added secrets to authentik

.gitignore

@@ -0,0 +1,2 @@
+infrastructure/sealedsecret/sealed-secrets-key-BACKUP.yaml
+pub-sealed-secrets.pem

apps/authentik.yaml

@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    targetRevision: main
+    path: services/authentik
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: authentik
+  syncPolicy:
+    automated: {prune: true, selfHeal: true}

infrastructure/sealedsecret/controller.yaml

@@ -0,0 +1,416 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: secrets-unsealer
+  name: secrets-unsealer
+rules:
+- apiGroups:
+  - bitnami.com
+  resources:
+  - sealedsecrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - bitnami.com
+  resources:
+  - sealedsecrets/status
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - create
+  - update
+  - delete
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller
+  name: sealed-secrets-controller
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller
+  name: sealed-secrets-controller
+  namespace: kube-system
+spec:
+  minReadySeconds: 30
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      name: sealed-secrets-controller
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        name: sealed-secrets-controller
+    spec:
+      containers:
+      - args: []
+        command:
+        - controller
+        env: []
+        image: docker.io/bitnami/sealed-secrets-controller:0.41.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+        name: sealed-secrets-controller
+        ports:
+        - containerPort: 8080
+          name: http
+        - containerPort: 8081
+          name: metrics
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        stdin: false
+        tty: false
+        volumeMounts:
+        - mountPath: /tmp
+          name: tmp
+      imagePullSecrets: []
+      initContainers: []
+      securityContext:
+        fsGroup: 65534
+        runAsNonRoot: true
+        runAsUser: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: sealed-secrets-controller
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: tmp
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-service-proxier
+  name: sealed-secrets-service-proxier
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: sealed-secrets-service-proxier
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:authenticated
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller
+  name: sealed-secrets-controller
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: sealed-secrets-key-admin
+subjects:
+- kind: ServiceAccount
+  name: sealed-secrets-controller
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-key-admin
+  name: sealed-secrets-key-admin
+  namespace: kube-system
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - list
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: sealedsecrets.bitnami.com
+spec:
+  group: bitnami.com
+  names:
+    kind: SealedSecret
+    listKind: SealedSecretList
+    plural: sealedsecrets
+    singular: sealedsecret
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          SealedSecret is the K8s representation of a "sealed Secret" - a
+          regular k8s Secret that has been sealed (encrypted) using the
+          controller's key.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: SealedSecretSpec is the specification of a SealedSecret.
+            properties:
+              data:
+                description: Data is deprecated and will be removed eventually. Use
+                  per-value EncryptedData instead.
+                format: byte
+                type: string
+              encryptedData:
+                additionalProperties:
+                  type: string
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              template:
+                description: |-
+                  Template defines the structure of the Secret that will be
+                  created from this sealed secret.
+                properties:
+                  data:
+                    additionalProperties:
+                      type: string
+                    description: |-
+                      Keys that should be templated using decrypted data.
+                      Set a key with the same name as in `encryptedData`
+                      to `null` to omit the unsealed data from the final secret.
+                    nullable: true
+                    type: object
+                  immutable:
+                    description: |-
+                      Immutable, if set to true, ensures that data stored in the Secret cannot
+                      be updated (only object metadata can be modified).
+                      If not set to true, the field can be modified at any time.
+                      Defaulted to nil.
+                    type: boolean
+                  metadata:
+                    description: |-
+                      Standard object's metadata.
+                      More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
+                    nullable: true
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      finalizers:
+                        items:
+                          type: string
+                        type: array
+                      labels:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    type: object
+                    x-kubernetes-preserve-unknown-fields: true
+                  type:
+                    description: Used to facilitate programmatic handling of secret
+                      data.
+                    type: string
+                type: object
+            required:
+            - encryptedData
+            type: object
+          status:
+            description: SealedSecretStatus is the most recently observed status of
+              the SealedSecret.
+            properties:
+              conditions:
+                description: Represents the latest available observations of a sealed
+                  secret's current state.
+                items:
+                  description: SealedSecretCondition describes the state of a sealed
+                    secret at a certain point.
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    lastUpdateTime:
+                      description: The last time this condition was updated.
+                      format: date-time
+                      type: string
+                    message:
+                      description: A human readable message indicating details about
+                        the transition.
+                      type: string
+                    reason:
+                      description: The reason for the condition's last transition.
+                      type: string
+                    status:
+                      description: |-
+                        Status of the condition for a sealed secret.
+                        Valid values for "Synced": "True", "False", or "Unknown".
+                      type: string
+                    type:
+                      description: |-
+                        Type of condition for a sealed secret.
+                        Valid value: "Synced"
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+              observedGeneration:
+                description: ObservedGeneration reflects the generation most recently
+                  observed by the sealed-secrets controller.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller
+  name: sealed-secrets-controller
+  namespace: kube-system
+spec:
+  ports:
+  - port: 8080
+    targetPort: 8080
+  selector:
+    name: sealed-secrets-controller
+  type: ClusterIP
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-service-proxier
+  name: sealed-secrets-service-proxier
+  namespace: kube-system
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - sealed-secrets-controller
+  resources:
+  - services
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resourceNames:
+  - 'http:sealed-secrets-controller:'
+  - http:sealed-secrets-controller:http
+  - sealed-secrets-controller
+  resources:
+  - services/proxy
+  verbs:
+  - create
+  - get
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller-metrics
+  name: sealed-secrets-controller-metrics
+  namespace: kube-system
+spec:
+  ports:
+  - port: 8081
+    targetPort: 8081
+  selector:
+    name: sealed-secrets-controller
+  type: ClusterIP
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: sealed-secrets-controller
+  name: sealed-secrets-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: secrets-unsealer
+subjects:
+- kind: ServiceAccount
+  name: sealed-secrets-controller
+  namespace: kube-system

services/authentik/cert.yaml

@@ -0,0 +1,9 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zb-kw-wildcard
+  namespace: authentik
+spec:
+  secretName: zb-kw-wildcard-tls
+  dnsNames: ["auth.zb-kw.duckdns.org"]
+  issuerRef: {name: duckdns, kind: ClusterIssuer}

services/authentik/deployment.yaml

@@ -0,0 +1,125 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-media-pvc
+  namespace: authentik
+spec:
+  storageClassName: nfs-client        # NFS vanaf Proxmox — Bijlage A
+  accessModes: [ReadWriteMany]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-server}
+  template:
+    metadata:
+      labels: {app: authentik-server}
+    spec:
+      initContainers:
+      - name: wait-for-db
+        image: busybox:latest   # pin de tag! (Renovate houdt ze bij)
+        command: 
+        - sh
+        - -c
+        - |
+          until nc -z authentik-postgresql 5432; do
+            echo "Waiting for PostgreSQL..."
+            sleep 2
+          done
+          echo "PostgreSQL is ready!"
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2026.5.8
+        args: ["server"]
+        env:
+          - name: AUTHENTIK_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_SECRET_KEY
+          - name: AUTHENTIK_POSTGRESQL__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__HOST
+          - name: AUTHENTIK_POSTGRESQL__PORT
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PORT
+          - name: AUTHENTIK_POSTGRESQL__NAME
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__NAME
+          - name: AUTHENTIK_POSTGRESQL__USER
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__USER
+          - name: AUTHENTIK_POSTGRESQL__PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_POSTGRESQL__PASSWORD
+          - name: AUTHENTIK_REDIS__HOST
+            valueFrom:
+              secretKeyRef:
+                name: authentik-secret
+                key: AUTHENTIK_REDIS__HOST
+          - name: AUTHENTIK_ERROR_REPORTING__ENABLED
+            value: "false"
+        ports:
+        - containerPort: 9000
+          name: http
+        - containerPort: 9443
+          name: https
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        livenessProbe:
+          httpGet:
+            path: /-/health/live/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /-/health/ready/
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits: 
+            memory: "1Gi"
+            cpu: "1000m"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: authentik-media-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  selector: {app: authentik-server}
+  ports:
+  - port: 9000
+    targetPort: 9000
+    name: http
+  - port: 9443
+    targetPort: 9443
+    name: https

services/authentik/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: authentik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: auth.zb-kw.duckdns.org
+    paths:
+    - path: /
+      pathType: Prefix
+      backend:
+        service:
+          name: authentik-server
+          port:
+            number: 9000
+  tls:
+  - hosts:
+    - auth.zb-kw.duckdns.org
+    secretName: zb-kw-wildcard-tls

services/authentik/middleware.yaml

@@ -0,0 +1,37 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: authentik
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth-with-cookies
+  namespace: authentik
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - Set-Cookie
+      - Cookie
+    authRequestHeaders:
+      - X-Forwarded-Proto
+      - X-Forwarded-Host
+      - X-Forwarded-Uri

services/authentik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

services/authentik/postgres.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-postgres-pvc
+  namespace: authentik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-postgresql
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-postgresql}
+  template:
+    metadata:
+      labels: {app: authentik-postgresql}
+    spec:
+      containers:
+      - name: postgresql
+        image: postgres:16-alpine
+        env: 
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_PASSWORD
+        - name: POSTGRES_USER
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_USER
+        - name: POSTGRES_DB
+          valueFrom:
+            secretKeyRef:
+              name: authentik-postgres-secret
+              key: POSTGRES_DB
+        ports:
+        - containerPort: 5432
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+      volumes:
+      - name: postgres-data
+        persistentVolumeClaim:
+          claimName: authentik-postgres-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-postgresql
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-postgresql
+  ports:
+  - port: 5432

services/authentik/redis.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-redis
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-redis}
+  template:
+    metadata:
+      labels: {app: authentik-redis}
+    spec:
+      containers:
+      - name: redis
+        image: redis:alpine
+        ports:
+        - containerPort: 6379
+          name: redis
+        command:
+        - redis-server
+        - --save
+        - "60"
+        - "1"
+        - --logLevel
+        - warning
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "256Mi"
+            cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-redis
+  namespace: authentik
+spec:
+  selector: {app: authentik-redis}
+  ports:
+  - port: 6379
+    targetPort: 6379
+    name: redis

services/authentik/sealed-secret-postgres.yaml

@@ -0,0 +1,21 @@
+{
+  "kind": "SealedSecret",
+  "apiVersion": "bitnami.com/v1alpha1",
+  "metadata": {
+    "name": "authentik-postgres-secret",
+    "namespace": "authentik"
+  },
+  "spec": {
+    "template": {
+      "metadata": {
+        "name": "authentik-postgres-secret",
+        "namespace": "authentik"
+      }
+    },
+    "encryptedData": {
+      "POSTGRES_DB": "AgBlewltIxvwrrfMzpf1dlutVlStrPAlVmmTpRn7eBJ7CBfLKVBeiI1XoJXERFJl1PzOjO2by3J0/1CI3uAjcDq06CWyUHWNGdFsz/vkf570I3WFtSt5jeaNZtwgDdY6HRrvb23VAu3qqQtWuefPhIpUjqJAjNm+CktHAaF9ZS8VjvQ0zlFbeorZiIQf4W5rInfVKzEIrwrK1XMhXU7IM7ckWqZxI13KjGFqdlr2knTqbtNz8s6jID7V5sMk8v9eyerxv0bzTaiJdKi36SaH/SuDjETSqOEH6WEEjKgVvB5EBLFRBUwkV8EG8rVuNpGc3Fd9RhZX7ehVOGvmKFdvEmYrhNBV5JKUPj7beLdqP9wIKXvG1/R+Md5PhtWDbguXTVwHzTzFmMl2KfFjIR/jDhb64mUM6/SHphko+N48OQHPfyhTRZpDV8K3SfMo352atj+gLFEn42TWT+0D1rf84oGX0ztQltQMHv0xQuBRwKR6FJnYnt7ii8x3J+p8tQnd/JhvzaDt81f7GQv5avv/SFlvh/XxXGsZRz7695bzmOpxT1AEn9Zn/SCtIT0xX752trCcRaKV/9Jm2kOFWcCEm3ynQOlojLKugzoFiensfxKtywoTyESPSSIessSMX4hSezDGaprWjPG/ChK52IZz2LJHfdWyKgpYaQi/lPN6Jtq01wlKquhvs6UM6L8YIfL9NfsuWxRB7IsSZAI=",
+      "POSTGRES_PASSWORD": "AgCZncbrbavs+MADjKwVQ+Euk93PFHiyvMTdsDKFr6bRR0JkemG2vXwJURlUkkjExSpMvnHL6RhkXbtvhP53tFWnf8tqyk5Wg1ARrNg/H4LOobvLUwmKMEcpkqNj+w/585ijR6X0oFxxbh6dHyMjert4ASuMR8H2wlGChzE7GHp3PjZaPUlJAWk0iIBVQ3R9U9BavxbXa0zaoJQBEu6SZ8MNzyq14PPhLG2XD2k8qu4KyEIxAJhh+YO28GXVAQItSYui7T4S4UsRb3GH83rTBs97Wjn2PzGK0dl2D6Oc/Tol7UGbqTV00P5kVxc6mVOzw+aWVZekBw6KjrZ0sqWBQi/DtoFnECQkvERbEpQ5WaifsHjHnAf7o9DBjM2Lsn+UK5Ti1OMG5u3kcZAqo6opijjyGTxpyq51T2bZZpHbd2//k0aBax65fSo7YSqSEjICTu6LKGUprgCNfJC1Yi+GfXUVqDF6sA/gpcgkRp0zztaUoNXypzIfZQIEnTeCTncHDgwgTM6CM5l+ZUB4ApmbEzqP16SFojlGGVfUzeM8r2+KO/oUaFJI+QbVOU1gS5CQEEJ+ZdLsvYAaTPp/KkqEkSYQ2FkII8bGKBJjio8M8KTozSCDEiA7cBBnCqOI54F1vqrsCLcGFuwj910NoXUfyYzp5Sv4IiTVHWB7MboooLfAJ6X6Xzzjp6nthrmmPENXUitDo5eFOrQ/SrYIYjm7NRwAO7cCretlxqYFnSOL6ojLhz1Xb3aCltV7U0T3ZA==",
+      "POSTGRES_USER": "AgAMSJLtQvx4XygOyFrtJhfMwd6ylleyYtajd1TKQm47s5ZJVvQkBvVBN4LN29wvCbVC+Umu9EoXmP9ugIB96LTApPAQAt0q+IuLYrHwvOFRbrjubpqkDJh5GpSvogXLIQ4oTUO9C4n8++Lvun6695DYEck4ezcRp8tP2syXQc1UHHMQexfnhM9fIRuopvpWUc0Iqb73wh6MofbpCGR5sZHPQ35l65ZovmOv8gAKZbCcDT63fHN903kYbm9fqNSmyBLiBXn5qDKWz1LZrIPZ/BGgmNMfLvwKvmjSNLrP8iNgOzv2I1aeR7g+ss61T3GHHNno7IswAJWmUOTg1NCs4SEVOD4FthmiIlnAd8VkcuICiufduRMxQ1wTfIKCd/s4+u4YrNRmIxiFAG2G87GoFC6vO7QxbD7rLMxJsRrAf2x8RwaY3f1p/OWgyfqqdwkrLmp3VAVnibyaNdvkGfkj0y+kOQ3kZrS/zdgww6vrWo3Bziwj1ZwVtX7A32nw8LeeKlaQMbmjsazN8fH4sjWuXiy2wkn/XJsRHNo2za/45XlLbfH9JJZazDRDreAiwBD21t1ogsqAGPd/WlD5FzD4XU7qiLqHQZfxlcXOYmq2N19gmUo41bs4RBfwGpLzUz+3Qg3sqj79WvHgH4JWWi07MsmRy9q9/FSrYJRpNm8x3/s069eVL2XgWzCLlSZUx3D9DAyipoVdooGlE2k="
+    }
+  }
+}

services/authentik/sealed-secret.yaml

@@ -0,0 +1,25 @@
+{
+  "kind": "SealedSecret",
+  "apiVersion": "bitnami.com/v1alpha1",
+  "metadata": {
+    "name": "authentik-secret",
+    "namespace": "authentik"
+  },
+  "spec": {
+    "template": {
+      "metadata": {
+        "name": "authentik-secret",
+        "namespace": "authentik"
+      }
+    },
+    "encryptedData": {
+      "AUTHENTIK_POSTGRESQL__HOST": "AgCW4vQ2sjaRFWrzyMPRwXl5FdFY4gWrzqYrmxeO4RtylWuJ+USekNtPLbS8ibPN1w8s0Agwl4Jb5zJ1C/R2Y8C1vP4FugMSWf7F7Vm9DaP7weDrq7EC6pRPeK1b8Bqlkl1hPhzZloOX5LfCYY9laD5L3UGsXqC8Z2E06EduK1J8fnpY8OfawWppz79TkwNPGngGJk7to9aZI6SGVnnwZ4CdH3P3LTck0IHC3VJKYyxdK9XmQ4Msdd4lDRvA2rdDfg+2EvwRCeJ6m7qTtSL8Z1vCBMYEmyifb3UBake6nDj71OOacYWoIk4CUY39gS5MlQqqe+dftZmI4lvx8v5ViFYhaO1fI0EkQOTZwaLcvm5LZtvVwwsFWnBiI11sUl//gyDRz+5SVvlGhOA0rpPxZ2pqe0VKcFZicE7A+Nw3HYkbKFm3G9lfBG4YOIPnA4SX6Q857AJ2RRXk1Zu1jvzGVAm39iL5xNlHV1dbpsJpnGiTmnEL7UrQtcLy6mJyqJAuo/HhzKFsFpEllMFWoROoxK2zfr7hfZIA8j1kPoTh5Xs907MnJJWPQZX6hAII8MObwgaM2XOxkP1cBi5NIMQaPcrcER7uaMjzmYMNXQSaI7tFOExJquH64RStWts/LBH7xUuy5NSzs/1Lyn83V7+wQTMe+sP++x0b8ResIgq2LW8l+ZuEBBR4Q93MQTTJP/yZ0P5o1lFNqfMOhAKjCOr0HI4E45a85w==",
+      "AUTHENTIK_POSTGRESQL__NAME": "AgAlE5AU+tZ4+c7NIeBWsi8Q4mgaEO2znOFWp5NOUCBoM+KYG0aDWGmk7MBP2HtbdlJlkUs51IYWoaDb6tnV3AwQVB5WPaVI9dBVwiBdsBw0XVdwn08Hbp6mfiURqLNVAuqM44d1bep1ddiRi44+1Pa27bceO/ROVNyQEHjutPka6Tys7rXzEAIlCGeyI1ZcpsDGAFtgwQyBfQHNxKl8d0rgviLBXzTsuc4KJRN5Y6WV4GzgZa9iD3EacRcdp3hLSX8LqsswWpvASUMrmtymO9l1bI3lUh46QQuCAzWXKHiW7GkcZHSdPjvQsZQKYeO/LrkMknUuMiq60ETusyM23GqOz6hXLXmJhKtsc1x3AvzZDCxCW1SwcHKr9QuUH55gKgjm3ms4zrAaoECfcSH3ZzwnASIRgT+BiQRUfleyG4P5GgxMzN0Zxog6w90EIGhsjegIN6PZwO13DdcBBfCRoYhZOax2shW4hrvZMxYo+l/VNqxNopy0cx2befyoy+e2J+qEOExaWA5S8XQelQQCl8fSwSt+Wn5uzZleAK+0xzo5ZycYXPbnqLpPxVuYi5edomH0K4qMP5xnYEcN090PExgiHkxtzD1lv5QIVPY9NsYRtikdSf1NQ1NXuA6dgJBp80ZnTJpYKDr9v06yvJ+I2TVzHL87AVF+9RZEV3BIUIX6nBrcuBXHN4qeNhudio5VFp879/CwyAkPMN4=",
+      "AUTHENTIK_POSTGRESQL__PASSWORD": "AgCq22ubUvWQUrr7ztj2po2YMTFlKoWOy00QE7GNr6I6Fn8MkA61d//6HEhWpLJ9ETJogClDZEKLhNKrNtwiAXXw82gfUkzI51nJm+VrEfaZQsLQJT7WxDHLdbpRQjsgMqa+sZfjaCTdozzFdMbelYKl3/GBPrOPV521P404F3d9Cx4+NI+FpGGKaukTd1fLIlEiayELbiRnDjdXODXnNJ6NNpFRvfqi1wEVZ58HTn0tIVdJUrcBM+WY7up5MMwQJyK0dZ6NFpeUFQpd/W25lyuaPiSaYCLWLKSDMtKKmCfzk/J3VZ5s+yFffQa/sitnFtiwKweRH3xU5mJiYw4zZbiFg5Q3O25O++Oth1jbOMJvKJBz9soFcrC+GSxZMy2qxZHSXQdNLbeNlt5VWfdLcNLEgZKxoX3BzIk8h5I4B88rGX5c1/BhhkerrE+WMg79p5d8mnnA9TwX+3JFTkHteeEj7dcsutguLMd+9q84NXlF2sUFgN6+4Zo45FkmIkILd/ZasC+0W8NxJSxEg1BrZJh5ir2Xy3A1y0luzFy2f25U7OkwqC6bpg1pxTvMTWecjZ0krejp73yWDtJzw7xDawg3uwAWIe2PbQnnM5mMfB0zxHe9ialH236MAPmdhr0HKIG0Uh/9LCoLDAX/t+8MemPB8HODzMEQfEBpzEtALtk0958+HIwjbYu9ehE4zzexHncA6cjeU/LhtTjgnOek+4mPoYSxn/gR+D95nM69RkeHDsJ39cMo4ODgopbJUw==",
+      "AUTHENTIK_POSTGRESQL__PORT": "AgAFriuia/LohPqNw8jP1EI7NJBVyAuWxPvm7CN5YUjYjb/YRlsRO0yN/Op+lnw0KfOJQw3fr0rz8ccBl/TPS/6x5AFStqAYt6WSfMuyAjD16IfVS4tWH6ZBamtN35u8pBjk6h64p4l3Cyo65L5/Aou1zhWU8LZ27HrngVJJOM13k8JtuAwSB3pTf+aMaJem5Jc8tY4MAdEtpwiib+KtWEMDG6PAPJACtgC6h9mZbIf1DC9jLSZaGA4O7S1za4GZb7Cef4Z43xQmAI94RaYemU55VF+jJucMUwpG6SQSWSGUHOFS3rPHCUK0gK7nNomL/ryaaHi2SU52XL1oVRwbq2MzAb3M6PEMzfl6eK4fHYM5+GPGf8pnsfpQfs1XZxUYNqGYfIHTcYfBj4ffY6TqBq9iLEMtkmpM+6Wxtc7IfdEBCYHsphRmOOwB/RAVMtpBW2gmzpJwrRLQ6r4r7JjOr55A0I0TTGSm7ijKnGY+GuYJkeKfJ9vM5/wnbGGIh0hWMbnKpzlP8r7bbRp9qqC8GE6YdorzJEnBHKaP6r7NgRUt+cQI9kh/KLTOydrtHx+X15LajklBqwPnqAqNCx+jDe8e26BOS1N9qT0/lLyR1io7ZljMnxXAhu0cPF4uxJscHfaisVM6X925kWOAJqmcncngTN/7V/pK4pbGi8+VTV09vvcgDZHIEDPRexbFUl2dfBFsWWd7",
+      "AUTHENTIK_POSTGRESQL__USER": "AgBQsWvJfbOp72ChEu2bdraPpYyIB34u95hvLHe+mDaJjGanrC1ifl/2spJJDc1Mi2BGUPxIAJVt8Fz0POC/lHaq5+kX8SeF/BLcjTXZeaKGlx1y1UpGFwcNF1VIJni/hqqFTc2Q3cMwv4OxEJgCzI9PGvduA7jJjzQDz9c5M9AzIbzte3GZEYvOHWMfG5yvPY+Vo14+CVDoLc7o/HRJ4AB/zWcAFEmK2pwh+4ZDA2CONkk6KwKy0KSk+bQne/6tS2hXkyT9MTna3KTYvQp5w6b9sprFb5lIsk5QgAYeEMkFwsAaBWbWuLttq+QTFAIIFiWGAw94ON7nGE+iPjLz+PL2uQmEEusy9Qeu5sP61gCS+mEGTQEWi9M65sgm4bL0tqt39Ty9UzJY0WTmbaC5ioixsriovirBllTHmz6UonfEVwZhiNTxgQSfEuwfs4Pj+0LFKJ1UJBeUFZYKHW7Ixnm/tUinbVqFvXd98HgEjgi0xKgsUwPFkHqlhEgdu3QVhGkV9lNHwjNDBrk3SXaZ9DSsrcCxGMDxlc11CRPuifYCRmBSx6OXJDBLD2fmqWsq8LqgLSjPIdK5KyD6G2nfP6DePTh5yKrnb6gbb0aUkVDB9jlWXD5kBCAFct6ql/AbwuraZHvfExo2fX1rX4/7i87hNMVhSiXcOtB+VAmMAf7mbKRXKIaO16JR5JMH52IFfUYGRxGyDOnAyGM=",
+      "AUTHENTIK_REDIS__HOST": "AgAGtlVDGAAGLwmEUIUi4NvFUYZ08kq+Q4ZyP84eMqSYR3U0fAFQ1VhCUVhsrHVIIM/WeWwr/kqp4F8qYFUBGRcezRLKObogapWtRc1lkb5ayERXZUF1H+E8S4YtEsa+Y6InH6DHm0hTIY970k6a1HwV0Y8VuCawuXCF6Rc9VIq88GTpXT4PYCrsYwoGBH+xH/sz85OBlf9YYKZYX4s0i+Wm6DYSFcdoi75IEm3p3RNXpkwBwdZJNKJ9msUGlKBjRvHLoi+T1tCqxfvzh5q6bWEZR4JphNhl3C8psxsxxFoRIRTzh+FwJJov1ps4y+E/G56RBa5ClSYQsa498PdqENlD7vROILmD44FbhOcHmfp7vltI401aJydAMWAvG637Ugmvfrd2H/rBHHDWipBrCB7ih+n1tPmWeDC9Uo4nVLz+GVGfGMb4fI7CJaSk1WTRwCsuwjnxUnD7js0hW3IEUzcPceUXe0SV88R6pyDrXZpBW5fTbfyBcwG5VjoZtEgmDEci/mrP2T1hPZ2JVumxdbNvlIdby7e9qElrpB+5ny0kHev13GOBga0ZpUVrSmFnGMAil0NMjqLmUPWqE5Yp66TF64PGJqejlf6q7+Fvy0r9OpWG8eN9Q+59OEdhDadswEImOu62BmX+oHsLi6UHxPdfUZrRGIzoFYeBCo2TVRzqk6MbmaiVut2m0HPRER47ownM4VNyS32w+KLhUGECYZk=",
+      "AUTHENTIK_SECRET_KEY": "AgBBfeEC5uZ2cENxnvO0uXPrBBRGZcqsCNvWEGSYFuUbrK57V2UfL1bj4Ka6D0HT8mJ4wdu4+fyzgcK+p8K3WlcyVEtTro2JYOxRme8Mzp/rB3tTSgqMU0d/7fhMwU9XunlEsJ0ZLSz4Kxc2SCzGf0jbfxEDKh+ThhqjITyCkkuBynIhnHqRWwi1bJByKKwEH9FtKyLLFiuJVIQLsbXirkW3mOnyEN632Jn0qbKDgqmO+fupRaa6bFSU6AzJYpzxiEnNjOlqKXO0kdBrrFhfHnoaLQ0daPLPIAWMfGhTAPXpukOgQHUgO2quRlM5+7Ipy+gMnGPu3mUJ0QXw9v/7b/EkIClYpLdxVcxovg1BFpcrsgJqiXWrA4M9VYBvuCkYx1LtIIKf8wGQFMIAk6jT+cAFHQgvl2zecd9vnaTcA1oPFvOHUOgc9nY611o+/HfJ7W6VswqCr+qhtp8boYCi/H8c4nFM+BcQ4luK3Asjv9Hd9lH5NrB59DBHQxP3mKy+H3fuIgMk8Bp1sPufQFjtspudj9G5VZKp3QhKNw707z/+9vulk8nvLa3gF3Iy0wGkDlpy71PW5LJBrsPNMXz4FLQLYHts2SsE21jSKr1XxEkzjvR/xbQchUbKpmdoBnqjv7RyDIezb8lzh1cAen/Icxwlz3K3IBbPbqlDmbcS/pnwosdXE/iQ3r9g0cxhDNjLvsL9uiMlVPFVl4RbrNRnkjJu+/vwlyQnBd+FKVQv32PzSeYg2WmMAjoR9RX0QQxoPFArSylNnKjEHhsxQ8onc9HojktXgXOH108oF4xB+bt3jFo="
+    }
+  }
+}

services/authentik/worker.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: authentik-worker}
+  template:
+    metadata:
+      labels: {app: authentik-worker}
+    spec:
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2026.5.8
+        args: ["worker"]
+        env:
+        - name: AUTHENTIK_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_SECRET_KEY
+        - name: AUTHENTIK_POSTGRESQL__HOST
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__HOST
+        - name: AUTHENTIK_POSTGRESQL__PORT
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__PORT
+        - name: AUTHENTIK_POSTGRESQL__NAME
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__NAME
+        - name: AUTHENTIK_POSTGRESQL__USER
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__USER
+        - name: AUTHENTIK_POSTGRESQL__PASSWORD
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_POSTGRESQL__PASSWORD
+        - name: AUTHENTIK_REDIS__HOST
+          valueFrom: 
+            secretKeyRef:
+              name: authentik-secret
+              key: AUTHENTIK_REDIS__HOST
+        - name: AUTHENTIK_ERROR_REPORTING__ENABLED
+          value: "false"
+        volumeMounts:
+          - name: media
+            mountPath: /media
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: authentik-media-pvc