From 9117fd777a885106685294aa8ee9b3bdeecd73b1 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:40:08 -0700
Subject: [PATCH] =?UTF-8?q?fix(authentik):=20drop=20redundant=20authentik-?=
 =?UTF-8?q?migrate=20init=20container=20=E2=80=94=20server=20entrypoint=20?=
 =?UTF-8?q?migrates;=20old-image=20manage=20migrate=20tripped=20version-hi?=
 =?UTF-8?q?story=20precheck=20on=20empty=20DB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/security/iam/authentik-values.yaml | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 73c998a..392af6b 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -82,21 +82,10 @@ _caInitContainers: &caInitContainers
         readOnly: true
       - name: merged-ca
         mountPath: /merged
-  - name: authentik-migrate
-    image: ghcr.io/goauthentik/server:2026.5.4
-    imagePullPolicy: IfNotPresent
-    command:
-      - sh
-      - -c
-      - python -m manage migrate --noinput
-    envFrom:
-      - secretRef:
-          name: authentik
-      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
-      # merged after the chart config secret — see sops-cmp-plugin.yaml.
-      - secretRef:
-          name: authentik-secrets
-    volumeMounts: *caVolumeMounts
+  # NOTE: no authentik-migrate init container — the authentik `server` entrypoint
+  # runs migrations itself on startup. A separate `manage migrate` init pinned to
+  # an older image tripped a version-history precheck on an empty DB
+  # (relation "authentik_version_history" does not exist) and blocked boot.
 
 _caEnv: &caEnv
   - name: REQUESTS_CA_BUNDLE