apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentik
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true
    automated:
      prune: true
      selfHeal: true
  project: default
  sources:
    - chart: authentik
      repoURL: https://charts.goauthentik.io
      targetRevision: 2026.2.1
      helm:
        values: |
          authentik:
            secret_key: ""
            bootstrap_password: ""
            bootstrap_token: ""
            postgresql:
              host: authentik-postgres-rw
              name: authentik
              user: authentik
              password: ""
            existingSecret:
              secretName: authentik-secrets
          global:
            env:
              - name: AUTHENTIK_SECRET_KEY
                valueFrom:
                  secretKeyRef:
                    name: authentik-secrets
                    key: secret_key
              - name: AUTHENTIK_BOOTSTRAP_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: authentik-secrets
                    key: bootstrap_password
              - name: AUTHENTIK_BOOTSTRAP_TOKEN
                valueFrom:
                  secretKeyRef:
                    name: authentik-secrets
                    key: bootstrap_token
              - name: AUTHENTIK_POSTGRESQL__HOST
                value: authentik-postgres-rw
              - name: AUTHENTIK_POSTGRESQL__NAME
                value: authentik
              - name: AUTHENTIK_POSTGRESQL__USER
                valueFrom:
                  secretKeyRef:
                    name: authentik-postgres-credentials
                    key: username
              - name: AUTHENTIK_POSTGRESQL__PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: authentik-postgres-credentials
                    key: password
              - name: VAULT_OIDC_CLIENT_SECRET
                valueFrom:
                  secretKeyRef:
                    name: vault-oidc-client-secret
                    key: client_secret
          server:
            volumes:
              - name: custom-blueprints
                configMap:
                  name: authentik-blueprint-vault
            volumeMounts:
              - name: custom-blueprints
                mountPath: /blueprints/custom/vault-oidc.yaml
                subPath: vault-oidc.yaml
            ingress:
              enabled: true
              ingressClassName: nginx
              annotations:
                cert-manager.io/cluster-issuer: prod-cluster-issuer
              hosts:
                - authentik.rubenhensen.nl
              tls:
                - secretName: authentik-tls
                  hosts:
                    - authentik.rubenhensen.nl
          worker:
            volumes:
              - name: custom-blueprints
                configMap:
                  name: authentik-blueprint-vault
            volumeMounts:
              - name: custom-blueprints
                mountPath: /blueprints/custom/vault-oidc.yaml
                subPath: vault-oidc.yaml
          postgresql:
            enabled: false
          redis:
            enabled: true
            master:
              persistence:
                storageClass: longhorn
                size: 2Gi
    - repoURL: https://github.com/rubenhensen/k8scd.git
      targetRevision: HEAD
      path: authentik
      directory:
        include: "*.yaml"
        exclude: "authentik-helm.yaml"
  destination:
    server: https://kubernetes.default.svc
    namespace: authentik