Error: 2 errors occurred:
        * Deployment.apps "authentik-worker" is invalid: spec.template.labels: Invalid value: "gh-stages-authenticator_validate-fix-regression-1687776866-22f27e4": must be no more than 63 characters
        * Deployment.apps "authentik-server" is invalid: spec.template.labels: Invalid value: "gh-stages-authenticator_validate-fix-regression-1687776866-22f27e4": must be no more than 63 characters

Helm upgrade failed: template: authentik/charts/serviceAccount/templates/service-account.yaml:4:11: executing "authentik/charts/serviceAccount/templates/service-account.yaml" at <include "authentik-remote-cluster.fullname" .>: error calling include: template: authentik/charts/serviceAccount/templates/_helpers.tpl:14:17: executing "authentik-remote-cluster.fullname" at <.Chart.IsRoot>: can't evaluate field IsRoot in type interface {}

# Source: authentik/charts/serviceAccount/templates/service-account.yaml
kind: ServiceAccount
metadata:
  name: release-name

# Source: authentik/templates/worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: release-name-authentik-worker
.......
    spec:
      serviceAccountName: release-name-authentik

        # your server name goes here
        KUBE_API=https://localhost:8443
        SERVICE_ACCOUNT=svr-authentik-authentik-remote-cluster

        KUBE_CA=$(kubectl config view --minify --raw --output 'jsonpath={..cluster.certificate-authority-data}')
        KUBE_TOKEN=$(kubectl create token $SERVICE_ACCOUNT )

        echo "apiVersion: v1
        kind: Config
        clusters:
        - name: default-cluster
        cluster:
            certificate-authority-data: ${KUBE_CA}
            server: ${KUBE_API}
        contexts:
        - name: default-context
        context:
            cluster: default-cluster
            namespace: default
            user: authentik-user
        current-context: default-context
        users:
        - name: authentik-user
        user:
            token: ${KUBE_TOKEN}" 

helm:
      values: |
        authentik:
        envFrom:
        - secretRef:
            name: authentik-secrets

spec:
      containers:
        - args:
            - server
          env: null
          envFrom:
            - secretRef:
                name: authentik-secrets

{"event": "PostgreSQL connection failed, retrying... (could not connect to server: Connection refused\n\tIs the server running on host \"localhost\" (::1) and accepting\n\tTCP/IP connections on port 5432?\ncould not connect to server: Connection refused\n\tIs the server running on host \"localhost\" (127.0.0.1) and accepting\n\tTCP/IP connections on port 5432?\n)", "level": "info", "logger": "__main__", "timestamp": 1648550029.4643047}``

So it strikes me as a ending up in a very 'default' state. 

Is there an examples of using secrets along with the default config?. I could possibly retype it all in env, but there should be a way to just specify the key as a secret and use the sane defaults for the rest.

{"event": "Task published", "level": "info", "logger": "authentik.root.celery", "pid": 90, "task_id": "6d0b5841-aaa1-4706-918d-35a315e1eb7a", "task_name": "authentik.blueprints.v1.tasks.clear_failed_blueprints", "timestamp": "2023-02-20T20:47:51.000522"}
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/manage.py", line 31, in <module>
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 446, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 440, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 402, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 448, in execute
    output = self.handle(*args, **options)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 96, in wrapped
    res = handle_func(*args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/stages/email/management/commands/test_email.py", line 37, in handle
    send_mail(message.__dict__, stage.pk)
  File "/usr/local/lib/python3.11/site-packages/celery/local.py", line 188, in __call__
    return self._get_current_object()(*a, **kw)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/celery/app/task.py", line 392, in __call__
    return self.run(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/celery/app/autoretry.py", line 54, in run
    ret = task.retry(exc=exc, **retry_kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/celery/app/task.py", line 701, in retry
    raise_with_context(exc or Retry('Task can be retried', None))
  File "/usr/local/lib/python3.11/site-packages/celery/app/autoretry.py", line 34, in run
    return task._orig_run(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/stages/email/tasks.py", line 103, in send_mail
    raise exc
  File "/authentik/stages/email/tasks.py", line 73, in send_mail
    backend.open()
  File "/usr/local/lib/python3.11/site-packages/django/core/mail/backends/smtp.py", line 91, in open
    self.connection.login(self.username, self.password)
  File "/usr/local/lib/python3.11/smtplib.py", line 739, in login
    (code, resp) = self.auth(
                   ^^^^^^^^^^
  File "/usr/local/lib/python3.11/smtplib.py", line 642, in auth
    (code, resp) = self.docmd("AUTH", mechanism + " " + response)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/smtplib.py", line 432, in docmd
    return self.getreply()
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/smtplib.py", line 405, in getreply
    raise SMTPServerDisconnected("Connection unexpectedly closed")
smtplib.SMTPServerDisconnected: Connection unexpectedly closed

authentik:
    # -- Secret key used for cookie singing and unique user IDs,
    # don't change this after the first install
    # pulled in from secrets
    secret_key: ""
    # -- Mode for the avatars. Defaults to gravatar. Possible options 'gravatar' and 'none'
    avatars: none
    email:
      # -- SMTP Server emails are sent from, fully optional
      host: "smtp.sendgrid.net"
      port: 587
      # -- SMTP credentials, when left empty, not authentication will be done
      username: "apikey"
      # -- SMTP credentials, when left empty, no authentication will be done (can use ENVFrom)
      password: "" # <-- This is where I suspect the error is
      # -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
      use_tls: true
      # -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
      use_ssl: false
      # -- Connection timeout
      timeout: 30
      # -- Email from address, can either be in the format "[email protected]" or "authentik <[email protected]>"
      from: "[email protected]"
    outposts:
      # -- Template used for managed outposts. The following placeholders can be used
      # %(type)s - the type of the outpost
      # %(version)s - version of your authentik install
      # %(build_hash)s - only for beta versions, the build hash of the image
      container_image_base: ghcr.io/goauthentik/%(type)s:%(version)s
    error_reporting:
      # -- This sends anonymous usage-data, stack traces on errors and
      # performance data to sentry.beryju.org, and is fully opt-in
      enabled: false
      # -- This is a string that is sent to sentry with your error reports
      environment: "k3s"
    postgresql:
      port: 5432
    redis:
      # -- set the redis hostname to talk to
      # @default -- `{{ .Release.Name }}-redis-master`
      host: '{{ .Release.Name }}-redis-master'

  envValueFrom:
    AUTHENTIK_SECRET_KEY:
      secretKeyRef:
        name: authentik-secrets
        key: secret-key
    AUTHENTIK_POSTGRESQL__PASSWORD:
      secretKeyRef:
        name: authentik-postgresql
        key: postgresql-password
    AUTHENTIK_EMAIL__PASSWORD:
      secretKeyRef:
        name: authentik-secrets
        key: email-password

project: default
source:
  repoURL: '[email protected]:<censored>'
  path: apps
  targetRevision: HEAD
  directory:
    recurse: true
    jsonnet: {}
destination:
  server: 'https://kubernetes.default.svc'
  namespace: argocd
syncPolicy:
  automated:
    prune: true
    selfHeal: true
  syncOptions:
    - CreateNamespace=true
    - Validate=true
    - PruneLast=true
    - RespectIgnoreDifferences=false
    - ApplyOutOfSyncOnly=false
    - ServerSideApply=true
    - Replace=false
  retry:
    limit: 3
    backoff:
      duration: 60s
      factor: 2
      maxDuration: 3m0s

apiVersion: v2
name: goauthentik
description: An Umbrella Helm chart
type: application
version: 0.1.0
appVersion: "1.0"

dependencies:
- name: authentik
  version: 2023.*
  repository: https://charts.goauthentik.io/

apiVersion: v1
kind: Namespace
metadata:
  name: authentik
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  destination:
    name: ''
    namespace: authentik
    server: 'https://kubernetes.default.svc'
  source:
    path: apps/authentik
    repoURL: '[email protected]:<censored>'
    targetRevision: HEAD
    helm:
      valueFiles:
      - values.yaml
  sources: []
  project: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground

replicas: 1
priorityClassName:
securityContext: {}

worker:
  replicas: 1
  priorityClassName:
  securityContext: {}

image:
  repository: ghcr.io/goauthentik/server
  digest: ""
  pullPolicy: IfNotPresent
  pullSecrets: []

initContainers: {}

additionalContainers: {}

ingress:
  enabled: false
  ingressClassName: "traefik-ingress"
  annotations: {
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  }
  labels: {}
  hosts:
    - host: <censored my domain>
      paths:
        - path: "/"
          pathType: Prefix
  tls: []

annotations: {}

podAnnotations: {}

authentik:
  log_level: error
  secret_key: "<censored some value>"
  geoip: /geoip/GeoLite2-City.mmdb
  email:
    host: ""
    port: 587
    username: ""
    password: ""
    use_tls: false
    use_ssl: false
    timeout: 30
    from: ""
  outposts:
    container_image_base: ghcr.io/goauthentik/%(type)s:%(version)s
  error_reporting:
    enabled: false
    environment: "k8s"
    send_pii: false
  redis:
    host: "{{ .Release.Name }}-redis-master"
    password: ""
  geoip:
    enabled: false

blueprints: []

#secret to avoid add information about DB
envFrom:
  - secretRef:
       name: authentik-secret

envValueFrom: {}

service:
  enabled: true
  type: ClusterIP
  port: 80
  name: http
  protocol: TCP
  labels: {}
  annotations: {}

volumes: []

volumeMounts: []

affinity: {}

tolerations: []

nodeSelector: {}

resources:
  server: {}
  worker: {}

autoscaling:
  server:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 50
  worker:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80

livenessProbe:
  enabled: true
  httpGet:
    path: /-/health/live/
    port: http
  initialDelaySeconds: 5
  periodSeconds: 10

startupProbe:
  enabled: true
  httpGet:
    path: /-/health/live/
    port: http
  failureThreshold: 60
  periodSeconds: 5

readinessProbe:
  enabled: true
  httpGet:
    path: /-/health/ready/
    port: http
  periodSeconds: 10

serviceAccount:
  create: true
  annotations: {}
  serviceAccountSecret:
    enabled: false

prometheus:
  serviceMonitor:
    create: false
    interval: 30s
    scrapeTimeout: 3s
    labels: {}
  rules:
    create: false
    labels: {}

postgresql:
  enabled: false

redis:
  enabled: true

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: authentik-secret
  namespace: authentik
spec:
  encryptedData:
    AUTHENTIK_POSTGRESQL__HOST: <censored>
    AUTHENTIK_POSTGRESQL__NAME: <censored>
    AUTHENTIK_POSTGRESQL__PASSWORD: <censored>
    AUTHENTIK_POSTGRESQL__USER: <censored>
    AUTHENTIK_SECRET_KEY: <censored>
  template:
    metadata:
      creationTimestamp: null
      name: authentik-secret
      namespace: authentik
    type: stringData
---

{"event": "Loaded config", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1698178364.4328628, "file": "/authentik/lib/default.yml"}

{"event": "Loaded environment variables", "level": "debug", "logger": "authentik.lib.config", "timestamp": 1698178364.4334147, "count": 28}

{"event": "Starting authentik bootstrap", "level": "info", "logger": "authentik.lib.config", "timestamp": 1698178364.4335992}

{"event": "----------------------------------------------------------------------", "level": "info", "logger": "authentik.lib.config", "timestamp": 1698178364.4336236}

{"event": "Secret key missing, check https://goauthentik.io/docs/installation/.", "level": "info", "logger": "authentik.lib.config", "timestamp": 1698178364.433638}

{"event": "----------------------------------------------------------------------", "level": "info", "logger": "authentik.lib.config", "timestamp": 1698178364.4336486}

env:
  AUTHENTIK_POSTGRESQL_HOSTNANE: [redacted]
  AUTHENTIK_POSTGRESQL__NAME: [redacted]

Events:
  Type     Reason                   Age                   From     Message
  ----     ------                   ----                  ----     -------
  Warning  SystemOOM                33m                   kubelet  System OOM encountered, victim process: celery, pid: 3602044
  Warning  SystemOOM                30m                   kubelet  System OOM encountered, victim process: celery, pid: 3603940
  Warning  SystemOOM                21m                   kubelet  System OOM encountered, victim process: celery, pid: 3612872
  Normal   NodeHasSufficientPID     21m (x40 over 16h)    kubelet  Node k8s-worker3 status is now: NodeHasSufficientPID
  Normal   NodeReady                21m (x40 over 16h)    kubelet  Node k8s-worker3 status is now: NodeReady
  Warning  SystemOOM                6m28s                 kubelet  System OOM encountered, victim process: celery, pid: 3632477

{"event": "Redis Connection failed, retrying... (Error 111 connecting to None:6379. Connection refused.)", "level": "info", "logger": "__main__", "timestamp": 1637770878.299152}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: RELEASE-NAME-authentik-worker
  labels:
    helm.sh/chart: authentik-1.0.0-RC5
    app.kubernetes.io/name: authentik
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/version: "2021.4.5"
    app.kubernetes.io/managed-by: Helm
...

apiVersion: apps/v1
kind: Deployment
metadata:
  name: RELEASE-NAME-authentik-server
  labels:
    helm.sh/chart: authentik-1.0.0-RC5
    app.kubernetes.io/name: authentik
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/version: "2021.4.5"
    app.kubernetes.io/managed-by: Helm

apiVersion: v1
kind: Service
...
  labels:
    helm.sh/chart: authentik-1.0.0-RC5
    app.kubernetes.io/name: authentik
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/version: "2021.4.5"
    app.kubernetes.io/managed-by: Helm

project: default
source:
  repoURL: '[email protected]:<censored>'
  path: apps
  targetRevision: HEAD
  directory:
    recurse: true
    jsonnet: {}
destination:
  server: 'https://kubernetes.default.svc'
  namespace: argocd
syncPolicy:
  automated:
    prune: true
    selfHeal: true
  syncOptions:
    - CreateNamespace=true
    - Validate=true
    - PruneLast=true
    - RespectIgnoreDifferences=false
    - ApplyOutOfSyncOnly=false
    - ServerSideApply=true
    - Replace=false
  retry:
    limit: 3
    backoff:
      duration: 60s
      factor: 2
      maxDuration: 3m0s

apiVersion: v2
name: goauthentik
description: An Umbrella Helm chart
type: application
version: 0.1.0
appVersion: "1.0"

dependencies:
- name: authentik
  version: 2023.*
  repository: https://charts.goauthentik.io/

apiVersion: v1
kind: Namespace
metadata:
  name: authentik
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  destination:
    name: ''
    namespace: authentik
    server: 'https://kubernetes.default.svc'
  source:
    path: apps/authentik
    repoURL: '[email protected]:<censored>'
    targetRevision: HEAD
    helm:
      valueFiles:
      - values.yaml
  sources: []
  project: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground

replicas: 1
priorityClassName:
securityContext: {}

worker:
  replicas: 1
  priorityClassName:
  securityContext: {}

image:
  repository: ghcr.io/goauthentik/server
  digest: ""
  pullPolicy: IfNotPresent
  pullSecrets: []

initContainers: {}

additionalContainers: {}

ingress:
  enabled: false
  ingressClassName: "traefik-ingress"
  annotations: {
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  }
  labels: {}
  hosts:
    - host: <censored my domain>
      paths:
        - path: "/"
          pathType: Prefix
  tls: []

annotations: {}

podAnnotations: {}

authentik:
  log_level: error
  secret_key: "<censored some value>"
  geoip: /geoip/GeoLite2-City.mmdb
  email:
    host: ""
    port: 587
    username: ""
    password: ""
    use_tls: false
    use_ssl: false
    timeout: 30
    from: ""
  outposts:
    container_image_base: ghcr.io/goauthentik/%(type)s:%(version)s
  error_reporting:
    enabled: false
    environment: "k8s"
    send_pii: false
  redis:
    host: "{{ .Release.Name }}-redis-master"
    password: ""

blueprints: []

#secret to avoid add information about DB
envFrom:
  - secretRef:
       name: authentik-secret

envValueFrom: {}

service:
  enabled: true
  type: ClusterIP
  port: 80
  name: http
  protocol: TCP
  labels: {}
  annotations: {}

volumes: []

volumeMounts: []

affinity: {}

tolerations: []

nodeSelector: {}

resources:
  server: {}
  worker: {}

autoscaling:
  server:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 50
  worker:
    enabled: false
    minReplicas: 1
    maxReplicas: 5
    targetCPUUtilizationPercentage: 80

livenessProbe:
  enabled: true
  httpGet:
    path: /-/health/live/
    port: http
  initialDelaySeconds: 5
  periodSeconds: 10

startupProbe:
  enabled: true
  httpGet:
    path: /-/health/live/
    port: http
  failureThreshold: 60
  periodSeconds: 5

readinessProbe:
  enabled: true
  httpGet:
    path: /-/health/ready/
    port: http
  periodSeconds: 10

serviceAccount:
  create: true
  annotations: {}
  serviceAccountSecret:
    enabled: false

geoip:
  enabled: false

prometheus:
  serviceMonitor:
    create: false
    interval: 30s
    scrapeTimeout: 3s
    labels: {}
  rules:
    create: false
    labels: {}

postgresql:
  enabled: false

redis:
  enabled: true

ComparisonError: Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): `helm template . --name-template authentik --namespace authentik --kube-version 1.27 --values <path to cached source>/apps/authentik/values.yaml --api-versions admissionregistration.k8s.io/v1 --api-versions admissionregistration.k8s.io/v1/MutatingWebhookConfiguration --api-versions admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration --api-versions apiextensions.k8s.io/v1 --api-versions apiextensions.k8s.io/v1/CustomResourceDefinition --api-versions apiregistration.k8s.io/v1 --api-versions apiregistration.k8s.io/v1/APIService --api-versions apps/v1 --api-versions apps/v1/ControllerRevision --api-versions apps/v1/DaemonSet --api-versions apps/v1/Deployment --api-versions apps/v1/ReplicaSet --api-versions apps/v1/StatefulSet --api-versions argoproj.io/v1alpha1 --api-versions argoproj.io/v1alpha1/AppProject --api-versions argoproj.io/v1alpha1/Application --api-versions argoproj.io/v1alpha1/ApplicationSet --api-versions autoscaling/v1 --api-versions autoscaling/v1/HorizontalPodAutoscaler --api-versions autoscaling/v2 --api-versions autoscaling/v2/HorizontalPodAutoscaler --api-versions batch/v1 --api-versions batch/v1/CronJob --api-versions batch/v1/Job --api-versions bitnami.com/v1alpha1 --api-versions bitnami.com/v1alpha1/SealedSecret --api-versions certificates.k8s.io/v1 --api-versions certificates.k8s.io/v1/CertificateSigningRequest --api-versions coordination.k8s.io/v1 --api-versions coordination.k8s.io/v1/Lease --api-versions discovery.k8s.io/v1 --api-versions discovery.k8s.io/v1/EndpointSlice --api-versions events.k8s.io/v1 --api-versions events.k8s.io/v1/Event --api-versions flowcontrol.apiserver.k8s.io/v1beta2 --api-versions flowcontrol.apiserver.k8s.io/v1beta2/FlowSchema --api-versions flowcontrol.apiserver.k8s.io/v1beta2/PriorityLevelConfiguration --api-versions flowcontrol.apiserver.k8s.io/v1beta3 --api-versions flowcontrol.apiserver.k8s.io/v1beta3/FlowSchema --api-versions flowcontrol.apiserver.k8s.io/v1beta3/PriorityLevelConfiguration --api-versions helm.cattle.io/v1 --api-versions helm.cattle.io/v1/HelmChart --api-versions helm.cattle.io/v1/HelmChartConfig --api-versions k3s.cattle.io/v1 --api-versions k3s.cattle.io/v1/Addon --api-versions longhorn.io/v1beta1 --api-versions longhorn.io/v1beta1/BackingImage --api-versions longhorn.io/v1beta1/BackingImageDataSource --api-versions longhorn.io/v1beta1/BackingImageManager --api-versions longhorn.io/v1beta1/Backup --api-versions longhorn.io/v1beta1/BackupTarget --api-versions longhorn.io/v1beta1/BackupVolume --api-versions longhorn.io/v1beta1/Engine --api-versions longhorn.io/v1beta1/EngineImage --api-versions longhorn.io/v1beta1/InstanceManager --api-versions longhorn.io/v1beta1/Node --api-versions longhorn.io/v1beta1/RecurringJob --api-versions longhorn.io/v1beta1/Replica --api-versions longhorn.io/v1beta1/Setting --api-versions longhorn.io/v1beta1/ShareManager --api-versions longhorn.io/v1beta1/Volume --api-versions longhorn.io/v1beta2 --api-versions longhorn.io/v1beta2/BackingImage --api-versions longhorn.io/v1beta2/BackingImageDataSource --api-versions longhorn.io/v1beta2/BackingImageManager --api-versions longhorn.io/v1beta2/Backup --api-versions longhorn.io/v1beta2/BackupTarget --api-versions longhorn.io/v1beta2/BackupVolume --api-versions longhorn.io/v1beta2/Engine --api-versions longhorn.io/v1beta2/EngineImage --api-versions longhorn.io/v1beta2/InstanceManager --api-versions longhorn.io/v1beta2/Node --api-versions longhorn.io/v1beta2/Orphan --api-versions longhorn.io/v1beta2/RecurringJob --api-versions longhorn.io/v1beta2/Replica --api-versions longhorn.io/v1beta2/Setting --api-versions longhorn.io/v1beta2/ShareManager --api-versions longhorn.io/v1beta2/Snapshot --api-versions longhorn.io/v1beta2/SupportBundle --api-versions longhorn.io/v1beta2/SystemBackup --api-versions longhorn.io/v1beta2/SystemRestore --api-versions longhorn.io/v1beta2/Volume --api-versions longhorn.io/v1beta2/VolumeAttachment --api-versions metallb.io/v1alpha1 --api-versions metallb.io/v1alpha1/AddressPool --api-versions metallb.io/v1beta1 --api-versions metallb.io/v1beta1/AddressPool --api-versions metallb.io/v1beta1/BFDProfile --api-versions metallb.io/v1beta1/BGPAdvertisement --api-versions metallb.io/v1beta1/BGPPeer --api-versions metallb.io/v1beta1/Community --api-versions metallb.io/v1beta1/IPAddressPool --api-versions metallb.io/v1beta1/L2Advertisement --api-versions metallb.io/v1beta2 --api-versions metallb.io/v1beta2/BGPPeer --api-versions networking.k8s.io/v1 --api-versions networking.k8s.io/v1/Ingress --api-versions networking.k8s.io/v1/IngressClass --api-versions networking.k8s.io/v1/NetworkPolicy --api-versions node.k8s.io/v1 --api-versions node.k8s.io/v1/RuntimeClass --api-versions policy/v1 --api-versions policy/v1/PodDisruptionBudget --api-versions postgresql.cnpg.io/v1 --api-versions postgresql.cnpg.io/v1/Backup --api-versions postgresql.cnpg.io/v1/Cluster --api-versions postgresql.cnpg.io/v1/Pooler --api-versions postgresql.cnpg.io/v1/ScheduledBackup --api-versions rbac.authorization.k8s.io/v1 --api-versions rbac.authorization.k8s.io/v1/ClusterRole --api-versions rbac.authorization.k8s.io/v1/ClusterRoleBinding --api-versions rbac.authorization.k8s.io/v1/Role --api-versions rbac.authorization.k8s.io/v1/RoleBinding --api-versions scheduling.k8s.io/v1 --api-versions scheduling.k8s.io/v1/PriorityClass --api-versions storage.k8s.io/v1 --api-versions storage.k8s.io/v1/CSIDriver --api-versions storage.k8s.io/v1/CSINode --api-versions storage.k8s.io/v1/CSIStorageCapacity --api-versions storage.k8s.io/v1/StorageClass --api-versions storage.k8s.io/v1/VolumeAttachment --api-versions traefik.containo.us/v1alpha1 --api-versions traefik.containo.us/v1alpha1/IngressRoute --api-versions traefik.containo.us/v1alpha1/IngressRouteTCP --api-versions traefik.containo.us/v1alpha1/IngressRouteUDP --api-versions traefik.containo.us/v1alpha1/Middleware --api-versions traefik.containo.us/v1alpha1/MiddlewareTCP --api-versions traefik.containo.us/v1alpha1/ServersTransport --api-versions traefik.containo.us/v1alpha1/TLSOption --api-versions traefik.containo.us/v1alpha1/TLSStore --api-versions traefik.containo.us/v1alpha1/TraefikService --api-versions traefik.io/v1alpha1 --api-versions traefik.io/v1alpha1/IngressRoute --api-versions traefik.io/v1alpha1/IngressRouteTCP --api-versions traefik.io/v1alpha1/IngressRouteUDP --api-versions traefik.io/v1alpha1/Middleware --api-versions traefik.io/v1alpha1/MiddlewareTCP --api-versions traefik.io/v1alpha1/ServersTransport --api-versions traefik.io/v1alpha1/ServersTransportTCP --api-versions traefik.io/v1alpha1/TLSOption --api-versions traefik.io/v1alpha1/TLSStore --api-versions traefik.io/v1alpha1/TraefikService --api-versions v1 --api-versions v1/ConfigMap --api-versions v1/Endpoints --api-versions v1/Event --api-versions v1/LimitRange --api-versions v1/Namespace --api-versions v1/Node --api-versions v1/PersistentVolume --api-versions v1/PersistentVolumeClaim --api-versions v1/Pod --api-versions v1/PodTemplate --api-versions v1/ReplicationController --api-versions v1/ResourceQuota --api-versions v1/Secret --api-versions v1/Service --api-versions v1/ServiceAccount --include-crds` failed exit status 1: Error: template: goauthentik/charts/authentik/templates/worker-deployment.yaml:28:43: executing "goauthentik/charts/authentik/templates/worker-deployment.yaml" at <include (print $.Template.BasePath "/secret.yaml") .>: error calling include: template: goauthentik/charts/authentik/templates/secret.yaml:13:10: executing "goauthentik/charts/authentik/templates/secret.yaml" at <$.Values.geoip.enabled>: can't evaluate field enabled in type interface {} Use --debug flag to render out invalid YAML

<include (print $.Template.BasePath "/secret.yaml") .>: error calling include: template: goauthentik/charts/authentik/templates/secret.yaml:13:10: executing "goauthentik/charts/authentik/templates/secret.yaml" at <$.Values.geoip.enabled>: can't evaluate field enabled in type interface {} Use --debug flag to render out invalid YAML

# -- Additional API resources to deploy
additionalObjects: []

{{- range .Values.additionalObjects }}
---
{{ toYaml . }}
{{- end }}

envValueFrom: {}
#  AUTHENTIK_VAR_NAME:
#    secretKeyRef:
#      key: password
#      name: my-secret

  postgresql:
    enabled: true
    postgresqlPassword: "7ucC2kxRgHbr9oh7KdYyxb3I"
    primary:
      persistence:
        existingClaim: authentik-pvc

image:
  tag: 2021.8.3

Helm upgrade failed: template: authentik/templates/worker-deployment.yaml:28:43: executing "authentik/templates/worker-deployment.yaml" at <include (print $.Template.BasePath "/secret.yaml") .>: error calling include: template: authentik/templates/secret.yaml:14:93: executing "authentik/templates/secret.yaml" at <b64enc>: wrong type for value; expected string; got float64 Last Helm logs: preparing upgrade for authentik resetting values to the chart's original version