40 lines
2.0 KiB
Markdown
40 lines
2.0 KiB
Markdown
# Authentik homelab deployment
|
|
|
|
This directory contains only the homelab values and cluster integrations for
|
|
the maintained upstream Authentik chart. The chart owns the Authentik server,
|
|
worker, PostgreSQL, Services, Ingress, RBAC, probes, and persistent volume
|
|
claim. The local resources retain the existing media route, embedded-outpost
|
|
path, Ceph object user, and an alert for the three Authentik-managed outposts.
|
|
|
|
## Secrets and recovery boundary
|
|
|
|
The public repository never contains credentials. The deployment references
|
|
the existing `authentik/authentik-runtime` and
|
|
`authentik/authentik-postgresql` Secrets. The existing `argocd/argocd-oidc`
|
|
Secret is also retained outside Git and must contain the same OIDC client
|
|
secret as `ARGOCD_OIDC_CLIENT_SECRET` in `authentik-runtime`.
|
|
|
|
Restore those Secrets before synchronizing Authentik into an empty cluster.
|
|
PostgreSQL password rotation must update the database role and both Secret
|
|
references together during a maintenance window.
|
|
|
|
## Managed outposts
|
|
|
|
Authentik, not Argo CD, creates the `ak-outpost-ldap`,
|
|
`ak-outpost-radius`, and `ak-outpost-rac` Deployments. Their database
|
|
`container_image` overrides are intentionally null so Authentik uses its
|
|
upstream `ghcr.io/goauthentik/%(type)s:%(version)s` template. That keeps each
|
|
outpost on the same version as the server after a chart upgrade without a
|
|
second version list in Git.
|
|
|
|
After every Authentik upgrade, verify that all three Deployments use the chart
|
|
application version and report one updated, ready, and available replica. The
|
|
`AuthentikManagedOutpostsUnavailable` alert detects missing or unavailable
|
|
generated outposts, which are outside Argo CD's direct resource inventory.
|
|
Run `apps/authentik/verify-outposts.sh` for the version, database-pin, image,
|
|
and replica checks; it derives the expected version from the Argo Application.
|
|
|
|
The Kubernetes Dashboard provider is attached to the embedded outpost in the
|
|
Authentik database. This avoids a blueprint replacing the embedded outpost's
|
|
complete provider list, because other applications also own providers there.
|