Skip to content

stages: use managed secrets for email and CAPTCHA - #26103

Open
dominic-r wants to merge 36 commits into
dominic/rotation-mfa-stagesfrom
dominic/rotation-email-captcha
Open

dominic-r wants to merge 36 commits into
dominic/rotation-mfa-stagesfrom
dominic/rotation-email-captcha

Conversation

@dominic-r

@dominic-r dominic-r commented Sep 14, 2026 •

Copy link
Copy Markdown
Member

Details

Part of the managed secrets stack, see #25415.

What does this PR change?

Email, authenticator email and CAPTCHA stages store their SMTP passwords and private keys as secrets.

Why is this change needed?

Each credential becomes a secret with its own permissions, rotation and audit trail. See #25415.

How was this tested?

Ran the email, authenticator email, CAPTCHA, identification and blueprint tests.

Linked issues


Checklist

  • The project has been linted, built, and tested (make all)
  • The documentation has been updated and formatted (make docs)
  • I have read the AI usage policy.

@netlify

netlify Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 38e0ee6
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6acaaaf0f394f700083f18cb
😎 Deploy Preview https://deploy-preview-26103--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 0dadcf4 to caf808c Compare September 14, 2026 02:00
@codecov

codecov Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.56%. Comparing base (fa95f13) to head (1bfb94a).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@                       Coverage Diff                       @@
##           dominic/rotation-mfa-stages   #26103      +/-   ##
===============================================================
- Coverage                        92.56%   92.56%   -0.01%     
===============================================================
  Files                             1209     1209              
  Lines                            82024    82032       +8     
  Branches                          4489     4489              
===============================================================
+ Hits                             75924    75930       +6     
- Misses                            6034     6036       +2     
  Partials                            66       66              
Flag Coverage Δ
conformance 32.05% <30.76%> (-0.01%) ⬇️
e2e 36.59% <30.76%> (+0.01%) ⬆️
integration 28.90% <30.76%> (-0.01%) ⬇️
rust 46.06% <ø> (ø)
unit 94.18% <100.00%> (+<0.01%) ⬆️
unit-migrate 94.18% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from caf808c to 3b03b64 Compare September 14, 2026 02:18
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 3b03b64 to 15ddd33 Compare September 14, 2026 02:28
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 15ddd33 to 7d5db11 Compare September 14, 2026 02:48
@github-actions

github-actions Bot commented Sep 14, 2026 •

Copy link
Copy Markdown
Contributor

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-1723273b440d1517a8a9c5a1e979d1ab8eabf0c5
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-1723273b440d1517a8a9c5a1e979d1ab8eabf0c5

Afterwards, run the upgrade commands from the latest release notes.

@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 7d5db11 to 24b46a2 Compare September 14, 2026 03:32
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 24b46a2 to 8f10c15 Compare September 14, 2026 03:59
…l-captcha

# Conflicts:
#	packages/client-ts/src/apis/StagesApi.ts
#	packages/client-ts/src/models/AuthenticatorEmailStage.ts
#	packages/client-ts/src/models/AuthenticatorEmailStageRequest.ts
#	packages/client-ts/src/models/CaptchaStage.ts
#	packages/client-ts/src/models/CaptchaStageRequest.ts
#	packages/client-ts/src/models/EmailStage.ts
#	packages/client-ts/src/models/EmailStageRequest.ts
#	packages/client-ts/src/models/PatchedAuthenticatorEmailStageRequest.ts
#	packages/client-ts/src/models/PatchedCaptchaStageRequest.ts
#	packages/client-ts/src/models/PatchedEmailStageRequest.ts
@dominic-r
dominic-r force-pushed the dominic/rotation-email-captcha branch from 1690be4 to 0eea168 Compare October 5, 2026 17:57
@dominic-r
dominic-r removed this pull request from stack #26110 October 10, 2026 21:17
@dominic-r
dominic-r added this pull request to stack #26820 October 10, 2026 21:17

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

2 participants