willemjan/cluster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: added authentik manifests

Browse Source
This commit is contained in:
willemjan
2026-10-31 16:08:23 +01:00
parent fada4e68b4
commit 8f8569cb82
9 changed files with 395 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/authentik.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
spec:
project: default
source:
repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
targetRevision: main
path: services/authentik
destination:
server: https://kubernetes.default.svc
namespace: authentik
syncPolicy:
automated: {prune: true, selfHeal: true}
services/authentik/cert.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: zb-kw-wildcard
namespace: authentik
spec:
secretName: zb-kw-wildcard-tls
dnsNames: ["auth.zb-kw.duckdns.org"]
issuerRef: {name: duckdns, kind: ClusterIssuer}
services/authentik/deployment.yaml
+125
View File
@@ -0,0 +1,125 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: authentik-media-pvc
namespace: authentik
spec:
storageClassName: nfs-client # NFS vanaf Proxmox — Bijlage A
accessModes: [ReadWriteOnce]
resources:
requests:
storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-server
namespace: authentik
spec:
replicas: 1
selector:
matchLabels: {app: authentik-server}
template:
metadata:
labels: {app: authentik-server}
spec:
initContainers:
- name: wait-for-db
image: busybox:latest # pin de tag! (Renovate houdt ze bij)
command:
- sh
- -c
- |
until nc -z authentik-postgresql 5432; do
echo "Waiting for PostgreSQL..."
sleep 2
done
echo "PostgreSQL is ready!"
containers:
- name: authentik
image: ghcr.io/goauthentik/server:2026.5.8
args: ["server"]
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_SECRET_KEY
- name: AUTHENTIK_POSTGRESQL__HOST
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__HOST
- name: AUTHENTIK_POSTGRESQL__PORT
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__PORT
- name: AUTHENTIK_POSTGRESQL__NAME
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__NAME
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__USER
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__PASSWORD
- name: AUTHENTIK_REDIS__HOST
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_REDIS__HOST
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
value: "false"
ports:
- containerPort: 9000
name: http
- containerPort: 9443
name: https
volumeMounts:
- name: media
mountPath: /media
livenessProbe:
httpGet:
path: /-/health/live/
port: 9000
initialDelaySeconds: 60
periodSeconds: 30
readinessProbe:
httpGet:
path: /-/health/ready/
port: 9000
initialDelaySeconds: 60
periodSeconds: 30
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "1Gi"
cpu: "1000m"
volumes:
- name: media
persistentVolumeClaim:
claimName: authentik-media-pvc
---
apiVersion: v1
kind: Service
metadata:
name: authentik-server
namespase: authentik
spec:
selector: {app: authentik-server}
ports:
- port: 9000
targetPort: 9000
name: http
- port: 9443
targetPort: 9443
name: https
services/authentik/ingress.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: authentik
namespace: authentik
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
ingressClassName: traefik
rules:
- host:
paths:
- path: /
pathType: Prefix
backend:
service:
name: authentik-server
port:
number: 9000
tls:
- hosts:
- auth.zb-kw.duckdns.org
secretName: zb-kw-wildcard-tls
services/authentik/middleware.yaml
+37
View File
@@ -0,0 +1,37 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: authentik-forwardauth
namespace: authentik
spec:
forwardAuth:
address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: authentik-forwardauth-with-cookies
namespace: authentik
spec:
forwardAuth:
address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- Set-Cookie
- Cookie
authRequestHeaders:
- X-Forwarded-Proto
- X-Forwarded-Host
- X-Forwarded-Uri
services/authentik/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: authentik
services/authentik/postgres.yaml
+65
View File
@@ -0,0 +1,65 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: authentik-postgres-pvc
namespace: authentik
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-postgresql
namespace: authentik
spec:
replicas: 1
selector:
matchLabels: {app: authentik-postgresql}
template:
metadata:
labels: {app: authentik-postgresql}
spec:
containers:
- name: postgresql
image: postgres:16-alpine
env:
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-postgres-secret
key: POSTGRES_PASSWORD
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: authentik-postgres-secret
key: POSTGRES_USER
- name: POSTGRES_DB
valueFrom:
secretKeyRef:
name: authentik-postgres-secret
key: POSTGRES_DB
ports:
- containerPort: 5432
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
volumes:
- name: postgres-data
persistentVolumeClaim:
claimName: authentik-postgres-pvc
---
apiVersion: v1
kind: Service
metadata:
name: authentik-postgresql
namespace: authentik
spec:
selector:
app: authentik-postgresql
ports:
- port: 5432
services/authentik/redis.yaml
+46
View File
@@ -0,0 +1,46 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-redis
namespace: authentik
spec:
replicas: 1
selector:
matchLabels: {app: authentik-redis}
template:
metadata:
labels: {app: authentik-redis}
spec:
containers:
- name: redis
image: redis:alpine
ports:
- containerPort: 6379
name: redis
command:
- redis-server
- --save
- "60"
- "1"
- --logLevel
- warning
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "256Mi"
cpu: "200m"
---
apiVersion: v1
kind: Service
metadata:
name: authentik-redis
namespace: authentik
spec:
selector: {app: authentik-redis}
ports:
- port: 6379
targetPort: 6379
name: redis
services/authentik/worker.yaml
+69
View File
@@ -0,0 +1,69 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-worker
namespace: authentik
spec:
replicas: 1
selector:
matchLabels: {app: authentik-worker}
template:
metadata:
labels: {app: authentik-worker}
spec:
containers:
- name: authentik
image: ghcr.io/goauthentik/server:2026.5.8
args: ["worker"]
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_SECRET_KEY
- name: AUTHENTIK_POSTGRESQL__HOST
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__HOST
- name: AUTHENTIK_POSTGRESQL__PORT
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__PORT
- name: AUTHENTIK_POSTGRESQL__NAME
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__NAME
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__USER
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_POSTGRESQL__PASSWORD
- name: AUTHENTIK_REDIS__HOST
valueFrom:
secretKeyRef:
name: authentik-secret
key: AUTHENTIK_REDIS__HOST
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
value: "false"
volumeMounts:
- name: media
mountPath: /media
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
volumes:
- name: media
persistentVolumeClaim:
claimName: authentik-media-pvc