2026-10-18 23:26:48 +02:00
|
|
|
# Authentik deployment moved to GitOps
|
2026-09-05 10:39:44 +02:00
|
|
|
|
2026-10-18 23:26:48 +02:00
|
|
|
This repository is retained as historical deployment documentation and no
|
|
|
|
|
longer writes to Kubernetes. The homelab's Authentik release is reconciled by
|
|
|
|
|
Argo CD from the public
|
|
|
|
|
[`homelab-gitops/apps/authentik`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/authentik)
|
|
|
|
|
directory using Authentik's maintained upstream Helm chart.
|
2026-09-05 11:51:27 +02:00
|
|
|
|
2026-10-18 23:26:48 +02:00
|
|
|
The GitOps application pins the chart version, holds public homelab values and
|
|
|
|
|
cluster integrations, documents the existing Secret recovery boundary, and
|
|
|
|
|
includes the managed-outpost verification procedure. Credentials remain only
|
|
|
|
|
in the cluster-managed `authentik-runtime`, `authentik-postgresql`, and
|
|
|
|
|
`argocd-oidc` Secrets; they are not stored in either repository.
|
2026-10-14 20:16:26 +02:00
|
|
|
|
2026-10-18 23:26:48 +02:00
|
|
|
The LDAP, RADIUS, and RAC Deployments are generated by Authentik's outpost
|
|
|
|
|
controller. Their database `container_image` overrides are null, so they follow
|
|
|
|
|
the server version supplied by the upstream chart. Argo monitors their
|
|
|
|
|
availability without trying to own those generated Deployments.
|
2026-09-05 11:51:27 +02:00
|
|
|
|
2026-10-18 23:26:48 +02:00
|
|
|
Use the Git history here only when investigating the retired direct Helm/Gitea
|
|
|
|
|
Actions deployment. Do not restore that workflow alongside Argo CD, because it
|
|
|
|
|
would create a second writer for the same Kubernetes resources.
|
