Initial commit

2026-08-20 23:16:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,177 @@
+# Authentik configuration
+authentik:
+  secret_key: env://AUTHENTIK_SECRET_KEY
+  postgresql:
+    host: env://AUTHENTIK_POSTGRESQL__HOST
+    port: 5432
+    name: env://AUTHENTIK_POSTGRESQL__NAME
+    user: env://AUTHENTIK_POSTGRESQL__USER
+    password: env://AUTHENTIK_POSTGRESQL__PASSWORD
+
+global:
+  envFrom:
+    # First secret: Authentik-specific settings (AUTHENTIK_SECRET_KEY)
+    - secretRef:
+        name: authentik
+    # Second secret: Database credentials from CNPG
+    - secretRef:
+        name: pg-authentik-app
+      prefix: AUTHENTIK_POSTGRESQL__
+  env:
+    # Configure external URL for proper OIDC discovery responses
+    - name: AUTHENTIK_URL
+      value: "https://auth.kube.huskypup.net"
+    # Override to use the correct field names from pg-authentik-app
+    - name: AUTHENTIK_POSTGRESQL__HOST
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: host
+    - name: AUTHENTIK_POSTGRESQL__NAME
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: dbname
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: password
+    - name: AUTHENTIK_POSTGRESQL__PORT
+      value: "5432"
+
+# Blueprints - Mount ConfigMaps for auto-discovery
+blueprints:
+  configMaps:
+    - authentik-blueprints-gitlab
+    - authentik-blueprints-nextcloud
+    - authentik-blueprints-argocd
+    - authentik-blueprints-grafana
+    - authentik-blueprints-forward-auth
+    - authentik-blueprints-prometheus
+    - authentik-blueprints-n8n
+    - authentik-blueprints-ceph
+    - authentik-blueprints-home-assistant
+    - authentik-blueprints-guacamole
+    - authentik-blueprints-percona-everest
+    - authentik-blueprints-rancher
+    - authentik-blueprints-netbird
+
+# Enable Prometheus metrics
+server:
+  # Single replica required: the embedded outpost stores forward-auth sessions
+  # in-memory (no Redis). Multiple replicas cause callback failures because
+  # the session created during ext_authz check is only on one pod.
+  replicas: 1
+
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: prometheus
+  
+  # Resource limits to prevent OOM
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  
+  # Health probes - removed invalid 'enabled' fields
+  startupProbe:
+    initialDelaySeconds: 10
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 24  # 120 seconds for Authentik startup
+
+  readinessProbe:
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 2
+
+  livenessProbe:
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  
+  # Spread across nodes
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: server
+          topologyKey: kubernetes.io/hostname
+
+worker:
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: prometheus
+  
+  # Resource limits to prevent OOM
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  
+  # Spread across nodes
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: worker
+          topologyKey: kubernetes.io/hostname
+
+  # Mount cert-manager secret for auto-import of Let's Encrypt cert
+  volumeMounts:
+    - name: certs
+      mountPath: /certs
+      readOnly: true
+  volumes:
+    - name: certs
+      secret:
+        secretName: authentik-tls
+        optional: true
+
+# Disable bundled Postgres
+postgresql:
+  enabled: false