mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
910b792452
Longhorn has no users of its own; nginx guarded it with basic auth using apr1 hashes, which Envoy Gateway does not support. An Envoy Gateway SecurityPolicy now sends visitors through an authentik OIDC application that only admins may use. The client secret lives in Vault at kv/longhorn-oidc and reaches both authentik and Envoy through External Secrets.
243 lines
9.0 KiB
YAML
243 lines
9.0 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: authentik
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
project: default
|
|
sources:
|
|
- chart: authentik
|
|
repoURL: https://charts.goauthentik.io
|
|
targetRevision: 2026.2.1
|
|
helm:
|
|
values: |
|
|
authentik:
|
|
secret_key: ""
|
|
bootstrap_password: ""
|
|
bootstrap_token: ""
|
|
postgresql:
|
|
host: authentik-postgres-rw
|
|
name: authentik
|
|
user: authentik
|
|
password: ""
|
|
existingSecret:
|
|
secretName: authentik-secrets
|
|
global:
|
|
env:
|
|
- name: AUTHENTIK_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: secret_key
|
|
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: bootstrap_password
|
|
- name: AUTHENTIK_BOOTSTRAP_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secrets
|
|
key: bootstrap_token
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
value: authentik-postgres-rw
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
value: authentik
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-credentials
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-credentials
|
|
key: password
|
|
- name: VAULT_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-oidc-client-secret
|
|
key: client_secret
|
|
- name: STALWART_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stalwart-oidc-client-secret
|
|
key: client_secret
|
|
- name: ARGOCD_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oidc-client-secret
|
|
key: client_secret
|
|
- name: FRESHRSS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: freshrss-oidc-client-secret
|
|
key: client_secret
|
|
- name: ACTUALBUDGET_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: actualbudget-oidc-client-secret
|
|
key: client_secret
|
|
- name: LONGHORN_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: longhorn-oidc-client-secret
|
|
key: client_secret
|
|
# Point OpenSSL and requests (which uses certifi otherwise) at
|
|
# patched-ca-bundle, mounted below until the image drops the
|
|
# compromised eMudhra intermediates.
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
server:
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
- name: blueprint-vault
|
|
configMap:
|
|
name: authentik-blueprint-vault
|
|
- name: blueprint-mail
|
|
configMap:
|
|
name: authentik-blueprint-mail
|
|
- name: blueprint-ldap
|
|
configMap:
|
|
name: authentik-blueprint-ldap
|
|
- name: blueprint-argocd
|
|
configMap:
|
|
name: authentik-blueprint-argocd
|
|
- name: blueprint-freshrss
|
|
configMap:
|
|
name: authentik-blueprint-freshrss
|
|
- name: blueprint-actualbudget
|
|
configMap:
|
|
name: authentik-blueprint-actualbudget
|
|
- name: blueprint-session
|
|
configMap:
|
|
name: authentik-blueprint-session
|
|
- name: blueprint-longhorn
|
|
configMap:
|
|
name: authentik-blueprint-longhorn
|
|
volumeMounts:
|
|
- name: blueprint-vault
|
|
mountPath: /blueprints/custom/vault-oidc.yaml
|
|
subPath: vault-oidc.yaml
|
|
- name: blueprint-mail
|
|
mountPath: /blueprints/custom/mail-oidc.yaml
|
|
subPath: mail-oidc.yaml
|
|
- name: blueprint-ldap
|
|
mountPath: /blueprints/custom/ldap.yaml
|
|
subPath: ldap.yaml
|
|
- name: blueprint-argocd
|
|
mountPath: /blueprints/custom/argocd-oidc.yaml
|
|
subPath: argocd-oidc.yaml
|
|
- name: blueprint-freshrss
|
|
mountPath: /blueprints/custom/freshrss-oidc.yaml
|
|
subPath: freshrss-oidc.yaml
|
|
- name: blueprint-actualbudget
|
|
mountPath: /blueprints/custom/actualbudget-proxy.yaml
|
|
subPath: actualbudget-proxy.yaml
|
|
- name: blueprint-session
|
|
mountPath: /blueprints/custom/session-duration.yaml
|
|
subPath: session-duration.yaml
|
|
- name: blueprint-longhorn
|
|
mountPath: /blueprints/custom/longhorn-oidc.yaml
|
|
subPath: longhorn-oidc.yaml
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
hosts:
|
|
- authentik.rubenhensen.nl
|
|
tls:
|
|
- secretName: authentik-tls
|
|
hosts:
|
|
- authentik.rubenhensen.nl
|
|
worker:
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
- name: blueprint-vault
|
|
configMap:
|
|
name: authentik-blueprint-vault
|
|
- name: blueprint-mail
|
|
configMap:
|
|
name: authentik-blueprint-mail
|
|
- name: blueprint-ldap
|
|
configMap:
|
|
name: authentik-blueprint-ldap
|
|
- name: blueprint-argocd
|
|
configMap:
|
|
name: authentik-blueprint-argocd
|
|
- name: blueprint-freshrss
|
|
configMap:
|
|
name: authentik-blueprint-freshrss
|
|
- name: blueprint-actualbudget
|
|
configMap:
|
|
name: authentik-blueprint-actualbudget
|
|
- name: blueprint-session
|
|
configMap:
|
|
name: authentik-blueprint-session
|
|
- name: blueprint-longhorn
|
|
configMap:
|
|
name: authentik-blueprint-longhorn
|
|
volumeMounts:
|
|
- name: blueprint-vault
|
|
mountPath: /blueprints/custom/vault-oidc.yaml
|
|
subPath: vault-oidc.yaml
|
|
- name: blueprint-mail
|
|
mountPath: /blueprints/custom/mail-oidc.yaml
|
|
subPath: mail-oidc.yaml
|
|
- name: blueprint-ldap
|
|
mountPath: /blueprints/custom/ldap.yaml
|
|
subPath: ldap.yaml
|
|
- name: blueprint-argocd
|
|
mountPath: /blueprints/custom/argocd-oidc.yaml
|
|
subPath: argocd-oidc.yaml
|
|
- name: blueprint-freshrss
|
|
mountPath: /blueprints/custom/freshrss-oidc.yaml
|
|
subPath: freshrss-oidc.yaml
|
|
- name: blueprint-actualbudget
|
|
mountPath: /blueprints/custom/actualbudget-proxy.yaml
|
|
subPath: actualbudget-proxy.yaml
|
|
- name: blueprint-session
|
|
mountPath: /blueprints/custom/session-duration.yaml
|
|
subPath: session-duration.yaml
|
|
- name: blueprint-longhorn
|
|
mountPath: /blueprints/custom/longhorn-oidc.yaml
|
|
subPath: longhorn-oidc.yaml
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
postgresql:
|
|
enabled: false
|
|
redis:
|
|
enabled: true
|
|
master:
|
|
persistence:
|
|
storageClass: longhorn
|
|
size: 2Gi
|
|
- repoURL: https://github.com/rubenhensen/k8scd.git
|
|
targetRevision: HEAD
|
|
path: authentik
|
|
directory:
|
|
include: "*.yaml"
|
|
exclude: "authentik-helm.yaml"
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: authentik
|