rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 22:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
f3f36c3718adb77fb0cfd0abbb5bf103b7ec96c9
k8scd/apps/templates/authentik-helm.yaml
T
Ruben Hensen 48b0873ca3 authentik: add an OIDC provider for immich 
The Scouting MBG photos (immich) will log in through this authentik,
which later passes on Scouts Online. The provider issues immich_role and
immich_quota: admins and the members of "MBG kader" may upload (-1),
everyone else gets a quota of 0, which makes immich refuse uploads.
"MBG leden" and "MBG kader" are filled by the Scouts Online source in a
next step; until then only authentik Admins can use the app.

The scouting blueprints and their secrets are mounted as directories
rather than with subPath, and the blueprint reads the client secret with
!File instead of !Env, so later changes reach authentik without a restart.
2026-10-24 13:19:52 +02:00

272 lines
10 KiB
YAML
Raw Blame History

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
syncPolicy:
syncOptions:
- CreateNamespace=true
automated:
prune: true
selfHeal: true
project: default
sources:
- chart: authentik
repoURL: https://charts.goauthentik.io
targetRevision: 2026.2.1
helm:
values: |
authentik:
secret_key: ""
bootstrap_password: ""
bootstrap_token: ""
postgresql:
host: authentik-postgres-rw
name: authentik
user: authentik
password: ""
existingSecret:
secretName: authentik-secrets
global:
env:
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secrets
key: secret_key
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_password
- name: AUTHENTIK_BOOTSTRAP_TOKEN
valueFrom:
secretKeyRef:
name: authentik-secrets
key: bootstrap_token
- name: AUTHENTIK_POSTGRESQL__HOST
value: authentik-postgres-rw
- name: AUTHENTIK_POSTGRESQL__NAME
value: authentik
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: username
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-postgres-credentials
key: password
- name: VAULT_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: vault-oidc-client-secret
key: client_secret
- name: STALWART_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: stalwart-oidc-client-secret
key: client_secret
- name: ARGOCD_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: argocd-oidc-client-secret
key: client_secret
- name: FRESHRSS_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: freshrss-oidc-client-secret
key: client_secret
- name: ACTUALBUDGET_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: actualbudget-oidc-client-secret
key: client_secret
- name: LONGHORN_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: longhorn-oidc-client-secret
key: client_secret
# Point OpenSSL and requests (which uses certifi otherwise) at
# patched-ca-bundle, mounted below until the image drops the
# compromised eMudhra intermediates.
- name: SSL_CERT_FILE
value: /etc/ssl/certs/ca-certificates.crt
- name: REQUESTS_CA_BUNDLE
value: /etc/ssl/certs/ca-certificates.crt
server:
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
worker:
volumes:
- name: patched-ca-bundle
configMap:
name: patched-ca-bundle
- name: blueprint-vault
configMap:
name: authentik-blueprint-vault
- name: blueprint-mail
configMap:
name: authentik-blueprint-mail
- name: blueprint-ldap
configMap:
name: authentik-blueprint-ldap
- name: blueprint-argocd
configMap:
name: authentik-blueprint-argocd
- name: blueprint-freshrss
configMap:
name: authentik-blueprint-freshrss
- name: blueprint-actualbudget
configMap:
name: authentik-blueprint-actualbudget
- name: blueprint-session
configMap:
name: authentik-blueprint-session
- name: blueprint-longhorn
configMap:
name: authentik-blueprint-longhorn
# Directory mounts, not subPath, so changes reach the pods
# without a restart. The secrets are optional: a blueprint
# that needs a missing one fails until it shows up.
- name: blueprint-scouting
configMap:
name: authentik-blueprint-scouting
- name: scouting-secrets
projected:
sources:
- secret:
name: immich-oidc-client-secret
optional: true
items:
- key: client_secret
path: immich-oidc-client-secret
volumeMounts:
- name: blueprint-vault
mountPath: /blueprints/custom/vault-oidc.yaml
subPath: vault-oidc.yaml
- name: blueprint-mail
mountPath: /blueprints/custom/mail-oidc.yaml
subPath: mail-oidc.yaml
- name: blueprint-ldap
mountPath: /blueprints/custom/ldap.yaml
subPath: ldap.yaml
- name: blueprint-argocd
mountPath: /blueprints/custom/argocd-oidc.yaml
subPath: argocd-oidc.yaml
- name: blueprint-freshrss
mountPath: /blueprints/custom/freshrss-oidc.yaml
subPath: freshrss-oidc.yaml
- name: blueprint-actualbudget
mountPath: /blueprints/custom/actualbudget-proxy.yaml
subPath: actualbudget-proxy.yaml
- name: blueprint-session
mountPath: /blueprints/custom/session-duration.yaml
subPath: session-duration.yaml
- name: blueprint-longhorn
mountPath: /blueprints/custom/longhorn-oidc.yaml
subPath: longhorn-oidc.yaml
- name: blueprint-scouting
mountPath: /blueprints/custom/scouting
- name: scouting-secrets
mountPath: /secrets/scouting
readOnly: true
- name: patched-ca-bundle
mountPath: /etc/ssl/certs
readOnly: true
postgresql:
enabled: false
redis:
enabled: true
master:
persistence:
storageClass: longhorn
size: 2Gi
- repoURL: https://github.com/rubenhensen/k8scd.git
targetRevision: HEAD
path: authentik
directory:
include: "*.yaml"
exclude: "authentik-helm.yaml"
destination:
server: https://kubernetes.default.svc
namespace: authentik
Reference in new issue View Git Blame Copy Permalink