rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 14:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
648f99c505d3dcbef541ff5b1f07e4b4eec483d9
k8scd/apps/templates/authentik-helm.yaml
T

290 lines
11 KiB
YAML
Raw Blame History

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
syncPolicy:
syncOptions:
- CreateNamespace=true
automated:
prune: true
selfHeal: true
project: default
sources:
- chart: authentik
repoURL: https://charts.goauthentik.io
targetRevision: 2026.8.5
helm:
values: |
authentik:
secret_key: ""
bootstrap_password: ""
bootstrap_token: ""
postgresql:
host: authentik-postgres-rw
name: authentik
user: authentik
password: ""
existingSecret:
secretName: authentik-secrets
global:
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secrets
key: secret_key
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_password
- name: AUTHENTIK_BOOTSTRAP_TOKEN
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_token
- name: AUTHENTIK_POSTGRESQL__HOST
value: authentik-postgres-rw
- name: AUTHENTIK_POSTGRESQL__NAME
value: authentik
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: username
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: password
- name: VAULT_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: vault-oidc-client-secret
key: client_secret
- name: STALWART_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: stalwart-oidc-client-secret
key: client_secret
- name: ARGOCD_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: argocd-oidc-client-secret
key: client_secret
- name: FRESHRSS_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: freshrss-oidc-client-secret
key: client_secret
- name: ACTUALBUDGET_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: actualbudget-oidc-client-secret
key: client_secret
- name: LONGHORN_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: longhorn-oidc-client-secret
key: client_secret
# Point OpenSSL and requests (which uses certifi otherwise) at
# patched-ca-bundle, mounted below until the image drops the
# compromised eMudhra intermediates.
- name: SSL_CERT_FILE
value: /etc/ssl/certs/ca-certificates.crt
- name: REQUESTS_CA_BUNDLE
value: /etc/ssl/certs/ca-certificates.crt
server:
resources:
requests:
cpu: 70m
memory: 560Mi
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
- secret:
name: scouts-online-client
optional: true
items:
- key: client_id
path: scouts-online-client-id
- key: client_secret
path: scouts-online-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
worker:
resources:
requests:
cpu: 100m
memory: 336Mi
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
- secret:
name: scouts-online-client
optional: true
items:
- key: client_id
path: scouts-online-client-id
- key: client_secret
path: scouts-online-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
postgresql:
enabled: false
- repoURL: https://github.com/rubenhensen/k8scd.git
targetRevision: HEAD
path: authentik
directory:
include: "*.yaml"
exclude: "authentik-helm.yaml"
destination:
server: https://kubernetes.default.svc
namespace: authentik
Reference in new issue View Git Blame Copy Permalink