mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-16 18:02:55 +02:00
Ruben Hensen
20cf119dbd
Authentik's default-authentication-login stage ships with session_duration: seconds=0, so the SSO session died with the browser. New blueprint raises it to 30 days for every app on that flow. FreshRSS runs OIDC through Apache mod_auth_openidc, whose defaults are a 5 minute inactivity timeout and a ~7.5 hour max duration in a non-persistent cookie. Bumped to a 30 day sliding inactivity window (refreshed on every request) with a 90 day hard cap, and made the cookie persistent so it survives a browser restart.
207 lines
7.5 KiB
YAML
207 lines
7.5 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: authentik
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
project: default
|
|
sources:
|
|
- chart: authentik
|
|
repoURL: https://charts.goauthentik.io
|
|
targetRevision: 2026.2.1
|
|
helm:
|
|
values: |
|
|
authentik:
|
|
secret_key: ""
|
|
bootstrap_password: ""
|
|
bootstrap_token: ""
|
|
postgresql:
|
|
host: authentik-postgres-rw
|
|
name: authentik
|
|
user: authentik
|
|
password: ""
|
|
existingSecret:
|
|
secretName: authentik-secrets
|
|
global:
|
|
env:
|
|
- name: AUTHENTIK_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: secret_key
|
|
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: bootstrap_password
|
|
- name: AUTHENTIK_BOOTSTRAP_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: bootstrap_token
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
value: authentik-postgres-rw
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
value: authentik
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-credentials
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-credentials
|
|
key: password
|
|
- name: VAULT_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-oidc-client-secret
|
|
key: client_secret
|
|
- name: STALWART_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stalwart-oidc-client-secret
|
|
key: client_secret
|
|
- name: ARGOCD_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oidc-client-secret
|
|
key: client_secret
|
|
- name: FRESHRSS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: freshrss-oidc-client-secret
|
|
key: client_secret
|
|
- name: ACTUALBUDGET_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: actualbudget-oidc-client-secret
|
|
key: client_secret
|
|
server:
|
|
volumes:
|
|
- name: blueprint-vault
|
|
configMap:
|
|
name: authentik-blueprint-vault
|
|
- name: blueprint-mail
|
|
configMap:
|
|
name: authentik-blueprint-mail
|
|
- name: blueprint-ldap
|
|
configMap:
|
|
name: authentik-blueprint-ldap
|
|
- name: blueprint-argocd
|
|
configMap:
|
|
name: authentik-blueprint-argocd
|
|
- name: blueprint-freshrss
|
|
configMap:
|
|
name: authentik-blueprint-freshrss
|
|
- name: blueprint-actualbudget
|
|
configMap:
|
|
name: authentik-blueprint-actualbudget
|
|
- name: blueprint-session
|
|
configMap:
|
|
name: authentik-blueprint-session
|
|
volumeMounts:
|
|
- name: blueprint-vault
|
|
mountPath: /blueprints/custom/vault-oidc.yaml
|
|
subPath: vault-oidc.yaml
|
|
- name: blueprint-mail
|
|
mountPath: /blueprints/custom/mail-oidc.yaml
|
|
subPath: mail-oidc.yaml
|
|
- name: blueprint-ldap
|
|
mountPath: /blueprints/custom/ldap.yaml
|
|
subPath: ldap.yaml
|
|
- name: blueprint-argocd
|
|
mountPath: /blueprints/custom/argocd-oidc.yaml
|
|
subPath: argocd-oidc.yaml
|
|
- name: blueprint-freshrss
|
|
mountPath: /blueprints/custom/freshrss-oidc.yaml
|
|
subPath: freshrss-oidc.yaml
|
|
- name: blueprint-actualbudget
|
|
mountPath: /blueprints/custom/actualbudget-proxy.yaml
|
|
subPath: actualbudget-proxy.yaml
|
|
- name: blueprint-session
|
|
mountPath: /blueprints/custom/session-duration.yaml
|
|
subPath: session-duration.yaml
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
hosts:
|
|
- authentik.rubenhensen.nl
|
|
tls:
|
|
- secretName: authentik-tls
|
|
hosts:
|
|
- authentik.rubenhensen.nl
|
|
worker:
|
|
volumes:
|
|
- name: blueprint-vault
|
|
configMap:
|
|
name: authentik-blueprint-vault
|
|
- name: blueprint-mail
|
|
configMap:
|
|
name: authentik-blueprint-mail
|
|
- name: blueprint-ldap
|
|
configMap:
|
|
name: authentik-blueprint-ldap
|
|
- name: blueprint-argocd
|
|
configMap:
|
|
name: authentik-blueprint-argocd
|
|
- name: blueprint-freshrss
|
|
configMap:
|
|
name: authentik-blueprint-freshrss
|
|
- name: blueprint-actualbudget
|
|
configMap:
|
|
name: authentik-blueprint-actualbudget
|
|
- name: blueprint-session
|
|
configMap:
|
|
name: authentik-blueprint-session
|
|
volumeMounts:
|
|
- name: blueprint-vault
|
|
mountPath: /blueprints/custom/vault-oidc.yaml
|
|
subPath: vault-oidc.yaml
|
|
- name: blueprint-mail
|
|
mountPath: /blueprints/custom/mail-oidc.yaml
|
|
subPath: mail-oidc.yaml
|
|
- name: blueprint-ldap
|
|
mountPath: /blueprints/custom/ldap.yaml
|
|
subPath: ldap.yaml
|
|
- name: blueprint-argocd
|
|
mountPath: /blueprints/custom/argocd-oidc.yaml
|
|
subPath: argocd-oidc.yaml
|
|
- name: blueprint-freshrss
|
|
mountPath: /blueprints/custom/freshrss-oidc.yaml
|
|
subPath: freshrss-oidc.yaml
|
|
- name: blueprint-actualbudget
|
|
mountPath: /blueprints/custom/actualbudget-proxy.yaml
|
|
subPath: actualbudget-proxy.yaml
|
|
- name: blueprint-session
|
|
mountPath: /blueprints/custom/session-duration.yaml
|
|
subPath: session-duration.yaml
|
|
postgresql:
|
|
enabled: false
|
|
redis:
|
|
enabled: true
|
|
master:
|
|
persistence:
|
|
storageClass: longhorn
|
|
size: 2Gi
|
|
- repoURL: https://github.com/rubenhensen/k8scd.git
|
|
targetRevision: HEAD
|
|
path: authentik
|
|
directory:
|
|
include: "*.yaml"
|
|
exclude: "authentik-helm.yaml"
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: authentik
|