1.21.1

2026-09-17 02:12:55 +02:00 · 2026-07-30 00:06:09 +00:00
9 changed files with 4 additions and 103 deletions
@@ -106,9 +106,6 @@ spec:
              - name: blueprint-actualbudget
                configMap:
                  name: authentik-blueprint-actualbudget
-              - name: blueprint-session
-                configMap:
-                  name: authentik-blueprint-session
            volumeMounts:
              - name: blueprint-vault
                mountPath: /blueprints/custom/vault-oidc.yaml
@@ -128,9 +125,6 @@ spec:
              - name: blueprint-actualbudget
                mountPath: /blueprints/custom/actualbudget-proxy.yaml
                subPath: actualbudget-proxy.yaml
-              - name: blueprint-session
-                mountPath: /blueprints/custom/session-duration.yaml
-                subPath: session-duration.yaml
            ingress:
              enabled: true
              ingressClassName: nginx
@@ -162,9 +156,6 @@ spec:
              - name: blueprint-actualbudget
                configMap:
                  name: authentik-blueprint-actualbudget
-              - name: blueprint-session
-                configMap:
-                  name: authentik-blueprint-session
            volumeMounts:
              - name: blueprint-vault
                mountPath: /blueprints/custom/vault-oidc.yaml
@@ -184,9 +175,6 @@ spec:
              - name: blueprint-actualbudget
                mountPath: /blueprints/custom/actualbudget-proxy.yaml
                subPath: actualbudget-proxy.yaml
-              - name: blueprint-session
-                mountPath: /blueprints/custom/session-duration.yaml
-                subPath: session-duration.yaml
          postgresql:
            enabled: false
          redis:
@@ -12,7 +12,7 @@ spec:
  project: default
  source:
    repoURL: https://charts.jetstack.io
-    targetRevision: v1.15.5
+    targetRevision: v1.21.1
    chart: cert-manager
    helm:
      parameters:
@@ -10,7 +10,7 @@ spec:
  source:
    chart: cloudnative-pg
    repoURL: https://cloudnative-pg.github.io/charts
-    targetRevision: 0.29.0
+    targetRevision: 0.23.2
    helm:
      values: |
        # Default values are fine
@@ -11,22 +11,6 @@ Authentik is deployed as the central identity provider, providing OIDC and LDAP
  - `blueprint-ldap.yaml` — LDAP provider (base DN: `DC=ldap,DC=goauthentik,DC=io`)
  - `blueprint-mail-oidc.yaml` — OAuth2/OIDC provider for Stalwart mail
  - `blueprint-vault-oidc.yaml` — OIDC provider for Vault
-  - `blueprint-argocd-oidc.yaml` — OIDC provider for ArgoCD
-  - `blueprint-freshrss-oidc.yaml` — OIDC provider for FreshRSS
-  - `blueprint-actualbudget-proxy.yaml` — Proxy provider for Actual Budget
-  - `blueprint-session-duration.yaml` — Session lifetime of the default authentication flow
-
-## Session lifetime
-
-Authentik ships the login stage of `default-authentication-flow` with
-`session_duration: seconds=0`, i.e. the SSO session dies when the browser closes.
-`blueprint-session-duration.yaml` raises this to 30 days for every app that uses
-that flow (FreshRSS, ArgoCD, Vault, Actual Budget, mail).
-
-The expiry is **absolute** — Authentik does not extend a session on activity. A
-sliding window has to come from the application itself; FreshRSS does this via
-`OIDC_SESSION_INACTIVITY_TIMEOUT` (see `freshrss/freshrss-deployment.yaml`), which
-Apache mod_auth_openidc refreshes on every request.

 ## LDAP Outpost

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-blueprint-session
-data:
-  session-duration.yaml: |
-    version: 1
-    metadata:
-      name: Session duration
-    entries:
-      # Overrides the login stage of the built-in `default-authentication-flow`,
-      # which every OIDC/proxy provider in this cluster authenticates against.
-      # authentik ships this stage with `session_duration: seconds=0`, which means
-      # "until the browser is closed" — that is why re-logins were so frequent.
-      #
-      # Note: authentik's session expiry is absolute (counted from login), it does
-      # not slide on activity. The sliding window lives in the applications, e.g.
-      # OIDC_SESSION_INACTIVITY_TIMEOUT in freshrss/freshrss-deployment.yaml.
-      - model: authentik_stages_user_login.userloginstage
-        state: present
-        identifiers:
-          name: default-authentication-login
-        attrs:
-          session_duration: days=30
-          # Uncomment to show a "Remember me on this device" checkbox that adds
-          # this offset on top of session_duration when ticked (0 = hidden).
-          # remember_me_offset: days=60
@@ -17,7 +17,7 @@ spec:
        app: bolletjestrui
    spec:
      containers:
-        - image: ghcr.io/rubenhensen/bolletjestrui:main-10268f1
+        - image: ghcr.io/rubenhensen/bolletjestrui:main-8f17b5d
          name: bolletjestrui
          ports:
            - containerPort: 3000
@@ -51,24 +51,6 @@ spec:
                secretKeyRef:
                  name: bolletjestrui-secrets
                  key: key_secret
-            # Push notifications. optional:true is load-bearing: without it a missing
-            # key leaves the pod in CreateContainerConfigError and the site is down,
-            # which would make deploying this depend on the Vault entries landing
-            # first. The app already treats absent VAPID keys as "send nothing".
-            - name: VAPID_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_public_key
-                  optional: true
-            - name: VAPID_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_private_key
-                  optional: true
-            - name: VAPID_SUBJECT
-              value: mailto:ruben.hensen@protonmail.com
          resources:
            requests:
              memory: "128Mi"
@@ -23,14 +23,3 @@ spec:
      remoteRef:
        key: kv/bolletjestrui
        property: key_secret
-    # web-push keypair for the "de route is gekozen" notification.
-    # Generate once with `npx web-push generate-vapid-keys` and never rotate it:
-    # a new key invalidates every subscription on everyone's phone.
-    - secretKey: vapid_public_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_public_key
-    - secretKey: vapid_private_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_private_key
@@ -6,8 +6,7 @@ metadata:
    cert-manager.io/cluster-issuer: prod-cluster-issuer
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # matches the app's BODY_SIZE_LIMIT: a bulk route import posts every GPX at once
-    nginx.ingress.kubernetes.io/proxy-body-size: "25m"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
 spec:
  ingressClassName: nginx
  rules:
@@ -56,20 +56,6 @@ spec:
              value: "openid email profile"
            - name: OIDC_X_FORWARDED_HEADERS
              value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
-            # Session handling for the Apache mod_auth_openidc layer that guards /i/.
-            # Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
-            # constant bounces back to authentik.
-            # Sliding window: refreshed on every request, so any visit within the
-            # period extends it by another 30 days.
-            - name: OIDC_SESSION_INACTIVITY_TIMEOUT
-              value: "2592000" # 30 days
-            # Hard cap, counted from login and never extended.
-            - name: OIDC_SESSION_MAX_DURATION
-              value: "7776000" # 90 days
-            # ":persistent" makes the session cookie survive a browser restart
-            # (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
-            - name: OIDC_SESSION_TYPE
-              value: "server-cache:persistent"
            - name: TZ
              value: Europe/Amsterdam
          image: freshrss/freshrss:latest