Initial commit

infrastructure/authentik/manifests/presync-job.yaml

@@ -0,0 +1,48 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: authentik-presync
+  namespace: authentik
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: presync
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Authentik PreSync ==="
+
+              # Wait for CNPG cluster to be ready (applied by ArgoCD as sync-wave resource)
+              echo "Waiting for Authentik PostgreSQL cluster..."
+              for i in $(seq 1 60); do
+                PHASE=$(kubectl -n authentik get clusters.postgresql.cnpg.io pg-authentik -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
+                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
+                  echo "  PostgreSQL cluster ready"
+                  break
+                fi
+                echo "  waiting for pg-authentik... (attempt $i/60, phase=$PHASE)"
+                sleep 5
+              done
+
+              # Generate Authentik secret key if it doesn't exist
+              if ! kubectl -n authentik get secret authentik >/dev/null 2>&1; then
+                echo "Generating Authentik secret key..."
+                SECRET_KEY=$(openssl rand -hex 50)
+                kubectl -n authentik create secret generic authentik \
+                  --from-literal=AUTHENTIK_SECRET_KEY="$SECRET_KEY"
+                echo "  Authentik secret key generated"
+              else
+                echo "  Authentik secret already exists"
+              fi
+
+              echo "=== Authentik PreSync Complete ==="
+      restartPolicy: Never