apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: authentik namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: syncPolicy: syncOptions: - CreateNamespace=true automated: prune: true selfHeal: true project: default sources: - chart: authentik repoURL: https://charts.goauthentik.io targetRevision: 2026.8.5 helm: values: | authentik: secret_key: "" bootstrap_password: "" bootstrap_token: "" postgresql: host: authentik-postgres-rw name: authentik user: authentik password: "" existingSecret: secretName: authentik-secrets global: env: - name: AUTHENTIK_SECRET_KEY valueFrom: secretKeyRef: name: authentik-secrets key: secret_key - name: AUTHENTIK_BOOTSTRAP_PASSWORD valueFrom: secretKeyRef: name: authentik-secrets key: bootstrap_password - name: AUTHENTIK_BOOTSTRAP_TOKEN valueFrom: secretKeyRef: name: authentik-secrets key: bootstrap_token - name: AUTHENTIK_POSTGRESQL__HOST value: authentik-postgres-rw - name: AUTHENTIK_POSTGRESQL__NAME value: authentik - name: AUTHENTIK_POSTGRESQL__USER valueFrom: secretKeyRef: name: authentik-postgres-credentials key: username - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: name: authentik-postgres-credentials key: password - name: VAULT_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: vault-oidc-client-secret key: client_secret - name: STALWART_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: stalwart-oidc-client-secret key: client_secret - name: ARGOCD_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: argocd-oidc-client-secret key: client_secret - name: FRESHRSS_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: freshrss-oidc-client-secret key: client_secret - name: ACTUALBUDGET_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: actualbudget-oidc-client-secret key: client_secret - name: LONGHORN_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: longhorn-oidc-client-secret key: client_secret # Point OpenSSL and requests (which uses certifi otherwise) at # patched-ca-bundle, mounted below until the image drops the # compromised eMudhra intermediates. - name: SSL_CERT_FILE value: /etc/ssl/certs/ca-certificates.crt - name: REQUESTS_CA_BUNDLE value: /etc/ssl/certs/ca-certificates.crt server: resources: requests: cpu: 70m memory: 560Mi volumes: - name: patched-ca-bundle configMap: name: patched-ca-bundle - name: blueprint-vault configMap: name: authentik-blueprint-vault - name: blueprint-mail configMap: name: authentik-blueprint-mail - name: blueprint-ldap configMap: name: authentik-blueprint-ldap - name: blueprint-argocd configMap: name: authentik-blueprint-argocd - name: blueprint-freshrss configMap: name: authentik-blueprint-freshrss - name: blueprint-actualbudget configMap: name: authentik-blueprint-actualbudget - name: blueprint-session configMap: name: authentik-blueprint-session - name: blueprint-longhorn configMap: name: authentik-blueprint-longhorn # Directory mounts, not subPath, so changes reach the pods # without a restart. The secrets are optional: a blueprint # that needs a missing one fails until it shows up. - name: blueprint-scouting configMap: name: authentik-blueprint-scouting - name: scouting-secrets projected: sources: - secret: name: immich-oidc-client-secret optional: true items: - key: client_secret path: immich-oidc-client-secret - secret: name: scouts-online-client optional: true items: - key: client_id path: scouts-online-client-id - key: client_secret path: scouts-online-client-secret volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml subPath: vault-oidc.yaml - name: blueprint-mail mountPath: /blueprints/custom/mail-oidc.yaml subPath: mail-oidc.yaml - name: blueprint-ldap mountPath: /blueprints/custom/ldap.yaml subPath: ldap.yaml - name: blueprint-argocd mountPath: /blueprints/custom/argocd-oidc.yaml subPath: argocd-oidc.yaml - name: blueprint-freshrss mountPath: /blueprints/custom/freshrss-oidc.yaml subPath: freshrss-oidc.yaml - name: blueprint-actualbudget mountPath: /blueprints/custom/actualbudget-proxy.yaml subPath: actualbudget-proxy.yaml - name: blueprint-session mountPath: /blueprints/custom/session-duration.yaml subPath: session-duration.yaml - name: blueprint-longhorn mountPath: /blueprints/custom/longhorn-oidc.yaml subPath: longhorn-oidc.yaml - name: blueprint-scouting mountPath: /blueprints/custom/scouting - name: scouting-secrets mountPath: /secrets/scouting readOnly: true - name: patched-ca-bundle mountPath: /etc/ssl/certs readOnly: true worker: resources: requests: cpu: 100m memory: 336Mi volumes: - name: patched-ca-bundle configMap: name: patched-ca-bundle - name: blueprint-vault configMap: name: authentik-blueprint-vault - name: blueprint-mail configMap: name: authentik-blueprint-mail - name: blueprint-ldap configMap: name: authentik-blueprint-ldap - name: blueprint-argocd configMap: name: authentik-blueprint-argocd - name: blueprint-freshrss configMap: name: authentik-blueprint-freshrss - name: blueprint-actualbudget configMap: name: authentik-blueprint-actualbudget - name: blueprint-session configMap: name: authentik-blueprint-session - name: blueprint-longhorn configMap: name: authentik-blueprint-longhorn # Directory mounts, not subPath, so changes reach the pods # without a restart. The secrets are optional: a blueprint # that needs a missing one fails until it shows up. - name: blueprint-scouting configMap: name: authentik-blueprint-scouting - name: scouting-secrets projected: sources: - secret: name: immich-oidc-client-secret optional: true items: - key: client_secret path: immich-oidc-client-secret - secret: name: scouts-online-client optional: true items: - key: client_id path: scouts-online-client-id - key: client_secret path: scouts-online-client-secret volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml subPath: vault-oidc.yaml - name: blueprint-mail mountPath: /blueprints/custom/mail-oidc.yaml subPath: mail-oidc.yaml - name: blueprint-ldap mountPath: /blueprints/custom/ldap.yaml subPath: ldap.yaml - name: blueprint-argocd mountPath: /blueprints/custom/argocd-oidc.yaml subPath: argocd-oidc.yaml - name: blueprint-freshrss mountPath: /blueprints/custom/freshrss-oidc.yaml subPath: freshrss-oidc.yaml - name: blueprint-actualbudget mountPath: /blueprints/custom/actualbudget-proxy.yaml subPath: actualbudget-proxy.yaml - name: blueprint-session mountPath: /blueprints/custom/session-duration.yaml subPath: session-duration.yaml - name: blueprint-longhorn mountPath: /blueprints/custom/longhorn-oidc.yaml subPath: longhorn-oidc.yaml - name: blueprint-scouting mountPath: /blueprints/custom/scouting - name: scouting-secrets mountPath: /secrets/scouting readOnly: true - name: patched-ca-bundle mountPath: /etc/ssl/certs readOnly: true postgresql: enabled: false - repoURL: https://github.com/rubenhensen/k8scd.git targetRevision: HEAD path: authentik directory: include: "*.yaml" exclude: "authentik-helm.yaml" destination: server: https://kubernetes.default.svc namespace: authentik