apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-migrations
  namespace: iam
spec:
  ttlSecondsAfterFinished: 600
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: default
      restartPolicy: Never
      containers:
      - name: migrate
        image: ghcr.io/goauthentik/server:2026.5.4
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: authentik
        command:
        - /bin/sh
        - -c
        - |
          python -m manage migrate --noinput && echo "✓ Migrations complete"