fix(helm): update chart authentik to 2026.5.4

[renovate]

This PR contains the following updates:

Package	Update	Change
authentik (source)	patch	2026.5.3 → 2026.5.4

---

Release Notes

goauthentik/helm (authentik)

v2026.5.4

Compare Source

authentik is an open-source Identity Provider focused on flexibility and versatility

What's Changed

• Update actions/checkout action to v7 by @​renovate[bot] in #​481
• charts/authentik: update postgresql chart tag to v18.7.6 by @​renovate[bot] in #​475
• charts/authentik: improve explanation of the authentik.existingSecret by @​chaeynz in #​480
• charts/authentik: update postgresql chart tag to v18.7.7 by @​renovate[bot] in #​482
• charts/authentik: add server automountServiceAccountToken value by @​somaz94 in #​483
• charts/authentik: update postgresql chart tag to v18.7.8 by @​renovate[bot] in #​484
• charts/authentik: update postgresql chart tag to v18.7.9 by @​renovate[bot] in #​486
• charts/authentik: bump to 2026.5.4 by @​authentik-automation[bot] in #​490

New Contributors

• @​chaeynz made their first contribution in #​480
• @​somaz94 made their first contribution in #​483

Full Changelog: goauthentik/helm@authentik-2026.5.3...authentik-2026.5.4

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm,before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Flux main kustomization diff

--- kubernetes/main/apps/frontend/haynesnetwork/app Kustomization: frontend/haynesnetwork HelmRelease: frontend/haynesnetwork

+++ kubernetes/main/apps/frontend/haynesnetwork/app Kustomization: frontend/haynesnetwork HelmRelease: frontend/haynesnetwork

@@ -42,13 +42,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             probes:
               liveness:
                 custom: true
                 enabled: true
                 spec:
                   failureThreshold: 3
@@ -108,13 +108,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
         replicas: 1
         strategy: RollingUpdate
       sync-full:
         containers:
           main:
             command:
@@ -127,13 +127,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 1Gi
               requests:
                 cpu: 50m
                 memory: 256Mi
@@ -159,13 +159,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 512Mi
               requests:
                 cpu: 25m
                 memory: 128Mi
@@ -191,13 +191,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 768Mi
               requests:
                 cpu: 25m
                 memory: 128Mi
@@ -223,13 +223,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 512Mi
               requests:
                 cpu: 25m
                 memory: 128Mi
@@ -255,13 +255,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 512Mi
               requests:
                 cpu: 25m
                 memory: 128Mi
@@ -288,13 +288,13 @@

             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
             image:
               pullPolicy: IfNotPresent
               repository: ghcr.io/thaynes43/haynesnetwork
-              tag: v0.23.0
+              tag: v0.22.0
             resources:
               limits:
                 memory: 512Mi
               requests:
                 cpu: 25m
                 memory: 128Mi
--- kubernetes/main/apps/network/authentik/app Kustomization: network/authentik HelmRelease: network/authentik

+++ kubernetes/main/apps/network/authentik/app Kustomization: network/authentik HelmRelease: network/authentik

@@ -12,13 +12,13 @@

   chart:
     spec:
       chart: authentik
       sourceRef:
         kind: HelmRepository
         name: authentik
-      version: 2026.5.3
+      version: 2026.5.4
   install:
     remediation:
       retries: 3
   interval: 30m
   uninstall:
     keepHistory: false

[github-actions]

Flux main helmrelease diff

--- HelmRelease: network/authentik Deployment: network/authentik-server

+++ HelmRelease: network/authentik Deployment: network/authentik-server

@@ -26,25 +26,25 @@

         app.kubernetes.io/name: authentik
         app.kubernetes.io/instance: authentik
         app.kubernetes.io/component: server
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: authentik
       annotations:
-        checksum/secret: 25ddca57e07240dff0b66c04037185edd819d590239756d1801dd224a8f53fb4
+        checksum/secret: d964a2bc8d2773f9c7f83f26bed6c16eb4697ddc8ac63c70114151ee98567603
     spec:
       terminationGracePeriodSeconds: 30
       initContainers:
       - envFrom:
         - secretRef:
             name: authentik-secret
         image: ghcr.io/home-operations/postgres-init:18.4
         imagePullPolicy: IfNotPresent
         name: init-db
       containers:
       - name: server
-        image: ghcr.io/goauthentik/server:2026.5.3
+        image: ghcr.io/goauthentik/server:2026.5.4
         imagePullPolicy: IfNotPresent
         args:
         - server
         env: null
         envFrom:
         - secretRef:
--- HelmRelease: network/authentik Deployment: network/authentik-worker

+++ HelmRelease: network/authentik Deployment: network/authentik-worker

@@ -26,19 +26,19 @@

         app.kubernetes.io/name: authentik
         app.kubernetes.io/instance: authentik
         app.kubernetes.io/component: worker
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: authentik
       annotations:
-        checksum/secret: 25ddca57e07240dff0b66c04037185edd819d590239756d1801dd224a8f53fb4
+        checksum/secret: d964a2bc8d2773f9c7f83f26bed6c16eb4697ddc8ac63c70114151ee98567603
     spec:
       serviceAccountName: authentik
       terminationGracePeriodSeconds: 30
       containers:
       - name: worker
-        image: ghcr.io/goauthentik/server:2026.5.3
+        image: ghcr.io/goauthentik/server:2026.5.4
         imagePullPolicy: IfNotPresent
         args:
         - worker
         env: null
         envFrom:
         - secretRef:
--- HelmRelease: frontend/haynesnetwork Deployment: frontend/haynesnetwork-main

+++ HelmRelease: frontend/haynesnetwork Deployment: frontend/haynesnetwork-main

@@ -51,13 +51,13 @@

         envFrom:
         - secretRef:
             name: haynesnetwork-secret
         - secretRef:
             name: haynesnetwork-webhook
             optional: true
-        image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+        image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
         imagePullPolicy: IfNotPresent
         name: migrate
       containers:
       - env:
         - name: HOSTNAME
           value: 0.0.0.0
@@ -70,13 +70,13 @@

         envFrom:
         - secretRef:
             name: haynesnetwork-secret
         - secretRef:
             name: haynesnetwork-webhook
             optional: true
-        image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+        image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
           httpGet:
             path: /api/health
             port: 3000
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-notify-outbox

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-notify-outbox

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 512Mi
               requests:
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-space-policy

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-space-policy

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 512Mi
               requests:
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-trash-batch-sweep

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-trash-batch-sweep

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 512Mi
               requests:
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-full

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-full

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 1Gi
               requests:
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-incremental

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-incremental

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 512Mi
               requests:
--- HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-metadata

+++ HelmRelease: frontend/haynesnetwork CronJob: frontend/haynesnetwork-sync-metadata

@@ -42,13 +42,13 @@

             envFrom:
             - secretRef:
                 name: haynesnetwork-secret
             - secretRef:
                 name: haynesnetwork-webhook
                 optional: true
-            image: ghcr.io/thaynes43/haynesnetwork:v0.23.0
+            image: ghcr.io/thaynes43/haynesnetwork:v0.22.0
             imagePullPolicy: IfNotPresent
             name: main
             resources:
               limits:
                 memory: 768Mi
               requests:

[haynes-ops-bot]

VERDICT: HOLD

This is a pure single-file chart bump (authentik 2026.5.3 → 2026.5.4, same 2026.5 — a revertible PATCH per the component playbook) with every check green (Flux Local, Diff Scope) and no supporting edit required. However, the backup gate cannot be confirmed read-only: the Reader SA (system:serviceaccount:upgrade-agent:upgrade-shepherd) is RBAC-forbidden from listing both backups.postgresql.cnpg.io and clusters.postgresql.cnpg.io in the database namespace, and authentik has no VolSync replicationsource of its own (its only durable state is the shared CNPG postgres cluster). Per the backup-gate rule, an unconfirmable safety net blocks auto-merge — holding until either the Reader SA's RBAC is widened to cover CNPG Backup/Cluster reads, or a human confirms a recent successful backup out-of-band.