# Authentik on Kubernetes

Authentik `2026.8.0` is rendered from the pinned official chart. `values.yaml`
contains only public configuration; the ignored legacy `authentik-values.yaml`
is retained locally. Runtime credentials live in `authentik-runtime` and the
existing PostgreSQL Secret, and neither is readable by CI.

`authentik-blueprints` declaratively creates the Argo CD OIDC application,
provider, and group claim. Its client secret comes from
`ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`; `install.sh` generates it
once when absent and mirrors it into the labeled `argocd-oidc` Secret. Only the
existing `authentik Admins` group is mapped to Argo CD administrator access.

Copy `authentik-secrets.env.example` to the ignored `authentik-secrets.env`,
preserve the existing values, and run `./install.sh` for administrator secret
updates. Run `./test.sh` for a secret-free render and schema validation.
The installer refuses a PostgreSQL password mismatch instead of attempting a
blind rotation; rotate the database role and both Kubernetes Secrets together
during a dedicated maintenance window.

Run `./create-ci-kubeconfig.sh` and store its final line as the Gitea Actions
secret `KUBE_CONFIG_BASE64`. CI can update only exact existing Authentik chart,
Ingress, Middleware, and event-filter objects; it cannot read Secrets, create
objects, delete objects, or manage the Ceph object user.

`authentik-client-credentials-event-filter` is a local compatibility patch
introduced on 2026-08-30. It replaces Authentik's private
`providers/oauth2/token/client_credentials.py` module to retain application
password grants while suppressing loopback (`::1`) login-event noise. Recheck
or remove it on every Authentik upgrade because it is not an upstream chart
feature or supported extension interface.