Provider 2026.8.0 requires pbm_uuid on the applications API, which the
deployed authentik 2026.5.3 server does not return, so every
authentik_application read fails and no plan completes.
- Pin goauthentik/authentik to 2026.5.1, the newest release built on the
2026.5 API client
- Record 2026.5.1 in the lock file
- Drop -upgrade from make init so the lock is authoritative
PR plan pipelines were failing with "Error acquiring the state lock"
when they collided with a concurrent apply (or another plan) holding
the lock on the same Consul-backed state.
- plan: pass -lock=false to terragrunt plan; apply keeps locking
The authentik provider needs a token but nothing supplied it, so plan
failed with 'No value for required variable authentik_token'. Source it
from Vault in vault_env like the consul creds, from the dedicated
terraform-service path kv/service/terraform/authentik (field: token),
overridable via AUTHENTIK_TOKEN_KV_* vars.
- Terraform module for groups, SAML/OAuth2/LDAP providers, applications, and LDAP outposts
- Data-driven YAML config with Terragrunt config loader
- Environment: identity.unkin.net with Consul backend
- Provider: goauthentik/authentik 2026.5.0
- Woodpecker CI pipelines (pre-commit, plan, apply)
- Makefile with Vault AppRole and K8s auth support
unkin-agent
unkinben