rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 22:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
abed11dbaa2a071e2a2a90affe9f7bf837705b96
k8scd/apps/templates/authentik-helm.yaml
T
Ruben Hensen 135bca4a83 authentik: log in to immich with Scouts Online 
Adds Scouts Online 3 (login.scouting.nl) as an OIDC source. Its userinfo
has the member's roles within the group; a property mapping puts every
member in "MBG leden" and those with an active Kaderlid role also in
"MBG kader", on every login. Members become external users. Family
members can share an email address and immich needs a unique one, so
those get a plus address with their member number.

The immich provider now authenticates through a flow whose only stage
is an identification stage with this one source and no fields, which
sends people straight on to Scouts Online. The source's own flows only
run through the source.
2026-10-24 13:37:12 +02:00

288 lines
11 KiB
YAML
Raw Blame History

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
syncPolicy:
syncOptions:
- CreateNamespace=true
automated:
prune: true
selfHeal: true
project: default
sources:
- chart: authentik
repoURL: https://charts.goauthentik.io
targetRevision: 2026.2.1
helm:
values: |
authentik:
secret_key: ""
bootstrap_password: ""
bootstrap_token: ""
postgresql:
host: authentik-postgres-rw
name: authentik
user: authentik
password: ""
existingSecret:
secretName: authentik-secrets
global:
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secrets
key: secret_key
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_password
- name: AUTHENTIK_BOOTSTRAP_TOKEN
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_token
- name: AUTHENTIK_POSTGRESQL__HOST
value: authentik-postgres-rw
- name: AUTHENTIK_POSTGRESQL__NAME
value: authentik
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: username
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: password
- name: VAULT_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: vault-oidc-client-secret
key: client_secret
- name: STALWART_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: stalwart-oidc-client-secret
key: client_secret
- name: ARGOCD_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: argocd-oidc-client-secret
key: client_secret
- name: FRESHRSS_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: freshrss-oidc-client-secret
key: client_secret
- name: ACTUALBUDGET_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: actualbudget-oidc-client-secret
key: client_secret
- name: LONGHORN_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: longhorn-oidc-client-secret
key: client_secret
# Point OpenSSL and requests (which uses certifi otherwise) at
# patched-ca-bundle, mounted below until the image drops the
# compromised eMudhra intermediates.
- name: SSL_CERT_FILE
value: /etc/ssl/certs/ca-certificates.crt
- name: REQUESTS_CA_BUNDLE
value: /etc/ssl/certs/ca-certificates.crt
server:
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
- secret:
name: scouts-online-client
optional: true
items:
- key: client_id
path: scouts-online-client-id
- key: client_secret
path: scouts-online-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
worker:
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
- secret:
name: scouts-online-client
optional: true
items:
- key: client_id
path: scouts-online-client-id
- key: client_secret
path: scouts-online-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
postgresql:
enabled: false
redis:
enabled: true
master:
persistence:
storageClass: longhorn
size: 2Gi
- repoURL: https://github.com/rubenhensen/k8scd.git
targetRevision: HEAD
path: authentik
directory:
include: "*.yaml"
exclude: "authentik-helm.yaml"
destination:
server: https://kubernetes.default.svc
namespace: authentik
Reference in new issue View Git Blame Copy Permalink