This directory contains only the homelab values and cluster integrations for the maintained upstream Authentik chart. The chart owns the Authentik server, worker, PostgreSQL, Services, Ingress, RBAC, probes, and persistent volume claim. The local resources retain the existing media route, embedded-outpost path, Ceph object user, and an alert for the three Authentik-managed outposts.

Secrets and recovery boundary

The public repository never contains credentials. The deployment references the existing authentik/authentik-runtime and authentik/authentik-postgresql Secrets. The existing argocd/argocd-oidc Secret is also retained outside Git and must contain the same OIDC client secret as ARGOCD_OIDC_CLIENT_SECRET in authentik-runtime.

Restore those Secrets before synchronizing Authentik into an empty cluster. PostgreSQL password rotation must update the database role and both Secret references together during a maintenance window.

Managed outposts

Authentik, not Argo CD, creates the ak-outpost-ldap, ak-outpost-radius, and ak-outpost-rac Deployments. Their database container_image overrides are intentionally null so Authentik uses its upstream ghcr.io/goauthentik/%(type)s:%(version)s template. That keeps each outpost on the same version as the server after a chart upgrade without a second version list in Git.

After every Authentik upgrade, verify that all three Deployments use the chart application version and report one updated, ready, and available replica. The AuthentikManagedOutpostsUnavailable alert detects missing or unavailable generated outposts, which are outside Argo CD's direct resource inventory. Run apps/authentik/verify-outposts.sh for the version, database-pin, image, and replica checks; it derives the expected version from the Argo Application.

The Kubernetes Dashboard provider is attached to the embedded outpost in the Authentik database. This avoids a blueprint replacing the embedded outpost's complete provider list, because other applications also own providers there.