# Authentik on Kubernetes

Authentik `2026.8.3` is rendered from the pinned official chart. `values.yaml`
contains only public configuration; the ignored legacy `authentik-values.yaml`
is retained locally. Runtime credentials live in `authentik-runtime` and the
existing PostgreSQL Secret, and neither is readable by CI.

The LDAP, RADIUS, and RAC outposts are managed by Authentik and keep their
image pins in its database. `install.sh` runs `update-outpost-images.sh` after
the chart upgrade so their images match the server release.

`authentik-blueprints` declaratively creates the Argo CD OIDC application,
provider, and group claim. Its client secret comes from
`ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`; `install.sh` generates it
once when absent and mirrors it into the labeled `argocd-oidc` Secret. Only the
existing `authentik Admins` group is mapped to Argo CD administrator access.

The same blueprint creates an admin-only forward-auth application for
Kubernetes Dashboard. Its proxy provider contains no committed credential and
is served by the embedded proxy outpost. `install.sh` applies the blueprint and
idempotently attaches the provider to that outpost; it deliberately does not
replace the outpost's complete provider list because other repositories own
those applications.

Copy `authentik-secrets.env.example` to the ignored `authentik-secrets.env`,
preserve the existing values, and run `./install.sh` for administrator secret
updates. Run `./test.sh` for a secret-free render and schema validation.
The installer refuses a PostgreSQL password mismatch instead of attempting a
blind rotation; rotate the database role and both Kubernetes Secrets together
during a dedicated maintenance window.

The public Authentik and embedded-outpost routes have no Traefik request-rate
or concurrent-request limit: browser login flows and protected applications can
legitimately generate large bursts. Two server replicas, a PodDisruptionBudget,
and explicit resource requests keep one busy client or node from removing the
only healthy authentication endpoint.

Run `./create-ci-kubeconfig.sh` and store its final line as the Gitea Actions
secret `KUBE_CONFIG_BASE64`. CI can update only exact existing Authentik chart,
Ingress, Middleware, and event-filter objects; it cannot read Secrets, create
objects, delete objects, or manage the Ceph object user.

`authentik-client-credentials-event-filter` is a local compatibility patch
introduced on 2026-08-30 and reviewed against upstream `2026.8.3`. It replaces Authentik's private
`providers/oauth2/token/client_credentials.py` module to retain application
password grants while suppressing loopback (`::1`) login-event noise. Recheck
or remove it on every Authentik upgrade because it is not an upstream chart
feature or supported extension interface.