k8scd/authentik

Authentik

Authentik is deployed as the central identity provider, providing OIDC and LDAP authentication for services in the cluster.

Components

• Authentik Server — Helm chart deployment (apps/templates/authentik-helm.yaml)
• PostgreSQL — CloudNativePG cluster (postgresql-cluster.yaml)
• Secrets — ExternalSecrets from Vault (external-secret.yaml)
• Blueprints — Auto-configured providers:
  • blueprint-ldap.yaml — LDAP provider (base DN: DC=ldap,DC=goauthentik,DC=io)
  • blueprint-mail-oidc.yaml — OAuth2/OIDC provider for Stalwart mail
  • blueprint-vault-oidc.yaml — OIDC provider for Vault
  • blueprint-argocd-oidc.yaml — OIDC provider for ArgoCD
  • blueprint-freshrss-oidc.yaml — OIDC provider for FreshRSS
  • blueprint-actualbudget-proxy.yaml — Proxy provider for Actual Budget
  • blueprint-session-duration.yaml — Session lifetime of the default authentication flow

Session lifetime

Authentik ships the login stage of default-authentication-flow with session_duration: seconds=0, i.e. the SSO session dies when the browser closes. blueprint-session-duration.yaml raises this to 30 days for every app that uses that flow (FreshRSS, ArgoCD, Vault, Actual Budget, mail).

The expiry is absolute — Authentik does not extend a session on activity. A sliding window has to come from the application itself; FreshRSS does this via OIDC_SESSION_INACTIVITY_TIMEOUT (see freshrss/freshrss-deployment.yaml), which Apache mod_auth_openidc refreshes on every request.

LDAP Outpost

The LDAP outpost exposes Authentik's user directory over LDAP. It is used by:

• SOGo-mail (in-cluster) — connects via ak-outpost-ldap-outpost.authentik.svc.cluster.local:3389
• Stalwart (NixOS, external) — connects via ldap.rubenhensen.nl:389

NodePort Service

The outpost is exposed externally via a NodePort service (ldap-outpost-lb.yaml):

• LDAP: 389 → 3389 (NodePort 30389)
• LDAPS: 636 → 6636 (NodePort 30636)

The router port-forwards 389 → 30389 on the cluster node to make it reachable at ldap.rubenhensen.nl.

Important: The pod selector is app.kubernetes.io/name: authentik-outpost-ldap (set by Authentik's outpost controller, not the outpost name).

MicroK8s CA Certificate Fix

Authentik's outpost controller needs to talk to the Kubernetes API to deploy the LDAP outpost pod. This fails on MicroK8s because the default CA certificate is missing the keyUsage extension, which Python 3.13+ enforces strictly.

Error:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
CA cert does not include key usage extension (_ssl.c:1081)

Root cause: https://github.com/canonical/microk8s/issues/4864

Fix applied (2026-03-21): Regenerated the MicroK8s CA certificate with the keyUsage extension using the script from the issue above:

#!/bin/bash
set -euo pipefail

cert_workspace="$HOME/fixed-certs"
mkdir -p "$cert_workspace"
cd "$cert_workspace"

# Generate new CA key
openssl genrsa -out ca.key 2048

# Generate CA cert WITH keyUsage extension
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
    -out ca.crt \
    -addext "keyUsage=critical,digitalSignature,keyCertSign" \
    -subj "/CN=microk8s-ca"

# Verify the certificate has the extension
openssl x509 -in ca.crt -text -noout | grep -A 1 "Key Usage"

# Rotate the cluster CA
microk8s refresh-certs "$cert_workspace"

# Regenerate kubeconfig
mkdir -p ~/.kube
microk8s config > ~/.kube/config

Note: This must be re-applied after MicroK8s upgrades or cert rotations, as MicroK8s may regenerate the CA without the extension. The fix needs to run on every node in the cluster.