Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 willemjan
|
b81955b323 | ||
|
willemjan
|
e416add06d | ||
|
willemjan
|
8f8569cb82 |
@@ -0,0 +1,2 @@
|
|||||||
|
infrastructure/sealedsecret/sealed-secrets-key-BACKUP.yaml
|
||||||
|
pub-sealed-secrets.pem
|
||||||
|
|||||||
@@ -0,0 +1,16 @@
|
|||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
|
||||||
|
targetRevision: main
|
||||||
|
path: services/authentik
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: authentik
|
||||||
|
syncPolicy:
|
||||||
|
automated: {prune: true, selfHeal: true}
|
||||||
@@ -0,0 +1,416 @@
|
|||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: secrets-unsealer
|
||||||
|
name: secrets-unsealer
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- bitnami.com
|
||||||
|
resources:
|
||||||
|
- sealedsecrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- bitnami.com
|
||||||
|
resources:
|
||||||
|
- sealedsecrets/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
minReadySeconds: 30
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxSurge: 25%
|
||||||
|
maxUnavailable: 25%
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args: []
|
||||||
|
command:
|
||||||
|
- controller
|
||||||
|
env: []
|
||||||
|
image: docker.io/bitnami/sealed-secrets-controller:0.41.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
- containerPort: 8081
|
||||||
|
name: metrics
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
stdin: false
|
||||||
|
tty: false
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /tmp
|
||||||
|
name: tmp
|
||||||
|
imagePullSecrets: []
|
||||||
|
initContainers: []
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 65534
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
serviceAccountName: sealed-secrets-controller
|
||||||
|
terminationGracePeriodSeconds: 30
|
||||||
|
volumes:
|
||||||
|
- emptyDir: {}
|
||||||
|
name: tmp
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
namespace: kube-system
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
subjects:
|
||||||
|
- apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Group
|
||||||
|
name: system:authenticated
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
name: sealed-secrets-key-admin
|
||||||
|
namespace: kube-system
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: sealedsecrets.bitnami.com
|
||||||
|
spec:
|
||||||
|
group: bitnami.com
|
||||||
|
names:
|
||||||
|
kind: SealedSecret
|
||||||
|
listKind: SealedSecretList
|
||||||
|
plural: sealedsecrets
|
||||||
|
singular: sealedsecret
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: |-
|
||||||
|
SealedSecret is the K8s representation of a "sealed Secret" - a
|
||||||
|
regular k8s Secret that has been sealed (encrypted) using the
|
||||||
|
controller's key.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: SealedSecretSpec is the specification of a SealedSecret.
|
||||||
|
properties:
|
||||||
|
data:
|
||||||
|
description: Data is deprecated and will be removed eventually. Use
|
||||||
|
per-value EncryptedData instead.
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
encryptedData:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
template:
|
||||||
|
description: |-
|
||||||
|
Template defines the structure of the Secret that will be
|
||||||
|
created from this sealed secret.
|
||||||
|
properties:
|
||||||
|
data:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: |-
|
||||||
|
Keys that should be templated using decrypted data.
|
||||||
|
Set a key with the same name as in `encryptedData`
|
||||||
|
to `null` to omit the unsealed data from the final secret.
|
||||||
|
nullable: true
|
||||||
|
type: object
|
||||||
|
immutable:
|
||||||
|
description: |-
|
||||||
|
Immutable, if set to true, ensures that data stored in the Secret cannot
|
||||||
|
be updated (only object metadata can be modified).
|
||||||
|
If not set to true, the field can be modified at any time.
|
||||||
|
Defaulted to nil.
|
||||||
|
type: boolean
|
||||||
|
metadata:
|
||||||
|
description: |-
|
||||||
|
Standard object's metadata.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
|
||||||
|
nullable: true
|
||||||
|
properties:
|
||||||
|
annotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
finalizers:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
labels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
type:
|
||||||
|
description: Used to facilitate programmatic handling of secret
|
||||||
|
data.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- encryptedData
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: SealedSecretStatus is the most recently observed status of
|
||||||
|
the SealedSecret.
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: Represents the latest available observations of a sealed
|
||||||
|
secret's current state.
|
||||||
|
items:
|
||||||
|
description: SealedSecretCondition describes the state of a sealed
|
||||||
|
secret at a certain point.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: Last time the condition transitioned from one status
|
||||||
|
to another.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
lastUpdateTime:
|
||||||
|
description: The last time this condition was updated.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: A human readable message indicating details about
|
||||||
|
the transition.
|
||||||
|
type: string
|
||||||
|
reason:
|
||||||
|
description: The reason for the condition's last transition.
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: |-
|
||||||
|
Status of the condition for a sealed secret.
|
||||||
|
Valid values for "Synced": "True", "False", or "Unknown".
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: |-
|
||||||
|
Type of condition for a sealed secret.
|
||||||
|
Valid value: "Synced"
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
observedGeneration:
|
||||||
|
description: ObservedGeneration reflects the generation most recently
|
||||||
|
observed by the sealed-secrets controller.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 8080
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
name: sealed-secrets-service-proxier
|
||||||
|
namespace: kube-system
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- sealed-secrets-controller
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- 'http:sealed-secrets-controller:'
|
||||||
|
- http:sealed-secrets-controller:http
|
||||||
|
- sealed-secrets-controller
|
||||||
|
resources:
|
||||||
|
- services/proxy
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller-metrics
|
||||||
|
name: sealed-secrets-controller-metrics
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 8081
|
||||||
|
targetPort: 8081
|
||||||
|
selector:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: secrets-unsealer
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: sealed-secrets-controller
|
||||||
|
namespace: kube-system
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: zb-kw-wildcard
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
secretName: zb-kw-wildcard-tls
|
||||||
|
dnsNames: ["auth.zb-kw.duckdns.org"]
|
||||||
|
issuerRef: {name: duckdns, kind: ClusterIssuer}
|
||||||
@@ -0,0 +1,125 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: authentik-media-pvc
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
storageClassName: nfs-client # NFS vanaf Proxmox — Bijlage A
|
||||||
|
accessModes: [ReadWriteMany]
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 5Gi
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-server
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels: {app: authentik-server}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {app: authentik-server}
|
||||||
|
spec:
|
||||||
|
initContainers:
|
||||||
|
- name: wait-for-db
|
||||||
|
image: busybox:latest # pin de tag! (Renovate houdt ze bij)
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
until nc -z authentik-postgresql 5432; do
|
||||||
|
echo "Waiting for PostgreSQL..."
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
echo "PostgreSQL is ready!"
|
||||||
|
containers:
|
||||||
|
- name: authentik
|
||||||
|
image: ghcr.io/goauthentik/server:2026.5.8
|
||||||
|
args: ["server"]
|
||||||
|
env:
|
||||||
|
- name: AUTHENTIK_SECRET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_SECRET_KEY
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__PORT
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
- name: AUTHENTIK_REDIS__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_REDIS__HOST
|
||||||
|
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
|
||||||
|
value: "false"
|
||||||
|
ports:
|
||||||
|
- containerPort: 9000
|
||||||
|
name: http
|
||||||
|
- containerPort: 9443
|
||||||
|
name: https
|
||||||
|
volumeMounts:
|
||||||
|
- name: media
|
||||||
|
mountPath: /media
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /-/health/live/
|
||||||
|
port: 9000
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 30
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /-/health/ready/
|
||||||
|
port: 9000
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 30
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "512Mi"
|
||||||
|
cpu: "250m"
|
||||||
|
limits:
|
||||||
|
memory: "1Gi"
|
||||||
|
cpu: "1000m"
|
||||||
|
volumes:
|
||||||
|
- name: media
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: authentik-media-pvc
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: authentik-server
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
selector: {app: authentik-server}
|
||||||
|
ports:
|
||||||
|
- port: 9000
|
||||||
|
targetPort: 9000
|
||||||
|
name: http
|
||||||
|
- port: 9443
|
||||||
|
targetPort: 9443
|
||||||
|
name: https
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
|
namespace: authentik
|
||||||
|
annotations:
|
||||||
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||||
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
|
spec:
|
||||||
|
ingressClassName: traefik
|
||||||
|
rules:
|
||||||
|
- host: auth.zb-kw.duckdns.org
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: authentik-server
|
||||||
|
port:
|
||||||
|
number: 9000
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- auth.zb-kw.duckdns.org
|
||||||
|
secretName: zb-kw-wildcard-tls
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: authentik-forwardauth
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-authentik-username
|
||||||
|
- X-authentik-groups
|
||||||
|
- X-authentik-email
|
||||||
|
- X-authentik-name
|
||||||
|
- X-authentik-uid
|
||||||
|
---
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: authentik-forwardauth-with-cookies
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: http://authentik-server.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-authentik-username
|
||||||
|
- X-authentik-groups
|
||||||
|
- X-authentik-email
|
||||||
|
- X-authentik-name
|
||||||
|
- X-authentik-uid
|
||||||
|
- Set-Cookie
|
||||||
|
- Cookie
|
||||||
|
authRequestHeaders:
|
||||||
|
- X-Forwarded-Proto
|
||||||
|
- X-Forwarded-Host
|
||||||
|
- X-Forwarded-Uri
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: authentik
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: authentik-postgres-pvc
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-postgresql
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels: {app: authentik-postgresql}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {app: authentik-postgresql}
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: postgresql
|
||||||
|
image: postgres:16-alpine
|
||||||
|
env:
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgres-secret
|
||||||
|
key: POSTGRES_PASSWORD
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgres-secret
|
||||||
|
key: POSTGRES_USER
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-postgres-secret
|
||||||
|
key: POSTGRES_DB
|
||||||
|
ports:
|
||||||
|
- containerPort: 5432
|
||||||
|
volumeMounts:
|
||||||
|
- name: postgres-data
|
||||||
|
mountPath: /var/lib/postgresql/data
|
||||||
|
volumes:
|
||||||
|
- name: postgres-data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: authentik-postgres-pvc
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: authentik-postgresql
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: authentik-postgresql
|
||||||
|
ports:
|
||||||
|
- port: 5432
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-redis
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels: {app: authentik-redis}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {app: authentik-redis}
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: redis
|
||||||
|
image: redis:alpine
|
||||||
|
ports:
|
||||||
|
- containerPort: 6379
|
||||||
|
name: redis
|
||||||
|
command:
|
||||||
|
- redis-server
|
||||||
|
- --save
|
||||||
|
- "60"
|
||||||
|
- "1"
|
||||||
|
- --logLevel
|
||||||
|
- warning
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "256Mi"
|
||||||
|
cpu: "200m"
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: authentik-redis
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
selector: {app: authentik-redis}
|
||||||
|
ports:
|
||||||
|
- port: 6379
|
||||||
|
targetPort: 6379
|
||||||
|
name: redis
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{
|
||||||
|
"kind": "SealedSecret",
|
||||||
|
"apiVersion": "bitnami.com/v1alpha1",
|
||||||
|
"metadata": {
|
||||||
|
"name": "authentik-postgres-secret",
|
||||||
|
"namespace": "authentik"
|
||||||
|
},
|
||||||
|
"spec": {
|
||||||
|
"template": {
|
||||||
|
"metadata": {
|
||||||
|
"name": "authentik-postgres-secret",
|
||||||
|
"namespace": "authentik"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"encryptedData": {
|
||||||
|
"POSTGRES_DB": "AgBlewltIxvwrrfMzpf1dlutVlStrPAlVmmTpRn7eBJ7CBfLKVBeiI1XoJXERFJl1PzOjO2by3J0/1CI3uAjcDq06CWyUHWNGdFsz/vkf570I3WFtSt5jeaNZtwgDdY6HRrvb23VAu3qqQtWuefPhIpUjqJAjNm+CktHAaF9ZS8VjvQ0zlFbeorZiIQf4W5rInfVKzEIrwrK1XMhXU7IM7ckWqZxI13KjGFqdlr2knTqbtNz8s6jID7V5sMk8v9eyerxv0bzTaiJdKi36SaH/SuDjETSqOEH6WEEjKgVvB5EBLFRBUwkV8EG8rVuNpGc3Fd9RhZX7ehVOGvmKFdvEmYrhNBV5JKUPj7beLdqP9wIKXvG1/R+Md5PhtWDbguXTVwHzTzFmMl2KfFjIR/jDhb64mUM6/SHphko+N48OQHPfyhTRZpDV8K3SfMo352atj+gLFEn42TWT+0D1rf84oGX0ztQltQMHv0xQuBRwKR6FJnYnt7ii8x3J+p8tQnd/JhvzaDt81f7GQv5avv/SFlvh/XxXGsZRz7695bzmOpxT1AEn9Zn/SCtIT0xX752trCcRaKV/9Jm2kOFWcCEm3ynQOlojLKugzoFiensfxKtywoTyESPSSIessSMX4hSezDGaprWjPG/ChK52IZz2LJHfdWyKgpYaQi/lPN6Jtq01wlKquhvs6UM6L8YIfL9NfsuWxRB7IsSZAI=",
|
||||||
|
"POSTGRES_PASSWORD": "AgCZncbrbavs+MADjKwVQ+Euk93PFHiyvMTdsDKFr6bRR0JkemG2vXwJURlUkkjExSpMvnHL6RhkXbtvhP53tFWnf8tqyk5Wg1ARrNg/H4LOobvLUwmKMEcpkqNj+w/585ijR6X0oFxxbh6dHyMjert4ASuMR8H2wlGChzE7GHp3PjZaPUlJAWk0iIBVQ3R9U9BavxbXa0zaoJQBEu6SZ8MNzyq14PPhLG2XD2k8qu4KyEIxAJhh+YO28GXVAQItSYui7T4S4UsRb3GH83rTBs97Wjn2PzGK0dl2D6Oc/Tol7UGbqTV00P5kVxc6mVOzw+aWVZekBw6KjrZ0sqWBQi/DtoFnECQkvERbEpQ5WaifsHjHnAf7o9DBjM2Lsn+UK5Ti1OMG5u3kcZAqo6opijjyGTxpyq51T2bZZpHbd2//k0aBax65fSo7YSqSEjICTu6LKGUprgCNfJC1Yi+GfXUVqDF6sA/gpcgkRp0zztaUoNXypzIfZQIEnTeCTncHDgwgTM6CM5l+ZUB4ApmbEzqP16SFojlGGVfUzeM8r2+KO/oUaFJI+QbVOU1gS5CQEEJ+ZdLsvYAaTPp/KkqEkSYQ2FkII8bGKBJjio8M8KTozSCDEiA7cBBnCqOI54F1vqrsCLcGFuwj910NoXUfyYzp5Sv4IiTVHWB7MboooLfAJ6X6Xzzjp6nthrmmPENXUitDo5eFOrQ/SrYIYjm7NRwAO7cCretlxqYFnSOL6ojLhz1Xb3aCltV7U0T3ZA==",
|
||||||
|
"POSTGRES_USER": "AgAMSJLtQvx4XygOyFrtJhfMwd6ylleyYtajd1TKQm47s5ZJVvQkBvVBN4LN29wvCbVC+Umu9EoXmP9ugIB96LTApPAQAt0q+IuLYrHwvOFRbrjubpqkDJh5GpSvogXLIQ4oTUO9C4n8++Lvun6695DYEck4ezcRp8tP2syXQc1UHHMQexfnhM9fIRuopvpWUc0Iqb73wh6MofbpCGR5sZHPQ35l65ZovmOv8gAKZbCcDT63fHN903kYbm9fqNSmyBLiBXn5qDKWz1LZrIPZ/BGgmNMfLvwKvmjSNLrP8iNgOzv2I1aeR7g+ss61T3GHHNno7IswAJWmUOTg1NCs4SEVOD4FthmiIlnAd8VkcuICiufduRMxQ1wTfIKCd/s4+u4YrNRmIxiFAG2G87GoFC6vO7QxbD7rLMxJsRrAf2x8RwaY3f1p/OWgyfqqdwkrLmp3VAVnibyaNdvkGfkj0y+kOQ3kZrS/zdgww6vrWo3Bziwj1ZwVtX7A32nw8LeeKlaQMbmjsazN8fH4sjWuXiy2wkn/XJsRHNo2za/45XlLbfH9JJZazDRDreAiwBD21t1ogsqAGPd/WlD5FzD4XU7qiLqHQZfxlcXOYmq2N19gmUo41bs4RBfwGpLzUz+3Qg3sqj79WvHgH4JWWi07MsmRy9q9/FSrYJRpNm8x3/s069eVL2XgWzCLlSZUx3D9DAyipoVdooGlE2k="
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
{
|
||||||
|
"kind": "SealedSecret",
|
||||||
|
"apiVersion": "bitnami.com/v1alpha1",
|
||||||
|
"metadata": {
|
||||||
|
"name": "authentik-secret",
|
||||||
|
"namespace": "authentik"
|
||||||
|
},
|
||||||
|
"spec": {
|
||||||
|
"template": {
|
||||||
|
"metadata": {
|
||||||
|
"name": "authentik-secret",
|
||||||
|
"namespace": "authentik"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"encryptedData": {
|
||||||
|
"AUTHENTIK_POSTGRESQL__HOST": "AgCW4vQ2sjaRFWrzyMPRwXl5FdFY4gWrzqYrmxeO4RtylWuJ+USekNtPLbS8ibPN1w8s0Agwl4Jb5zJ1C/R2Y8C1vP4FugMSWf7F7Vm9DaP7weDrq7EC6pRPeK1b8Bqlkl1hPhzZloOX5LfCYY9laD5L3UGsXqC8Z2E06EduK1J8fnpY8OfawWppz79TkwNPGngGJk7to9aZI6SGVnnwZ4CdH3P3LTck0IHC3VJKYyxdK9XmQ4Msdd4lDRvA2rdDfg+2EvwRCeJ6m7qTtSL8Z1vCBMYEmyifb3UBake6nDj71OOacYWoIk4CUY39gS5MlQqqe+dftZmI4lvx8v5ViFYhaO1fI0EkQOTZwaLcvm5LZtvVwwsFWnBiI11sUl//gyDRz+5SVvlGhOA0rpPxZ2pqe0VKcFZicE7A+Nw3HYkbKFm3G9lfBG4YOIPnA4SX6Q857AJ2RRXk1Zu1jvzGVAm39iL5xNlHV1dbpsJpnGiTmnEL7UrQtcLy6mJyqJAuo/HhzKFsFpEllMFWoROoxK2zfr7hfZIA8j1kPoTh5Xs907MnJJWPQZX6hAII8MObwgaM2XOxkP1cBi5NIMQaPcrcER7uaMjzmYMNXQSaI7tFOExJquH64RStWts/LBH7xUuy5NSzs/1Lyn83V7+wQTMe+sP++x0b8ResIgq2LW8l+ZuEBBR4Q93MQTTJP/yZ0P5o1lFNqfMOhAKjCOr0HI4E45a85w==",
|
||||||
|
"AUTHENTIK_POSTGRESQL__NAME": "AgAlE5AU+tZ4+c7NIeBWsi8Q4mgaEO2znOFWp5NOUCBoM+KYG0aDWGmk7MBP2HtbdlJlkUs51IYWoaDb6tnV3AwQVB5WPaVI9dBVwiBdsBw0XVdwn08Hbp6mfiURqLNVAuqM44d1bep1ddiRi44+1Pa27bceO/ROVNyQEHjutPka6Tys7rXzEAIlCGeyI1ZcpsDGAFtgwQyBfQHNxKl8d0rgviLBXzTsuc4KJRN5Y6WV4GzgZa9iD3EacRcdp3hLSX8LqsswWpvASUMrmtymO9l1bI3lUh46QQuCAzWXKHiW7GkcZHSdPjvQsZQKYeO/LrkMknUuMiq60ETusyM23GqOz6hXLXmJhKtsc1x3AvzZDCxCW1SwcHKr9QuUH55gKgjm3ms4zrAaoECfcSH3ZzwnASIRgT+BiQRUfleyG4P5GgxMzN0Zxog6w90EIGhsjegIN6PZwO13DdcBBfCRoYhZOax2shW4hrvZMxYo+l/VNqxNopy0cx2befyoy+e2J+qEOExaWA5S8XQelQQCl8fSwSt+Wn5uzZleAK+0xzo5ZycYXPbnqLpPxVuYi5edomH0K4qMP5xnYEcN090PExgiHkxtzD1lv5QIVPY9NsYRtikdSf1NQ1NXuA6dgJBp80ZnTJpYKDr9v06yvJ+I2TVzHL87AVF+9RZEV3BIUIX6nBrcuBXHN4qeNhudio5VFp879/CwyAkPMN4=",
|
||||||
|
"AUTHENTIK_POSTGRESQL__PASSWORD": "AgCq22ubUvWQUrr7ztj2po2YMTFlKoWOy00QE7GNr6I6Fn8MkA61d//6HEhWpLJ9ETJogClDZEKLhNKrNtwiAXXw82gfUkzI51nJm+VrEfaZQsLQJT7WxDHLdbpRQjsgMqa+sZfjaCTdozzFdMbelYKl3/GBPrOPV521P404F3d9Cx4+NI+FpGGKaukTd1fLIlEiayELbiRnDjdXODXnNJ6NNpFRvfqi1wEVZ58HTn0tIVdJUrcBM+WY7up5MMwQJyK0dZ6NFpeUFQpd/W25lyuaPiSaYCLWLKSDMtKKmCfzk/J3VZ5s+yFffQa/sitnFtiwKweRH3xU5mJiYw4zZbiFg5Q3O25O++Oth1jbOMJvKJBz9soFcrC+GSxZMy2qxZHSXQdNLbeNlt5VWfdLcNLEgZKxoX3BzIk8h5I4B88rGX5c1/BhhkerrE+WMg79p5d8mnnA9TwX+3JFTkHteeEj7dcsutguLMd+9q84NXlF2sUFgN6+4Zo45FkmIkILd/ZasC+0W8NxJSxEg1BrZJh5ir2Xy3A1y0luzFy2f25U7OkwqC6bpg1pxTvMTWecjZ0krejp73yWDtJzw7xDawg3uwAWIe2PbQnnM5mMfB0zxHe9ialH236MAPmdhr0HKIG0Uh/9LCoLDAX/t+8MemPB8HODzMEQfEBpzEtALtk0958+HIwjbYu9ehE4zzexHncA6cjeU/LhtTjgnOek+4mPoYSxn/gR+D95nM69RkeHDsJ39cMo4ODgopbJUw==",
|
||||||
|
"AUTHENTIK_POSTGRESQL__PORT": "AgAFriuia/LohPqNw8jP1EI7NJBVyAuWxPvm7CN5YUjYjb/YRlsRO0yN/Op+lnw0KfOJQw3fr0rz8ccBl/TPS/6x5AFStqAYt6WSfMuyAjD16IfVS4tWH6ZBamtN35u8pBjk6h64p4l3Cyo65L5/Aou1zhWU8LZ27HrngVJJOM13k8JtuAwSB3pTf+aMaJem5Jc8tY4MAdEtpwiib+KtWEMDG6PAPJACtgC6h9mZbIf1DC9jLSZaGA4O7S1za4GZb7Cef4Z43xQmAI94RaYemU55VF+jJucMUwpG6SQSWSGUHOFS3rPHCUK0gK7nNomL/ryaaHi2SU52XL1oVRwbq2MzAb3M6PEMzfl6eK4fHYM5+GPGf8pnsfpQfs1XZxUYNqGYfIHTcYfBj4ffY6TqBq9iLEMtkmpM+6Wxtc7IfdEBCYHsphRmOOwB/RAVMtpBW2gmzpJwrRLQ6r4r7JjOr55A0I0TTGSm7ijKnGY+GuYJkeKfJ9vM5/wnbGGIh0hWMbnKpzlP8r7bbRp9qqC8GE6YdorzJEnBHKaP6r7NgRUt+cQI9kh/KLTOydrtHx+X15LajklBqwPnqAqNCx+jDe8e26BOS1N9qT0/lLyR1io7ZljMnxXAhu0cPF4uxJscHfaisVM6X925kWOAJqmcncngTN/7V/pK4pbGi8+VTV09vvcgDZHIEDPRexbFUl2dfBFsWWd7",
|
||||||
|
"AUTHENTIK_POSTGRESQL__USER": "AgBQsWvJfbOp72ChEu2bdraPpYyIB34u95hvLHe+mDaJjGanrC1ifl/2spJJDc1Mi2BGUPxIAJVt8Fz0POC/lHaq5+kX8SeF/BLcjTXZeaKGlx1y1UpGFwcNF1VIJni/hqqFTc2Q3cMwv4OxEJgCzI9PGvduA7jJjzQDz9c5M9AzIbzte3GZEYvOHWMfG5yvPY+Vo14+CVDoLc7o/HRJ4AB/zWcAFEmK2pwh+4ZDA2CONkk6KwKy0KSk+bQne/6tS2hXkyT9MTna3KTYvQp5w6b9sprFb5lIsk5QgAYeEMkFwsAaBWbWuLttq+QTFAIIFiWGAw94ON7nGE+iPjLz+PL2uQmEEusy9Qeu5sP61gCS+mEGTQEWi9M65sgm4bL0tqt39Ty9UzJY0WTmbaC5ioixsriovirBllTHmz6UonfEVwZhiNTxgQSfEuwfs4Pj+0LFKJ1UJBeUFZYKHW7Ixnm/tUinbVqFvXd98HgEjgi0xKgsUwPFkHqlhEgdu3QVhGkV9lNHwjNDBrk3SXaZ9DSsrcCxGMDxlc11CRPuifYCRmBSx6OXJDBLD2fmqWsq8LqgLSjPIdK5KyD6G2nfP6DePTh5yKrnb6gbb0aUkVDB9jlWXD5kBCAFct6ql/AbwuraZHvfExo2fX1rX4/7i87hNMVhSiXcOtB+VAmMAf7mbKRXKIaO16JR5JMH52IFfUYGRxGyDOnAyGM=",
|
||||||
|
"AUTHENTIK_REDIS__HOST": "AgAGtlVDGAAGLwmEUIUi4NvFUYZ08kq+Q4ZyP84eMqSYR3U0fAFQ1VhCUVhsrHVIIM/WeWwr/kqp4F8qYFUBGRcezRLKObogapWtRc1lkb5ayERXZUF1H+E8S4YtEsa+Y6InH6DHm0hTIY970k6a1HwV0Y8VuCawuXCF6Rc9VIq88GTpXT4PYCrsYwoGBH+xH/sz85OBlf9YYKZYX4s0i+Wm6DYSFcdoi75IEm3p3RNXpkwBwdZJNKJ9msUGlKBjRvHLoi+T1tCqxfvzh5q6bWEZR4JphNhl3C8psxsxxFoRIRTzh+FwJJov1ps4y+E/G56RBa5ClSYQsa498PdqENlD7vROILmD44FbhOcHmfp7vltI401aJydAMWAvG637Ugmvfrd2H/rBHHDWipBrCB7ih+n1tPmWeDC9Uo4nVLz+GVGfGMb4fI7CJaSk1WTRwCsuwjnxUnD7js0hW3IEUzcPceUXe0SV88R6pyDrXZpBW5fTbfyBcwG5VjoZtEgmDEci/mrP2T1hPZ2JVumxdbNvlIdby7e9qElrpB+5ny0kHev13GOBga0ZpUVrSmFnGMAil0NMjqLmUPWqE5Yp66TF64PGJqejlf6q7+Fvy0r9OpWG8eN9Q+59OEdhDadswEImOu62BmX+oHsLi6UHxPdfUZrRGIzoFYeBCo2TVRzqk6MbmaiVut2m0HPRER47ownM4VNyS32w+KLhUGECYZk=",
|
||||||
|
"AUTHENTIK_SECRET_KEY": "AgBBfeEC5uZ2cENxnvO0uXPrBBRGZcqsCNvWEGSYFuUbrK57V2UfL1bj4Ka6D0HT8mJ4wdu4+fyzgcK+p8K3WlcyVEtTro2JYOxRme8Mzp/rB3tTSgqMU0d/7fhMwU9XunlEsJ0ZLSz4Kxc2SCzGf0jbfxEDKh+ThhqjITyCkkuBynIhnHqRWwi1bJByKKwEH9FtKyLLFiuJVIQLsbXirkW3mOnyEN632Jn0qbKDgqmO+fupRaa6bFSU6AzJYpzxiEnNjOlqKXO0kdBrrFhfHnoaLQ0daPLPIAWMfGhTAPXpukOgQHUgO2quRlM5+7Ipy+gMnGPu3mUJ0QXw9v/7b/EkIClYpLdxVcxovg1BFpcrsgJqiXWrA4M9VYBvuCkYx1LtIIKf8wGQFMIAk6jT+cAFHQgvl2zecd9vnaTcA1oPFvOHUOgc9nY611o+/HfJ7W6VswqCr+qhtp8boYCi/H8c4nFM+BcQ4luK3Asjv9Hd9lH5NrB59DBHQxP3mKy+H3fuIgMk8Bp1sPufQFjtspudj9G5VZKp3QhKNw707z/+9vulk8nvLa3gF3Iy0wGkDlpy71PW5LJBrsPNMXz4FLQLYHts2SsE21jSKr1XxEkzjvR/xbQchUbKpmdoBnqjv7RyDIezb8lzh1cAen/Icxwlz3K3IBbPbqlDmbcS/pnwosdXE/iQ3r9g0cxhDNjLvsL9uiMlVPFVl4RbrNRnkjJu+/vwlyQnBd+FKVQv32PzSeYg2WmMAjoR9RX0QQxoPFArSylNnKjEHhsxQ8onc9HojktXgXOH108oF4xB+bt3jFo="
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,69 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: authentik-worker
|
||||||
|
namespace: authentik
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels: {app: authentik-worker}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {app: authentik-worker}
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: authentik
|
||||||
|
image: ghcr.io/goauthentik/server:2026.5.8
|
||||||
|
args: ["worker"]
|
||||||
|
env:
|
||||||
|
- name: AUTHENTIK_SECRET_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_SECRET_KEY
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__HOST
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__PORT
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__NAME
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__USER
|
||||||
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||||
|
- name: AUTHENTIK_REDIS__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: authentik-secret
|
||||||
|
key: AUTHENTIK_REDIS__HOST
|
||||||
|
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
|
||||||
|
value: "false"
|
||||||
|
volumeMounts:
|
||||||
|
- name: media
|
||||||
|
mountPath: /media
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "256Mi"
|
||||||
|
cpu: "250m"
|
||||||
|
limits:
|
||||||
|
memory: "512Mi"
|
||||||
|
cpu: "500m"
|
||||||
|
volumes:
|
||||||
|
- name: media
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: authentik-media-pvc
|
||||||
Reference in New Issue
Block a user