# authentik.descriptor.yaml
# Build input for generating svc-authentik.yaml dashboard ConfigMap
# and svc-authentik-rules.yaml PrometheusRule.
# NOT applied to cluster — this is a reference for Claude's mechanical dashboard generation.

service: authentik
display_name: "Authentik"
namespace: iam
service_type: identity-provider
folder: "Authentik"

jobs:
  - authentik-server
  - authentik-worker

metrics:
  prefix: authentik
  up_selector: 'job="authentik-server"'

  rate:
    metric: authentik_flows_execution_stage_time_count
    labels: [flow_slug, stage_name]

  duration:
    metric: authentik_main_request_duration_seconds
    type: histogram
    unit: s

  error:
    metric: authentik_flows_cached
    filter: null

  domain:
    - metric: authentik_outpost_connection
      kind: gauge
      group_by: [outpost_name, outpost_type]
    - metric: authentik_outposts_connected
      kind: gauge
    - metric: authentik_flows_cached
      kind: gauge
    - metric: authentik_policies_cached
      kind: gauge
    - metric: authentik_tasks_queued
      kind: gauge
    - metric: authentik_admin_workers
      kind: gauge

correlation_ids: []

logs:
  loki_namespace_selector: 'namespace="iam"'

alerts:
  - name: HighErrorRate
    expr_template: rate_error_ratio
    threshold: 0.05
    for: 10m
    severity: warning
  - name: OutpostDown
    expr_template: gauge_below_threshold
    metric: authentik_outpost_total_up
    threshold: 1
    for: 5m
    severity: warning