feat: added authentik manifests

2026-10-31 16:08:23 +01:00
parent fada4e68b4
commit 8f8569cb82
9 changed files with 395 additions and 0 deletions
@@ -0,0 +1,125 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-media-pvc
+  namespace: authentik
+spec:
+  storageClassName: nfs-client        # NFS vanaf Proxmox — Bijlage A
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-server}
+  template:
+    metadata:
+      labels: {app: authentik-server}
+    spec:
+      initContainers:
+      - name: wait-for-db
+        image: busybox:latest   # pin de tag! (Renovate houdt ze bij)
+        command: 
+        - sh
+        - -c
+        - |
+          until nc -z authentik-postgresql 5432; do
+            echo "Waiting for PostgreSQL..."
+            sleep 2
+          done
+          echo "PostgreSQL is ready!"
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2026.5.8
+        args: ["server"]
+        env:
+          - name: AUTHENTIK_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_SECRET_KEY
+          - name: AUTHENTIK_POSTGRESQL__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__HOST
+          - name: AUTHENTIK_POSTGRESQL__PORT
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PORT
+          - name: AUTHENTIK_POSTGRESQL__NAME
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__NAME
+          - name: AUTHENTIK_POSTGRESQL__USER
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__USER
+          - name: AUTHENTIK_POSTGRESQL__PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PASSWORD
+          - name: AUTHENTIK_REDIS__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_REDIS__HOST
+          - name: AUTHENTIK_ERROR_REPORTING__ENABLED
+            value: "false"
+        ports:
+        - containerPort: 9000
+          name: http
+        - containerPort: 9443
+          name: https
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        livenessProbe:
+          httpGet:
+            path: /-/health/live/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /-/health/ready/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits: 
+            memory: "1Gi"
+            cpu: "1000m"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: authentik-media-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-server
+  namespase: authentik
+spec:
+  selector: {app: authentik-server}
+  ports:
+  - port: 9000
+    targetPort: 9000
+    name: http
+  - port: 9443
+    targetPort: 9443
+    name: https