rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF

Browse Source 
Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.

Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.
This commit is contained in:
Story Crater Bot
2026-07-14 16:36:12 -07:00
parent 9e3781a069
commit bca247a763
4 changed files with 433 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/authentik-config.tf
+9
View File
@@ -0,0 +1,9 @@
# Authentik provider — resources imported from live cluster.
# Resource bodies generated via `terraform plan -generate-config-out`
# into authentik-generated.tf. Import mappings in authentik-imports.tf.
# Token: terraform.tfvars.local as authentik_api_token (sensitive).
provider "authentik" {
url = "https://authentik.${var.cluster_domain}"
token = var.authentik_api_token
}
terraform/authentik-generated.tf
+418
View File
@@ -0,0 +1,418 @@
# __generated__ by Terraform
# Please review these resources and move them into your main configuration files.
# __generated__ by Terraform from "4"
resource "authentik_user" "akadmin" {
attributes = jsonencode({
settings = {
locale = ""
}
})
email = "[email protected]"
groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"]
is_active = true
name = "authentik Default Admin"
password = null # sensitive
path = "users"
type = "internal"
username = "akadmin"
}
# __generated__ by Terraform from "9d72cbf2-9d52-4d3c-bba9-0068525d7a91"
resource "authentik_group" "authentik_admins" {
attributes = jsonencode({})
is_superuser = true
name = "authentik Admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "5"
resource "authentik_user" "riotpiao" {
attributes = jsonencode({})
email = "[email protected]"
groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"]
is_active = true
name = "rock"
password = null # sensitive
path = "users"
type = "internal"
username = "riotpiao"
}
# __generated__ by Terraform from "e640d887-eb85-431b-b5b2-5b6a8a7e0a44"
resource "authentik_group" "minio_admins" {
attributes = jsonencode({})
is_superuser = false
name = "minio-admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "38"
resource "authentik_user" "core_cli" {
attributes = jsonencode({})
email = "[email protected]"
groups = []
is_active = true
name = "Core CLI (scoped)"
password = null # sensitive
path = "users"
type = "internal"
username = "core-cli"
}
# __generated__ by Terraform from "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88"
resource "authentik_group" "grafana_admins" {
attributes = jsonencode({})
is_superuser = false
name = "grafana-admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "22a3c296-0d98-433f-8456-ebc2f1c8d489"
resource "authentik_group" "argocd_admins" {
attributes = jsonencode({})
is_superuser = false
name = "argocd-admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "cbd8ce0d-c364-47a2-976c-c93211175b83"
resource "authentik_group" "homelab_admins" {
attributes = jsonencode({})
is_superuser = false
name = "homelab-admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "forgejo"
resource "authentik_application" "forgejo_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = "/static/authentik/sources/gitlab.svg"
meta_launch_url = null
meta_publisher = null
name = "forgejo"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 3
slug = "forgejo"
uuid = "f70eb945-bf90-4f8c-875b-74db857b6c22"
}
# __generated__ by Terraform from "argocd"
resource "authentik_application" "argocd_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "argocd"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 4
slug = "argocd"
uuid = "781fa91e-7fcd-4e54-a9e5-fe809774e9d1"
}
# __generated__ by Terraform from "core-cli"
resource "authentik_application" "core_cli_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "core-cli"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 0
slug = "core-cli"
uuid = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee"
}
# __generated__ by Terraform from "4"
resource "authentik_provider_oauth2" "argocd_provider" {
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "https://argocd.riotpiao.homelab.com/auth/callback"
}]
authentication_flow = null
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "argocd"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "argocd"
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "4084c8d6-0c12-46af-acf8-7372172b9016"
resource "authentik_group" "forgejo_admins" {
attributes = jsonencode({})
is_superuser = false
name = "forgejo-admins"
parent = null
roles = null
users = [5, 4]
}
# __generated__ by Terraform from "grafana"
resource "authentik_application" "grafana_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "grafana"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 1
slug = "grafana"
uuid = "0acc3c58-d218-4d1a-8f54-6e838851aadb"
}
# __generated__ by Terraform from "3"
resource "authentik_provider_oauth2" "forgejo_provider" {
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "https://forgejo.riotpiao.homelab.com/user/oauth2/authentik/callback"
}]
authentication_flow = null
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "forgejo"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "forgejo"
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "minio"
resource "authentik_application" "minio_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "Minio"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 2
slug = "minio"
uuid = "6f4ec073-f493-4e6a-96d4-1634e4e9f80f"
}
# __generated__ by Terraform from "40"
resource "authentik_provider_oauth2" "core_cli_provider" {
access_code_validity = "minutes=1"
access_token_validity = "hours=1"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "urn:ietf:wg:oauth:2.0:oob"
}, {
matching_mode = "strict"
url = "https://authentik.riotpiao.homelab.com/application/o/callback/"
}]
authentication_flow = null
authorization_flow = "41e57c24-e38d-4d23-b81f-a6f002ca5df9"
client_id = "core-cli"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "core-cli"
property_mappings = []
refresh_token_validity = "days=30"
signing_key = null
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "38"
resource "authentik_provider_oauth2" "device_code_provider" {
access_code_validity = "minutes=1"
access_token_validity = "hours=1"
allowed_redirect_uris = []
authentication_flow = "dc6cfe87-94ac-4178-a2b2-a6ad5d4677dc"
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "device-code-c5e6da866bd4"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "Device Code Flow"
property_mappings = []
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "0d1c1578-9358-4602-af76-8472f4b4e115"
resource "authentik_group" "authentik_read_only" {
attributes = jsonencode({
notes = "An group with an auto-generated role that allows read-only permissions on all objects.\n"
})
is_superuser = false
name = "authentik Read-only"
parent = null
roles = null
users = []
}
# __generated__ by Terraform from "2"
resource "authentik_provider_oauth2" "minio_provider" {
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "https://minio.riotpiao.homelab.com/oauth_callback"
}]
authentication_flow = null
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "minio"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "minio"
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "5"
resource "authentik_provider_oauth2" "temporal_provider" {
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "https://temporal.riotpiao.homelab.com/auth/callback"
}]
authentication_flow = null
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "temporal"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "temporal"
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "1"
resource "authentik_provider_oauth2" "grafana_provider" {
access_code_validity = "minutes=1"
access_token_validity = "minutes=5"
allowed_redirect_uris = [{
matching_mode = "strict"
url = "https://grafana.riotpiao.homelab.com/login/generic_oauth"
}]
authentication_flow = null
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
client_id = "grafana"
client_secret = null # sensitive
client_type = "confidential"
encryption_key = null
include_claims_in_id_token = true
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
issuer_mode = "per_provider"
jwks_sources = null
jwt_federation_providers = []
jwt_federation_sources = []
name = "grafana"
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
refresh_token_validity = "days=30"
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
sub_mode = "hashed_user_id"
}
# __generated__ by Terraform from "device-code"
resource "authentik_application" "device_code_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "device-code"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 38
slug = "device-code"
uuid = "7f6ff50a-3554-4b5b-8419-622db0091ea3"
}
# __generated__ by Terraform from "temporal"
resource "authentik_application" "temporal_app" {
backchannel_providers = []
group = null
meta_description = null
meta_icon = null
meta_launch_url = null
meta_publisher = null
name = "temporal"
open_in_new_tab = false
policy_engine_mode = "any"
protocol_provider = 5
slug = "temporal"
uuid = "1d51178b-5619-4ba4-bd50-c102f2864cdd"
}
terraform/bootstrap-releases.tf
+5
View File
@@ -5,6 +5,11 @@ locals {
namespace = "cert-manager"
repo = "jetstack"
}
cilium = {
chart_version = "1.19.5"
namespace = "kube-system"
repo = "cilium"
}
reloader = {
chart_version = "1.3.0"
namespace = "reloader"
terraform/helm-repositories.tf
+1
View File
@@ -4,6 +4,7 @@ locals {
jetstack = "https://charts.jetstack.io"
stakater = "https://stakater.github.io/stakater-charts"
ingress_nginx = "https://kubernetes.github.io/ingress-nginx"
cilium = "https://helm.cilium.io"
cnpg = "https://cloudnative-pg.github.io/charts"
authentik = "https://charts.goauthentik.io"
hashicorp = "https://helm.releases.hashicorp.com"