Archived
49 lines
2.8 KiB
Markdown
49 lines
2.8 KiB
Markdown
# Authentik on Kubernetes
|
|
|
|
Authentik `2026.8.3` is rendered from the pinned official chart. `values.yaml`
|
|
contains only public configuration; the ignored legacy `authentik-values.yaml`
|
|
is retained locally. Runtime credentials live in `authentik-runtime` and the
|
|
existing PostgreSQL Secret, and neither is readable by CI.
|
|
|
|
The LDAP, RADIUS, and RAC outposts are managed by Authentik and keep their
|
|
image pins in its database. `install.sh` runs `update-outpost-images.sh` after
|
|
the chart upgrade so their images match the server release.
|
|
|
|
`authentik-blueprints` declaratively creates the Argo CD OIDC application,
|
|
provider, and group claim. Its client secret comes from
|
|
`ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`; `install.sh` generates it
|
|
once when absent and mirrors it into the labeled `argocd-oidc` Secret. Only the
|
|
existing `authentik Admins` group is mapped to Argo CD administrator access.
|
|
|
|
The same blueprint creates an admin-only forward-auth application for
|
|
Kubernetes Dashboard. Its proxy provider contains no committed credential and
|
|
is served by the embedded proxy outpost. `install.sh` applies the blueprint and
|
|
idempotently attaches the provider to that outpost; it deliberately does not
|
|
replace the outpost's complete provider list because other repositories own
|
|
those applications.
|
|
|
|
Copy `authentik-secrets.env.example` to the ignored `authentik-secrets.env`,
|
|
preserve the existing values, and run `./install.sh` for administrator secret
|
|
updates. Run `./test.sh` for a secret-free render and schema validation.
|
|
The installer refuses a PostgreSQL password mismatch instead of attempting a
|
|
blind rotation; rotate the database role and both Kubernetes Secrets together
|
|
during a dedicated maintenance window.
|
|
|
|
The public Authentik and embedded-outpost routes have no Traefik request-rate
|
|
or concurrent-request limit: browser login flows and protected applications can
|
|
legitimately generate large bursts. Two server replicas, a PodDisruptionBudget,
|
|
and explicit resource requests keep one busy client or node from removing the
|
|
only healthy authentication endpoint.
|
|
|
|
Run `./create-ci-kubeconfig.sh` and store its final line as the Gitea Actions
|
|
secret `KUBE_CONFIG_BASE64`. CI can update only exact existing Authentik chart,
|
|
Ingress, Middleware, and event-filter objects; it cannot read Secrets, create
|
|
objects, delete objects, or manage the Ceph object user.
|
|
|
|
`authentik-client-credentials-event-filter` is a local compatibility patch
|
|
introduced on 2026-08-30 and reviewed against upstream `2026.8.3`. It replaces Authentik's private
|
|
`providers/oauth2/token/client_credentials.py` module to retain application
|
|
password grants while suppressing loopback (`::1`) login-event noise. Recheck
|
|
or remove it on every Authentik upgrade because it is not an upstream chart
|
|
feature or supported extension interface.
|