Add Authentik Argo CD application

bootstrap/authentik-project.yaml

@@ -0,0 +1,53 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  description: Authentik identity provider and homelab integrations
+  sourceRepos:
+  - https://charts.goauthentik.io
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: authentik
+    server: https://kubernetes.default.svc
+  - namespace: rook-ceph
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: ""
+    kind: Namespace
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: PersistentVolumeClaim
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: Deployment
+  - group: apps
+    kind: StatefulSet
+  - group: ceph.rook.io
+    kind: CephObjectStoreUser
+  - group: monitoring.coreos.com
+    kind: PrometheusRule
+  - group: networking.k8s.io
+    kind: Ingress
+  - group: networking.k8s.io
+    kind: NetworkPolicy
+  - group: policy
+    kind: PodDisruptionBudget
+  - group: rbac.authorization.k8s.io
+    kind: Role
+  - group: rbac.authorization.k8s.io
+    kind: RoleBinding
+  - group: traefik.io
+    kind: IngressRoute
+  - group: traefik.io
+    kind: Middleware

bootstrap/authentik.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  project: authentik
+  sources:
+  - repoURL: https://charts.goauthentik.io
+    chart: authentik
+    targetRevision: 2026.8.4
+    helm:
+      releaseName: authentik
+      valueFiles:
+      - $values/apps/authentik/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/authentik/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authentik
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true

bootstrap/kustomization.yaml

@@ -9,6 +9,8 @@ resources:
 - immich-sync.yaml
 - immichframe.yaml
 - anubis.yaml
+- authentik-project.yaml
+- authentik.yaml
 - metallb-project.yaml
 - metallb.yaml
 - brgkepler-com.yaml