chore(iam): retire Authentik
Zitadel is running and has provisioned OIDC clients for all 12 consumers (state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio, vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to serve until the last consumer moved. Remove every Authentik artifact from GitOps: - ArgoCD Application `authentik` and its Helm values - ArgoCD Application `iam-jobs` (provisioner RBAC + migration job) - ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart) - authentik-db CNPG cluster definition - authentik-secrets SOPS file and secret-generator entry - Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite - Prometheus alerts and ServiceMonitor - admin OIDC ClusterRoleBinding provisioning binding - scripts/iam/provision-rbac.py (the Authentik provisioner) The chart repo https://charts.goauthentik.io is removed from the AppProject. Kube-apiserver OIDC and consumer configs are switched to Zitadel in the local cluster-config (gitignored) and applied separately via talosctl.
This commit is contained in:
@@ -53,8 +53,4 @@ data:
|
||||
# even though the DNS CNAME points at the tunnel.
|
||||
- hostname: zitadel.riotpiao.com
|
||||
service: https://zitadel.riotpiao.com
|
||||
# AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
|
||||
# gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
|
||||
- hostname: authentik.riotpiao.com
|
||||
service: https://authentik.riotpiao.com
|
||||
- service: http_status:404
|
||||
|
||||
@@ -16,7 +16,7 @@ spec:
|
||||
# Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
|
||||
# dial https://<hostname> and trust homelab-ca or the TLS handshake fails
|
||||
# with "certificate signed by unknown authority". Same pattern as
|
||||
# authentik-values.yaml: merge the system bundle with homelab-ca.crt.
|
||||
# iam values: merge the system bundle with homelab-ca.crt.
|
||||
initContainers:
|
||||
- name: merge-ca-certs
|
||||
image: debian:bookworm
|
||||
|
||||
@@ -30,33 +30,6 @@ spec:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "3"
|
||||
spec:
|
||||
project: homelab
|
||||
sources:
|
||||
- repoURL: https://charts.goauthentik.io
|
||||
chart: authentik
|
||||
targetRevision: "*"
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/k8s/infra/iam/authentik-values.yaml
|
||||
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: iam
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
---
|
||||
# ZITADEL — the Authentik replacement. Coexistence, not cutover: Authentik keeps
|
||||
# serving in the same `iam` namespace until the last consumer moves, then this
|
||||
# becomes the only IdP. Migration plan (outside git):
|
||||
@@ -106,28 +79,6 @@ spec:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
---
|
||||
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: iam-jobs
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "3"
|
||||
spec:
|
||||
project: homelab
|
||||
source:
|
||||
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
path: k8s/infra/iam
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: iam
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
---
|
||||
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
|
||||
# under Argo, because values changes there were inert — a proxy-body-size fix
|
||||
# sat committed while the live Ingress kept nginx's 1m default and rejected
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
|
||||
# Wave 2 — dedicated per-app CNPG Postgres clusters (zitadel-db → ns iam,
|
||||
# temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
|
||||
# CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
|
||||
# dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: oidc-bootstrap
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "5"
|
||||
spec:
|
||||
project: homelab
|
||||
source:
|
||||
repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
||||
targetRevision: main
|
||||
path: k8s/infra/oidc-bootstrap
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: kube-system
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
@@ -34,7 +34,6 @@ spec:
|
||||
- https://prometheus-community.github.io/helm-charts
|
||||
- https://grafana.github.io/helm-charts
|
||||
- https://helm.releases.hashicorp.com
|
||||
- https://charts.goauthentik.io
|
||||
- https://charts.zitadel.com
|
||||
- https://strimzi.io/charts/
|
||||
- https://charts.bitnami.com/bitnami
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
apiVersion: ENC[AES256_GCM,data:Fc0=,iv:UFqMFeZTJZtFMoNeusjAoSI60U9StZS4IXw+n8JQCRM=,tag:uUvY4+jcjiSJHs0HDS3/7A==,type:str]
|
||||
kind: ENC[AES256_GCM,data:NUw86IEw,iv:gh4Vqn6uteYnYIFcXT/QVxRPKm+G+j2aIVuV71nZ4k4=,tag:nZA/x75Kx4+CoSx66BsvkQ==,type:str]
|
||||
metadata:
|
||||
name: ENC[AES256_GCM,data:qex150pm0eGwYiiI05y9LUs=,iv:5Tk001T796c4HFikoh1ZVB6ierBfDqOUkFs5ilkr+V8=,tag:LiDAiCH7w6aRS41VKIlIKg==,type:str]
|
||||
namespace: ENC[AES256_GCM,data:nI91,iv:c1hBWGMkVb+vg+MKNzty8CFfXxQabXEtT+EpiuQZNvo=,tag:BsGtJDbBadDdTa687+Sdag==,type:str]
|
||||
type: ENC[AES256_GCM,data:3rXawlSD,iv:FUtLK4KP7v/SBF08ZcU6siIO1qfjlJirf2x5PyzAjuA=,tag:mSIQ+Y43+wDfZGRbQ6a0Og==,type:str]
|
||||
stringData:
|
||||
AUTHENTIK_SECRET_KEY: ENC[AES256_GCM,data:i5tVOWnN9a/cfhs6gckveRxUpiN7Ie227R/74kOIz6lQ5US2hkf03W5qSGCrzheL3DB0i8+d0iJYsApjn/wCiN7ndZZVFko3W5jDfVPybxc=,iv:djF1G9JHT5B7ziTokA/UuPpG+tG2LvFU4uMAR0x4M6o=,tag:vHOd7jLYkM8Evnr0QUVrCw==,type:str]
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: ENC[AES256_GCM,data:PjvYtH03CzQbTXEqt/Z18+u1zJdok7DLwDn51FUZXDA=,iv:pSwSm8hB0/Q8uOAcOZ1rTqq7BF782EglG19GGeghm1E=,tag:qGCQFWCrwsWBOiQ07ySMUQ==,type:str]
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: ENC[AES256_GCM,data:1tnekGo0GIemJCMRenjN0yNeSiiMl/kky8ms84TsqBLaQ0lQzPxjq9qtgNJwoAsufxrznrkDVKjeOEHNYcA82A==,iv:NNFWSLMILoWccA9ihy1OArSS1X3OySB7PIHdXZdyzlg=,tag:t2w+KyReOXftTrU9pBQDnQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZGRKWm9PTkNSOENtREgx
|
||||
M2V3Z0xxOXRhRGVRclo3SzBKRkc0VmtCY0NnClJPSGJRcUlzWmNFeTZ1bmorNEV4
|
||||
U3l3TzVlMTlrWkJnQzBtUTJtcUwrM3MKLS0tIEJrMWZrbllYYUZKN1V4MVMzcXAv
|
||||
eUtheHlNMHpsTEJXZ1FTMFVxbWloa0kKLRkE1Du+4gdOLerOl9y0mZw+8fqfECQY
|
||||
uP64Q+9BSuPYNiTLZvYDzmdoy+KTS7i7C9rf+iU96R/crbQLamV9Ew==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
lastmodified: "2026-08-12T20:37:07Z"
|
||||
mac: ENC[AES256_GCM,data:b3pDx340d1iZxsPPXzACckoLBrW+XjX1qlGrWEEI30j2Ao0hewTRZJyHbdI97A6b/hqzBN/4tjqqkdqm8goNhUQweMLTw86X6sALuE0aLS9wK53qjqih8fQwQBbgLDtjFXtW26h+smIm7aB5ZSDvU2le44HDXuWd83sWtCavNq0=,iv:ZMDsoKpygFJrYpXy2dA0IlxAi0jt24rxF72eUzgQs7k=,tag:WWE7G7+c9JK6fF1U9V8igg==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -9,7 +9,6 @@ metadata:
|
||||
files:
|
||||
- agent-pod-models.enc.yaml
|
||||
- agent-pod-ssh-key.enc.yaml
|
||||
- authentik-secrets.enc.yaml
|
||||
- cloudflare-secrets.enc.yaml
|
||||
- cloudflared-credentials.enc.yaml
|
||||
- forgejo-registry-pat-api.enc.yaml
|
||||
|
||||
@@ -275,31 +275,3 @@ spec:
|
||||
name: temporal-web
|
||||
port:
|
||||
number: 8080
|
||||
|
||||
---
|
||||
# ── Authentik (identity provider) ─────────────────────────────────────────────
|
||||
# The chart's ingress is disabled in k8s/infra/iam/authentik-values.yaml; the
|
||||
# rule lives here so ingress-config owns every hostname. TLS terminates at
|
||||
# nginx via the wildcard default-ssl-certificate, so the backend stays HTTP.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: iam
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "16m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: authentik.riotpiao.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: authentik-server
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
|
||||
# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
|
||||
# authentik-values reads them locally (no cross-ns secret copy).
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: authentik-db
|
||||
namespace: iam
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
spec:
|
||||
instances: 3
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: authentik
|
||||
owner: app
|
||||
encoding: UTF8
|
||||
localeCollate: C
|
||||
localeCType: C
|
||||
enableSuperuserAccess: false
|
||||
resources:
|
||||
requests: { memory: "512Mi", cpu: "250m" }
|
||||
limits: { memory: "2Gi", cpu: "1" }
|
||||
storage:
|
||||
size: 10Gi
|
||||
storageClass: longhorn-cnpg
|
||||
monitoring:
|
||||
enablePodMonitor: true
|
||||
affinity:
|
||||
# preferred + tolerations: HA across nodes without deadlocking a partly-
|
||||
# schedulable 3-CP (same as forgejo-db).
|
||||
podAntiAffinityType: preferred
|
||||
topologyKey: kubernetes.io/hostname
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
@@ -6,7 +6,6 @@ kind: Kustomization
|
||||
# deployed into it. paperless ns declared in namespaces.yaml above.
|
||||
resources:
|
||||
- namespaces.yaml
|
||||
- authentik-db.yaml
|
||||
- zitadel-db.yaml
|
||||
- temporal-db.yaml
|
||||
- paperless-db.yaml
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# DB clusters are wave 2 — their namespaces must exist first (their apps that
|
||||
# would CreateNamespace run later, w3/w8). Declared here so the databases App
|
||||
# creates them. authentik/vault/temporal/paperless CreateNamespace=true then
|
||||
# no-ops. poimen namespace created by poimen-root app (wave 7).
|
||||
# creates them. vault/temporal/paperless CreateNamespace=true then no-ops.
|
||||
# poimen namespace created by poimen-root app (wave 7).
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
|
||||
@@ -1,284 +0,0 @@
|
||||
# k8s/talos-iam/authentik-values.yaml
|
||||
# Authentik — SSO Identity Provider for the homelab.
|
||||
# Provides OAuth2/OIDC login for Grafana, MinIO, Forgejo, and Argo CD.
|
||||
# Chart: authentik/authentik from https://charts.goauthentik.io
|
||||
#
|
||||
# Architecture: server (UI+API) + worker (background tasks) + PostgreSQL + Redis.
|
||||
# PostgreSQL is the system of record — must persist. Redis is ephemeral cache/queue.
|
||||
#
|
||||
# Secrets injected via helmfile --set (from .env / vsource):
|
||||
# AUTHENTIK_SECRET_KEY — signs sessions and tokens; set once, never rotate casually
|
||||
# AUTHENTIK_BOOTSTRAP_PASSWORD — initial akadmin password (used once at first login)
|
||||
# AUTHENTIK_BOOTSTRAP_TOKEN — API token for the setup_talos_iam.sh bootstrap script
|
||||
# AUTHENTIK_PG_PASSWORD — PostgreSQL user password
|
||||
|
||||
authentik:
|
||||
# host: the external URL Authentik uses to build redirect URIs in OAuth2 flows.
|
||||
# Must match what the browser sees — if it returns an internal svc URL,
|
||||
# the browser's redirect after login will fail (can't reach svc DNS externally).
|
||||
# HTTP (not HTTPS) because the Authentik ingress has no TLS cert configured.
|
||||
host: "https://authentik.riotpiao.com"
|
||||
|
||||
error_reporting:
|
||||
enabled: false # do not phone home to Sentry
|
||||
|
||||
# PostgreSQL connection — points at CloudNativePG cluster in ddb namespace.
|
||||
# Uses 'app' bootstrap user (CNPG simple pattern, same as Forgejo).
|
||||
# Credentials injected from authentik-db-app secret via env vars below.
|
||||
postgresql:
|
||||
host: authentik-db-rw.iam.svc.cluster.local
|
||||
port: 5432
|
||||
name: authentik
|
||||
user: app # All apps use shared 'app' user (CNPG design pattern)
|
||||
password: "" # overridden by AUTHENTIK_POSTGRESQL__PASSWORD env var
|
||||
|
||||
# Redis connection — bundled subchart, standalone mode (no sentinel/cluster).
|
||||
redis:
|
||||
host: authentik-redis-master
|
||||
|
||||
# ── HTTP client timeouts ──────────────────────────────────────────────────────
|
||||
# Increased to tolerate 5+ second pod-to-pod network latency.
|
||||
# Affects webhooks, outpost management, SCIM, LDAP sync.
|
||||
# Default: ~30s — too aggressive when latency spikes hit 5-10s.
|
||||
log_level: debug # enable debug logging to monitor connection issues
|
||||
|
||||
# ── CA trust (shared by server and worker) ────────────────────────────────────
|
||||
# Authentik (Python/Debian) uses requests + httpx for outgoing HTTPS — webhooks,
|
||||
# outpost management, SCIM. Both libraries need REQUESTS_CA_BUNDLE / SSL_CERT_FILE
|
||||
# to point to a bundle that includes homelab-ca, otherwise connections to other
|
||||
# homelab services fail with "certificate signed by unknown authority".
|
||||
#
|
||||
# Strategy: a debian:12-slim init container (run as root) concatenates the
|
||||
# Debian system Mozilla bundle with homelab-ca.crt into an emptyDir. The main
|
||||
# container then references /merged/ca-bundle.crt via two env vars that cover
|
||||
# every Python HTTP library.
|
||||
_caVolumes: &caVolumes
|
||||
- name: homelab-ca
|
||||
configMap:
|
||||
name: homelab-ca
|
||||
- name: merged-ca
|
||||
emptyDir: {}
|
||||
|
||||
_caVolumeMounts: &caVolumeMounts
|
||||
- name: homelab-ca
|
||||
mountPath: /homelab-ca
|
||||
readOnly: true
|
||||
- name: merged-ca
|
||||
mountPath: /merged
|
||||
readOnly: true
|
||||
|
||||
_caInitContainers: &caInitContainers
|
||||
- name: merge-ca-certs
|
||||
image: debian:bookworm
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
|
||||
volumeMounts:
|
||||
- name: homelab-ca
|
||||
mountPath: /homelab-ca
|
||||
readOnly: true
|
||||
- name: merged-ca
|
||||
mountPath: /merged
|
||||
# NOTE: no authentik-migrate init container — the authentik `server` entrypoint
|
||||
# runs migrations itself on startup. A separate `manage migrate` init pinned to
|
||||
# an older image tripped a version-history precheck on an empty DB
|
||||
# (relation "authentik_version_history" does not exist) and blocked boot.
|
||||
|
||||
_caEnv: &caEnv
|
||||
- name: REQUESTS_CA_BUNDLE
|
||||
value: /merged/ca-bundle.crt
|
||||
- name: SSL_CERT_FILE
|
||||
value: /merged/ca-bundle.crt
|
||||
|
||||
# ── Authentik server (UI + API) ───────────────────────────────────────────────
|
||||
# Handles all browser traffic: login flows, admin UI, OAuth2 authorize/token endpoints.
|
||||
# NodePort 32172 is a fallback for direct node access during troubleshooting;
|
||||
# normal access is via nginx ingress (authentik.riotpiao.com → svc:80).
|
||||
# Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
|
||||
server:
|
||||
replicas: 1
|
||||
# Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: authentik-secrets
|
||||
deploymentStrategy:
|
||||
type: Recreate
|
||||
service:
|
||||
type: NodePort
|
||||
nodePort: 32172
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
volumes: *caVolumes
|
||||
volumeMounts: *caVolumeMounts
|
||||
initContainers: *caInitContainers
|
||||
env:
|
||||
# Merge CA trust env vars
|
||||
- name: REQUESTS_CA_BUNDLE
|
||||
value: /merged/ca-bundle.crt
|
||||
- name: SSL_CERT_FILE
|
||||
value: /merged/ca-bundle.crt
|
||||
# Override database credentials to use 'app' from authentik-db-app
|
||||
- name: AUTHENTIK_POSTGRESQL__USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-db-app
|
||||
key: username
|
||||
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-db-app
|
||||
key: password
|
||||
podAnnotations:
|
||||
configmap.reloader.stakater.com/reload: "homelab-ca"
|
||||
homelab.io/restart-at: "2026-06-21T13-40"
|
||||
# The /-/health/{live,ready}/ endpoints do a DB round-trip; under transient
|
||||
# CNPG contention they respond in 5-6s while still returning 200. The chart's
|
||||
# default 3s liveness timeout then flags a working backend as dead and kubelet
|
||||
# kills it in a restart loop — the pod never stays Ready, gets dropped from the
|
||||
# authentik-server Service endpoints, and the OAuth-provisioning PostSync hook
|
||||
# fails with "Host is unreachable". Widen the timeouts so slow-but-healthy
|
||||
# checks aren't treated as failures. (Only these fields are overridden; the
|
||||
# chart deep-merges the rest of each probe, incl. the httpGet path.)
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 300 # skip probe until 5min passed (migrations finish)
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 300 # skip probe until migrations complete
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 6
|
||||
startupProbe:
|
||||
timeoutSeconds: 15
|
||||
failureThreshold: 120 # 120 × 10s = 20min for fresh DB migrations
|
||||
# Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
|
||||
# its request latency/error rate explains SSO-driven slowness on those services.
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
scrapeTimeout: 30s
|
||||
|
||||
# ── Authentik worker ──────────────────────────────────────────────────────────
|
||||
# Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
|
||||
# event log cleanup, and managed outpost updates. Stateless — no PVC needed.
|
||||
# Same resource profile as server; Authentik 2023+ merged some worker duties
|
||||
# into the server process but the worker pod is still required.
|
||||
worker:
|
||||
replicas: 1
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: authentik-secrets
|
||||
deploymentStrategy:
|
||||
type: Recreate
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
volumes: *caVolumes
|
||||
volumeMounts: *caVolumeMounts
|
||||
initContainers: *caInitContainers
|
||||
env:
|
||||
# Merge CA trust env vars
|
||||
- name: REQUESTS_CA_BUNDLE
|
||||
value: /merged/ca-bundle.crt
|
||||
- name: SSL_CERT_FILE
|
||||
value: /merged/ca-bundle.crt
|
||||
# Override database credentials to use 'app' from authentik-db-app
|
||||
- name: AUTHENTIK_POSTGRESQL__USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-db-app
|
||||
key: username
|
||||
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-db-app
|
||||
key: password
|
||||
podAnnotations:
|
||||
configmap.reloader.stakater.com/reload: "homelab-ca"
|
||||
homelab.io/restart-at: "2026-06-21T13-40"
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 300 # skip probe until 5min passed (migrations finish)
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 300 # skip probe until migrations complete
|
||||
startupProbe:
|
||||
initialDelaySeconds: 30 # let server finish DB work first
|
||||
failureThreshold: 120
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
scrapeTimeout: 30s
|
||||
|
||||
# ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
|
||||
# Authentik connects to the dedicated authentik-db (1 primary + 2 replicas).
|
||||
# Do not use the bundled Bitnami subchart — CNPG is already running.
|
||||
postgresql:
|
||||
enabled: false
|
||||
primary:
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: longhorn
|
||||
size: 8Gi
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/worker
|
||||
operator: Exists
|
||||
|
||||
# ── Bundled Redis ─────────────────────────────────────────────────────────────
|
||||
# Cache and async task queue only — no durable data. If Redis restarts, in-flight
|
||||
# background tasks are retried and cached tokens are recomputed. Losing Redis
|
||||
# data does not lose user accounts or flow configuration (that's in PostgreSQL).
|
||||
# persistence: false saves a PVC and makes restarts faster.
|
||||
#
|
||||
# Same prefer-worker / fallback-to-cp scheduling as PostgreSQL.
|
||||
# architecture: standalone — no Sentinel/cluster overhead for a 3-node homelab.
|
||||
redis:
|
||||
enabled: true
|
||||
master:
|
||||
persistence:
|
||||
enabled: false
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/worker
|
||||
operator: Exists
|
||||
architecture: standalone
|
||||
|
||||
# Ingress disabled — rule lives in k8s/ingress/ingress.yaml (authentik.riotpiao.com).
|
||||
# For direct access during bootstrap: kubectl -n iam port-forward svc/authentik-server 7000:80
|
||||
@@ -5,8 +5,6 @@ resources:
|
||||
- rbac-dashboard-rolebinding.yaml
|
||||
|
||||
# IAM provisioning is manual-only (security-sensitive).
|
||||
# Script: scripts/iam/authentik-provision.py
|
||||
# Script: scripts/iam/zitadel-provision.py
|
||||
# Run:
|
||||
# export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
|
||||
# -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
|
||||
# python3 scripts/iam/authentik-provision.py
|
||||
# scripts/iam/zitadel-provision.py all
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: authentik-provisioner
|
||||
namespace: dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: authentik-provisioner
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: authentik-provisioner
|
||||
namespace: iam
|
||||
@@ -1,33 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: authentik-rules
|
||||
namespace: iam
|
||||
spec:
|
||||
groups:
|
||||
- name: authentik.rules
|
||||
interval: 15s
|
||||
rules:
|
||||
- alert: AuthentikHighErrorRate
|
||||
expr: |
|
||||
(
|
||||
sum(rate(authentik_http_requests_total{status=~"5.."}[5m]))
|
||||
/
|
||||
sum(rate(authentik_http_requests_total[5m]))
|
||||
) > 0.05
|
||||
for: 10m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
summary: "High error rate on Authentik"
|
||||
description: "5xx error rate exceeded 5% of total requests for 10 minutes. Value: {{ $value | humanizePercentage }}"
|
||||
|
||||
- alert: AuthentikOutpostDown
|
||||
expr: |
|
||||
authentik_outpost_total_up == 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
summary: "Authentik outpost is down"
|
||||
description: "Outpost {{ $labels.outpost_name }} (type: {{ $labels.outpost_type }}) has been offline for 5 minutes"
|
||||
@@ -7,7 +7,6 @@ kind: Kustomization
|
||||
resources:
|
||||
- alerts/ingress-alerts.yaml
|
||||
- alerts/svc-argocd-rules.yaml
|
||||
- alerts/svc-authentik-rules.yaml
|
||||
- alerts/svc-zitadel-rules.yaml
|
||||
- alerts/svc-forgejo-rules.yaml
|
||||
- alerts/svc-grafana-rules.yaml
|
||||
@@ -17,7 +16,6 @@ resources:
|
||||
- alerts/api-gateway-alerts.yaml
|
||||
- alerts/cag-kv-cache-rules.yaml
|
||||
- servicemonitors/argocd.yaml
|
||||
- servicemonitors/authentik.yaml
|
||||
- servicemonitors/forgejo.yaml
|
||||
- servicemonitors/minio.yaml
|
||||
- servicemonitors/ingress-nginx.yaml
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: monitoring
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- iam
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: authentik
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
@@ -1,33 +0,0 @@
|
||||
# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
|
||||
# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
|
||||
# tokens were never accepted -> every login got 401). Delete this whole directory after.
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: oidc-bootstrap
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: oidc-bootstrap
|
||||
namespace: kube-system
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: oidc-bootstrap
|
||||
namespace: kube-system
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: oidc-bootstrap
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: oidc-bootstrap
|
||||
Reference in New Issue
Block a user