32 lines
1.8 KiB
Markdown
32 lines
1.8 KiB
Markdown
# Authentik on Kubernetes
|
|
|
|
Authentik `2026.8.0` is rendered from the pinned official chart. `values.yaml`
|
|
contains only public configuration; the ignored legacy `authentik-values.yaml`
|
|
is retained locally. Runtime credentials live in `authentik-runtime` and the
|
|
existing PostgreSQL Secret, and neither is readable by CI.
|
|
|
|
`authentik-blueprints` declaratively creates the Argo CD OIDC application,
|
|
provider, and group claim. Its client secret comes from
|
|
`ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`; `install.sh` generates it
|
|
once when absent and mirrors it into the labeled `argocd-oidc` Secret. Only the
|
|
existing `authentik Admins` group is mapped to Argo CD administrator access.
|
|
|
|
Copy `authentik-secrets.env.example` to the ignored `authentik-secrets.env`,
|
|
preserve the existing values, and run `./install.sh` for administrator secret
|
|
updates. Run `./test.sh` for a secret-free render and schema validation.
|
|
The installer refuses a PostgreSQL password mismatch instead of attempting a
|
|
blind rotation; rotate the database role and both Kubernetes Secrets together
|
|
during a dedicated maintenance window.
|
|
|
|
Run `./create-ci-kubeconfig.sh` and store its final line as the Gitea Actions
|
|
secret `KUBE_CONFIG_BASE64`. CI can update only exact existing Authentik chart,
|
|
Ingress, Middleware, and event-filter objects; it cannot read Secrets, create
|
|
objects, delete objects, or manage the Ceph object user.
|
|
|
|
`authentik-client-credentials-event-filter` is a local compatibility patch
|
|
introduced on 2026-08-30. It replaces Authentik's private
|
|
`providers/oauth2/token/client_credentials.py` module to retain application
|
|
password grants while suppressing loopback (`::1`) login-event noise. Recheck
|
|
or remove it on every Authentik upgrade because it is not an upstream chart
|
|
feature or supported extension interface.
|