diff --git a/terraform/authentik-config.tf b/terraform/authentik-config.tf new file mode 100644 index 0000000..d922b35 --- /dev/null +++ b/terraform/authentik-config.tf @@ -0,0 +1,9 @@ +# Authentik provider — resources imported from live cluster. +# Resource bodies generated via `terraform plan -generate-config-out` +# into authentik-generated.tf. Import mappings in authentik-imports.tf. +# Token: terraform.tfvars.local as authentik_api_token (sensitive). + +provider "authentik" { + url = "https://authentik.${var.cluster_domain}" + token = var.authentik_api_token +} diff --git a/terraform/authentik-generated.tf b/terraform/authentik-generated.tf new file mode 100644 index 0000000..49e4d1a --- /dev/null +++ b/terraform/authentik-generated.tf @@ -0,0 +1,418 @@ +# __generated__ by Terraform +# Please review these resources and move them into your main configuration files. + +# __generated__ by Terraform from "4" +resource "authentik_user" "akadmin" { + attributes = jsonencode({ + settings = { + locale = "" + } + }) + email = "root@example.com" + groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"] + is_active = true + name = "authentik Default Admin" + password = null # sensitive + path = "users" + type = "internal" + username = "akadmin" +} + +# __generated__ by Terraform from "9d72cbf2-9d52-4d3c-bba9-0068525d7a91" +resource "authentik_group" "authentik_admins" { + attributes = jsonencode({}) + is_superuser = true + name = "authentik Admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "5" +resource "authentik_user" "riotpiao" { + attributes = jsonencode({}) + email = "locartrock@gmail.com" + groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"] + is_active = true + name = "rock" + password = null # sensitive + path = "users" + type = "internal" + username = "riotpiao" +} + +# __generated__ by Terraform from "e640d887-eb85-431b-b5b2-5b6a8a7e0a44" +resource "authentik_group" "minio_admins" { + attributes = jsonencode({}) + is_superuser = false + name = "minio-admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "38" +resource "authentik_user" "core_cli" { + attributes = jsonencode({}) + email = "core-cli@homelab.local" + groups = [] + is_active = true + name = "Core CLI (scoped)" + password = null # sensitive + path = "users" + type = "internal" + username = "core-cli" +} + +# __generated__ by Terraform from "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88" +resource "authentik_group" "grafana_admins" { + attributes = jsonencode({}) + is_superuser = false + name = "grafana-admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "22a3c296-0d98-433f-8456-ebc2f1c8d489" +resource "authentik_group" "argocd_admins" { + attributes = jsonencode({}) + is_superuser = false + name = "argocd-admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "cbd8ce0d-c364-47a2-976c-c93211175b83" +resource "authentik_group" "homelab_admins" { + attributes = jsonencode({}) + is_superuser = false + name = "homelab-admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "forgejo" +resource "authentik_application" "forgejo_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = "/static/authentik/sources/gitlab.svg" + meta_launch_url = null + meta_publisher = null + name = "forgejo" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 3 + slug = "forgejo" + uuid = "f70eb945-bf90-4f8c-875b-74db857b6c22" +} + +# __generated__ by Terraform from "argocd" +resource "authentik_application" "argocd_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "argocd" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 4 + slug = "argocd" + uuid = "781fa91e-7fcd-4e54-a9e5-fe809774e9d1" +} + +# __generated__ by Terraform from "core-cli" +resource "authentik_application" "core_cli_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "core-cli" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 0 + slug = "core-cli" + uuid = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee" +} + +# __generated__ by Terraform from "4" +resource "authentik_provider_oauth2" "argocd_provider" { + access_code_validity = "minutes=1" + access_token_validity = "minutes=5" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "https://argocd.riotpiao.homelab.com/auth/callback" + }] + authentication_flow = null + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "argocd" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "argocd" + property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "4084c8d6-0c12-46af-acf8-7372172b9016" +resource "authentik_group" "forgejo_admins" { + attributes = jsonencode({}) + is_superuser = false + name = "forgejo-admins" + parent = null + roles = null + users = [5, 4] +} + +# __generated__ by Terraform from "grafana" +resource "authentik_application" "grafana_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "grafana" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 1 + slug = "grafana" + uuid = "0acc3c58-d218-4d1a-8f54-6e838851aadb" +} + +# __generated__ by Terraform from "3" +resource "authentik_provider_oauth2" "forgejo_provider" { + access_code_validity = "minutes=1" + access_token_validity = "minutes=5" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "https://forgejo.riotpiao.homelab.com/user/oauth2/authentik/callback" + }] + authentication_flow = null + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "forgejo" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "forgejo" + property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "minio" +resource "authentik_application" "minio_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "Minio" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 2 + slug = "minio" + uuid = "6f4ec073-f493-4e6a-96d4-1634e4e9f80f" +} + +# __generated__ by Terraform from "40" +resource "authentik_provider_oauth2" "core_cli_provider" { + access_code_validity = "minutes=1" + access_token_validity = "hours=1" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "urn:ietf:wg:oauth:2.0:oob" + }, { + matching_mode = "strict" + url = "https://authentik.riotpiao.homelab.com/application/o/callback/" + }] + authentication_flow = null + authorization_flow = "41e57c24-e38d-4d23-b81f-a6f002ca5df9" + client_id = "core-cli" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "core-cli" + property_mappings = [] + refresh_token_validity = "days=30" + signing_key = null + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "38" +resource "authentik_provider_oauth2" "device_code_provider" { + access_code_validity = "minutes=1" + access_token_validity = "hours=1" + allowed_redirect_uris = [] + authentication_flow = "dc6cfe87-94ac-4178-a2b2-a6ad5d4677dc" + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "device-code-c5e6da866bd4" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "Device Code Flow" + property_mappings = [] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "0d1c1578-9358-4602-af76-8472f4b4e115" +resource "authentik_group" "authentik_read_only" { + attributes = jsonencode({ + notes = "An group with an auto-generated role that allows read-only permissions on all objects.\n" + }) + is_superuser = false + name = "authentik Read-only" + parent = null + roles = null + users = [] +} + +# __generated__ by Terraform from "2" +resource "authentik_provider_oauth2" "minio_provider" { + access_code_validity = "minutes=1" + access_token_validity = "minutes=5" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "https://minio.riotpiao.homelab.com/oauth_callback" + }] + authentication_flow = null + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "minio" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "minio" + property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "5" +resource "authentik_provider_oauth2" "temporal_provider" { + access_code_validity = "minutes=1" + access_token_validity = "minutes=5" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "https://temporal.riotpiao.homelab.com/auth/callback" + }] + authentication_flow = null + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "temporal" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "temporal" + property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "1" +resource "authentik_provider_oauth2" "grafana_provider" { + access_code_validity = "minutes=1" + access_token_validity = "minutes=5" + allowed_redirect_uris = [{ + matching_mode = "strict" + url = "https://grafana.riotpiao.homelab.com/login/generic_oauth" + }] + authentication_flow = null + authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac" + client_id = "grafana" + client_secret = null # sensitive + client_type = "confidential" + encryption_key = null + include_claims_in_id_token = true + invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c" + issuer_mode = "per_provider" + jwks_sources = null + jwt_federation_providers = [] + jwt_federation_sources = [] + name = "grafana" + property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"] + refresh_token_validity = "days=30" + signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50" + sub_mode = "hashed_user_id" +} + +# __generated__ by Terraform from "device-code" +resource "authentik_application" "device_code_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "device-code" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 38 + slug = "device-code" + uuid = "7f6ff50a-3554-4b5b-8419-622db0091ea3" +} + +# __generated__ by Terraform from "temporal" +resource "authentik_application" "temporal_app" { + backchannel_providers = [] + group = null + meta_description = null + meta_icon = null + meta_launch_url = null + meta_publisher = null + name = "temporal" + open_in_new_tab = false + policy_engine_mode = "any" + protocol_provider = 5 + slug = "temporal" + uuid = "1d51178b-5619-4ba4-bd50-c102f2864cdd" +} diff --git a/terraform/bootstrap-releases.tf b/terraform/bootstrap-releases.tf index 1cddf89..c633d4c 100644 --- a/terraform/bootstrap-releases.tf +++ b/terraform/bootstrap-releases.tf @@ -5,6 +5,11 @@ locals { namespace = "cert-manager" repo = "jetstack" } + cilium = { + chart_version = "1.19.5" + namespace = "kube-system" + repo = "cilium" + } reloader = { chart_version = "1.3.0" namespace = "reloader" diff --git a/terraform/helm-repositories.tf b/terraform/helm-repositories.tf index d6a671c..937eece 100644 --- a/terraform/helm-repositories.tf +++ b/terraform/helm-repositories.tf @@ -4,6 +4,7 @@ locals { jetstack = "https://charts.jetstack.io" stakater = "https://stakater.github.io/stakater-charts" ingress_nginx = "https://kubernetes.github.io/ingress-nginx" + cilium = "https://helm.cilium.io" cnpg = "https://cloudnative-pg.github.io/charts" authentik = "https://charts.goauthentik.io" hashicorp = "https://helm.releases.hashicorp.com"