mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
f98c997293
Vault's OIDC auth method needs to resolve auth.kube.huskypup.net (the issuer URL) from inside its own pod - no in-cluster DNS entry exists for that public hostname, so add a hostAlias pointing at the live istio-ingressgateway LoadBalancer IP (verified current: 172.28.101.244). authentik-blueprints-vault (vault-blueprint.yaml) was already applied to the cluster and referenced by the authentik Deployment for some time - committing it now so git matches the live, working state instead of leaving it as an untracked local file.
179 lines
4.4 KiB
YAML
179 lines
4.4 KiB
YAML
# Authentik configuration
|
|
authentik:
|
|
secret_key: env://AUTHENTIK_SECRET_KEY
|
|
postgresql:
|
|
host: env://AUTHENTIK_POSTGRESQL__HOST
|
|
port: 5432
|
|
name: env://AUTHENTIK_POSTGRESQL__NAME
|
|
user: env://AUTHENTIK_POSTGRESQL__USER
|
|
password: env://AUTHENTIK_POSTGRESQL__PASSWORD
|
|
|
|
global:
|
|
envFrom:
|
|
# First secret: Authentik-specific settings (AUTHENTIK_SECRET_KEY)
|
|
- secretRef:
|
|
name: authentik
|
|
# Second secret: Database credentials from CNPG
|
|
- secretRef:
|
|
name: pg-authentik-app
|
|
prefix: AUTHENTIK_POSTGRESQL__
|
|
env:
|
|
# Configure external URL for proper OIDC discovery responses
|
|
- name: AUTHENTIK_URL
|
|
value: "https://auth.kube.huskypup.net"
|
|
# Override to use the correct field names from pg-authentik-app
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: host
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: dbname
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: password
|
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
|
value: "5432"
|
|
|
|
# Blueprints - Mount ConfigMaps for auto-discovery
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints-gitlab
|
|
- authentik-blueprints-nextcloud
|
|
- authentik-blueprints-argocd
|
|
- authentik-blueprints-grafana
|
|
- authentik-blueprints-forward-auth
|
|
- authentik-blueprints-prometheus
|
|
- authentik-blueprints-n8n
|
|
- authentik-blueprints-ceph
|
|
- authentik-blueprints-home-assistant
|
|
- authentik-blueprints-guacamole
|
|
- authentik-blueprints-percona-everest
|
|
- authentik-blueprints-rancher
|
|
- authentik-blueprints-netbird
|
|
- authentik-blueprints-vault
|
|
|
|
# Enable Prometheus metrics
|
|
server:
|
|
# Single replica required: the embedded outpost stores forward-auth sessions
|
|
# in-memory (no Redis). Multiple replicas cause callback failures because
|
|
# the session created during ext_authz check is only on one pod.
|
|
replicas: 1
|
|
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
labels:
|
|
release: prometheus
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
# Health probes - removed invalid 'enabled' fields
|
|
startupProbe:
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 24 # 120 seconds for Authentik startup
|
|
|
|
readinessProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 2
|
|
|
|
livenessProbe:
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
# Spread across nodes
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: authentik
|
|
app.kubernetes.io/component: server
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
worker:
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
labels:
|
|
release: prometheus
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
# Spread across nodes
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: authentik
|
|
app.kubernetes.io/component: worker
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# Mount cert-manager secret for auto-import of Let's Encrypt cert
|
|
volumeMounts:
|
|
- name: certs
|
|
mountPath: /certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: certs
|
|
secret:
|
|
secretName: authentik-tls
|
|
optional: true
|
|
|
|
# Disable bundled Postgres
|
|
postgresql:
|
|
enabled: false
|