cnpg with authentik

authentik/external-secret.yaml

@@ -23,7 +23,25 @@ spec:
       remoteRef:
         key: kv/authentik
         property: bootstrap_token
-    - secretKey: postgres_password
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: authentik-postgres-credentials
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: authentik-postgres-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: kv/authentik
+        property: postgres_user
+    - secretKey: password
       remoteRef:
         key: kv/authentik
         property: postgres_password

authentik/postgresql-cluster.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-postgres
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: authentik
+      secret:
+        name: authentik-postgres-credentials
+  storage:
+    storageClass: longhorn
+    size: 8Gi