Upgrade authentik to 2026.8.1, pin init-container off debian:13-slim

[nickvigilante]

Summary

Upgrades authentik from 2026.2.2 to 2026.8.1 (already applied live via helm upgrade), and codifies a fix for a postgres init-container image that reproducibly failed to pull during the upgrade.

Changes

• Chart authentik/authentik 2026.2.2 -> 2026.8.1, stepped through 2026.5.6 in between. Authentik enforces sequential major.minor upgrades -- jumping straight from 2026.2.x to 2026.8.x crash-loops the server with Major version skips are not allowed.
• Bundled postgres's volumePermissions init container redirected from the chart default (docker.io/debian:13-slim) to docker.io/library/postgres:17.11-bookworm (already pulled for the main container, and Debian-based so it has the chown/chmod the init step needs).

Why the image override

debian:13-slim reproducibly failed to pull from gandalf twice during this upgrade with insufficient_scope: authorization failed -- confirmed it wasn't a Docker Hub rate limit (99/100 remaining via a direct token check) and no other docker.io image pulled that day hit the same error. Left unfixed, this would break any future postgres pod recreation too (node reboot, eviction, etc.), not just this one upgrade -- worth fixing durably rather than working around it once.

Testing

• Reviewed authentik's 2026.5 and 2026.8 release notes for breaking changes affecting this cluster: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS already covers Traefik's pod CIDR for 2026.8's new trusted-proxy header restriction; the removed flow-import API endpoint and the hash_password CLI arg change aren't used anywhere in this repo; bundled postgres moved 17.9-bookworm -> 17.11-bookworm (patch-only, same major).
• Live-verified post-upgrade: all three authentik pods (server/worker/postgres) healthy, /-/health/ready/ returns 200, OIDC login redirect to authentik.vigihome.net works, forward-auth-gated prometheus.vigihome.net and grafana.vigihome.net both correctly 302 through Authentik.
• Hit and recovered from two live incidents during this upgrade (both rolled back and root-caused before retrying): the debian:13-slim pull failure, and the major-version-skip crash loop from an initial attempt that went straight from 2026.2.2 to 2026.8.1.

---

🤖 Built with AI assistance.