root: v0.4.0

0.4.0 (2026-09-05)

⚠ BREAKING CHANGES

• authup: Authup beta.64 changes CLI arguments, configuration paths, console topology, and several values. See charts/authup/BREAKING.md for migration steps.

Features

• authup: support the beta.64 runtime topology (#29) (226f784)

authup-0.4.0

authup-0.4.0 is the chart release for Authup v1.0.0-beta.64, the Authup release that turns one server process into a family of roles behind one binary. It covers everything since authup-0.3.0.

📣 Some News

The chart now deploys Authup beta.64

Authup beta.64 retired the server/core plus client/admin-console process pair, moved the consoles under /console/*, and replaced the .conf file family with one authup.yml. Chart 0.3.x cannot run that image: its admin-console workload starts a process that no longer exists, and it mounts the configuration file where beta.64 does not look. Chart 0.4.0 moves the CLI, the configuration paths and the console topology together, which is why it is a breaking release.

The default install stays what it was: one Deployment, one hostname, a built-in PostgreSQL. Everything else in this release is optional and off by default.

📖 Authup v1.0.0-beta.64 release notes

👀 Highlights

🧭 One image, explicit roles

The container command is now the Authup CLI's own argument list, and the chart runs one role per workload:

Workload	Container args	Port
server (default)	start	3000
server with server.splitConsoles=true	start core	3000
authConsole / adminConsole / accountConsole (split mode)	start console auth / admin / account	3020 / 3021 / 3022
worker	start worker	none
migration Job	migration run	none

Every role uses the same authup/authup image, and image.tag defaults to the chart's appVersion, 1.0.0-beta.64.

Warning

Remove any server.args or adminConsole.args override that still carries server/core or client/admin-console. The admin console is no longer a process of its own, and beta.64 accepts the server/core prefix only with a deprecation notice until it is removed in 1.0.0.

📖 Docker

🏠 One combined server, one hostname

adminConsole.enabled=true no longer creates a second Deployment with its own hostname. The default server serves the API, the auth pages and both consoles from one listener, so every browser-facing surface shares server.publicUrl. The second-origin wiring is gone with it: adminConsole.publicUrl, adminConsole.apiUrl, adminConsole.internalApiUrl and server.trustedOriginsAppendAdminConsole are removed, and the strict schema rejects them.

 server:
ingress:
enabled: true
hostname: auth.example.com
tls: true
-adminConsole:- ingress:- enabled: true- hostname: authup.example.com- tls: true

The admin console now answers at https://auth.example.com/console/admin and the account console at https://auth.example.com/console/account. adminConsole.enabled and accountConsole.enabled still switch those surfaces off through ADMIN_CONSOLE_ENABLED and ACCOUNT_CONSOLE_ENABLED; the auth pages stay because they own the login flow.

Warning

On upgrade Helm deletes the old -admin-console Deployment, Service and Ingress, and the second hostname stops serving. Authup serves no redirect from /admin and /account, so update bookmarks, reverse-proxy rules and anything that links to the consoles.

📖 Typical production values

🔀 Split consoles on one origin

server.splitConsoles=true turns the server into an API-only start core set and adds one Deployment per console. The consoles live under fixed prefixes on the same origin, so PUBLIC_URL does not change:

server:
publicUrl: https://auth.example.comsplitConsoles: trueingress:
enabled: truehostname: auth.example.comtls: trueauthConsole:
ingress:
enabled: trueadminConsole:
enabled: trueingress:
enabled: trueaccountConsole:
enabled: trueingress:
enabled: true

What this renders:

• The server Ingress keeps / and the four exact cookie-login paths (/console/admin/login/start, /console/admin/callback and the account pair) on the API, because those are still API routes: the pending-login cookie is issued and read back by the same service.
• One Ingress per console strips /console/<name> with an ingress-nginx regex rewrite. With route.enabled instead, one HTTPRoute per console does the same with a portable URLRewrite filter.
• Every console pod gets INTERNAL_URL pointing at the server Service on port 3000, so server-side console calls stay in the cluster instead of leaving through the public Ingress.

Console pods carry no Secret and open no database or cache connection. Scale them with replicaCount or the per-role HPA.

Note

The auth console cannot be disabled in split mode because it owns login; admin and account stay optional. The generated console Ingress resources need ingress-nginx, so on another controller use the HTTPRoutes or write your own rules. server.publicUrl must sit at the origin root, and a console Ingress or HTTPRoute requires the matching server resource so the API-owned paths cannot disappear.

📖 Console Replicas

⚙️ A dedicated background worker

worker.enabled=true adds a Deployment running start worker. It sets WORKER_ENABLED=true on the worker and WORKER_ENABLED=false on the server pods, so API replicas only serve requests and exactly one process owns the background sweeps.

server:
migration:
enabled: trueworker:
enabled: true

The worker has no listener, no Service and no HTTP probe. It receives the database and Redis credentials, but no SMTP, bootstrap identity or console secrets, and it never runs migrations.

Tip

Pair it with server.migration.enabled=true. The worker restarts until the schema exists, so on upgrades the pre-upgrade Job should own the migration before either role rolls.

📖 Worker

📄 authup.yml at /etc/authup

The chart follows the beta.64 filesystem layout. server.configuration is now the content of authup.yml, mounted at /etc/authup/authup.yml, and its sections sit at the document root (core:, adminConsole:, accountConsole:, authConsole:). Provisioning files mount at /etc/authup/provisioning and file logs go to /var/log/authup; the chart sets PROVISIONING_DIRECTORY_PATH and LOG_DIRECTORY_PATH accordingly.

server:
configuration: | core: middlewarePrometheus: false

Warning

There is no chart-managed writable root any more. server.config.WRITABLE_DIRECTORY_PATH fails the render, and an extraVolumeMounts entry aimed at /var/lib/authup or an authup.server.core.conf file is no longer read by Authup.

📖 Configuration

🛡️ Network policies and migration ownership follow the roles

With server.networkPolicy.enabled=true the chart used to select only the server pods. In a default-deny namespace the pre-upgrade migration Job therefore had no egress at all: it could neither resolve nor reach the database and hung until Helm's timeout (#22). The chart now renders a hook-scoped policy for the migration component at hook weight -5 (sync wave -5 under useHelmHooks=false), so it exists before the Job runs at weight 0. Split consoles and the worker get role-specific policies through their own networkPolicy.enabled: consoles may reach the server, the worker and the Job get DNS plus the release-local database and cache, and server.networkPolicy.extraEgress applies to the Job policy as well.

server:
migration:
enabled: truenetworkPolicy:
enabled: trueallowExternalEgress: falseextraEgress:
# an external database sits outside the release: open it explicitly
- to:
- ipBlock:
cidr: 10.20.0.0/24ports:
- port: 5432protocol: TCP

Migration ownership is explicit on the server side too. When the Job is enabled and the database persists through the rollout, upgrades set MIGRATION_ENABLED=false on the server pods, so the Job is the only DDL owner. Fresh installs and non-persistent built-in databases still migrate at boot.

📖 GitOps / ArgoCD

⚠️ Heads-Up Before Upgrading

Change	What to do
The chart requires the Authup beta.64 CLI	Remove args overrides carrying server/core or client/admin-console; keep image.tag at the chart default or on a beta.64 image
One combined server by default; the admin-console workload is gone	Drop the second admin hostname and point users at <publicUrl>/console/admin and /console/account; set server.splitConsoles=true only if you want separate workloads
server.features.accountConsole moved	Set accountConsole.enabled; any non-empty old value fails the render
adminConsole.publicUrl, apiUrl, internalApiUrl, ingress.path, ingress.pathType, ingress.extraHosts, route.matches, route.filters and server.trustedOriginsAppendAdminConsole removed	Delete them; the schema rejects them, and every role shares server.publicUrl
authup.yml at /etc/authup, provisioning at /etc/authup/provisioning, logs at /var/log/authup	Rewrite server.configuration with root-level sections; drop WRITABLE_DIRECTORY_PATH, /var/lib/authup mounts and authup.server.core.conf
Consoles under /console/*, no redirect from the old paths	Update proxy rules, bookmarks and links; split mode needs server.publicUrl at the origin root and ingress-nginx for the generated Ingress

⬆️ Upgrading

helm repo update
helm upgrade authup authup/authup --version 0.4.0
# or via OC...

root: v0.3.0

0.3.0 (2026-08-24)

⚠ BREAKING CHANGES

• authup: the writable directory moves from /usr/src/app/writable to /var/lib/authup, and server.config.WRITABLE_DIRECTORY_PATH now fails the render instead of being honored. A server.extraVolumeMounts entry aimed at the old path no longer overlays the writable directory. Migration: charts/authup/BREAKING.md.

Features

• authup: writable directory moves to /var/lib/authup, and route.enabled accepts a template (#16) (52e42f3)

Bug Fixes

• authup: give the migration hook only what a hook can see, and scope useHelmHooks to ArgoCD (#20) (bddbb7f)

authup-0.3.0

Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-admin-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.

What's Changed

• feat(authup)!: writable directory moves to /var/lib/authup, and route.enabled accepts a template by @tada5hi in #16
• fix(authup): give the migration hook only what a hook can see, and scope useHelmHooks to ArgoCD by @tada5hi in #20
• chore: release master by @github-actions[bot] in #19

Full Changelog: authup-0.2.2...authup-0.3.0

root: v0.2.2

0.2.2 (2026-08-19)

Features

• authup: open the global schema node and let HTTPRoute rules carry matches/filters (#13) (a3ca5d5)

root: v0.2.1

0.2.1 (2026-08-19)

Features

• authup: track authup 1.0.0-beta.62 and compose theme.json from values (#8) (696ea13)

Bug Fixes

• let release-please own a root release so release PRs resume (3a8df19)

authup-0.2.2

Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-admin-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.

What's Changed

• feat(authup): open the global schema node and let HTTPRoute rules carry matches/filters by @tada5hi in #13
• chore: release master by @github-actions[bot] in #14

Full Changelog: authup-0.2.1...authup-0.2.2

authup-0.2.1

Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-admin-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.

What's Changed

• feat(authup): track authup 1.0.0-beta.62 and compose theme.json from values by @tada5hi in #8
• chore: release master by @github-actions[bot] in #10

Full Changelog: authup-0.2.0...authup-0.2.1

authup-0.2.0

Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-admin-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.

What's Changed

• Apache-2.0 relicense and chart icon by @tada5hi in #2
• ci: publish charts with hevi instead of chart-releaser-action by @tada5hi in #4
• refactor(authup)!: rename admin UI to client-admin-console (values: ui -> adminConsole) by @tada5hi in #3
• feat(authup): mount an operator console theme by @tada5hi in #5
• chore(master): release authup 0.2.0 by @github-actions[bot] in #1
• ci: add a dispatchable release and keep the README version in sync by @tada5hi in #7

New Contributors

• @tada5hi made their first contribution in #2
• @github-actions[bot] made their first contribution in #1

Full Changelog: authup-0.1.0...authup-0.2.0

authup-0.1.0

Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-web admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.

Full Changelog: https://github.com/authup/helm/commits/authup-0.1.0