Story Crater Bot
acfc9cfc04
Import all live authentik resources (groups, users, oauth2 providers, applications) into terraform state via authentik-generated.tf. Provider config in authentik-config.tf. Resources are drift-free and match live cluster. Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system). Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.
419 lines
15 KiB
Terraform
419 lines
15 KiB
Terraform
# __generated__ by Terraform
|
|
# Please review these resources and move them into your main configuration files.
|
|
|
|
# __generated__ by Terraform from "4"
|
|
resource "authentik_user" "akadmin" {
|
|
attributes = jsonencode({
|
|
settings = {
|
|
locale = ""
|
|
}
|
|
})
|
|
email = "[email protected]"
|
|
groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"]
|
|
is_active = true
|
|
name = "authentik Default Admin"
|
|
password = null # sensitive
|
|
path = "users"
|
|
type = "internal"
|
|
username = "akadmin"
|
|
}
|
|
|
|
# __generated__ by Terraform from "9d72cbf2-9d52-4d3c-bba9-0068525d7a91"
|
|
resource "authentik_group" "authentik_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = true
|
|
name = "authentik Admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "5"
|
|
resource "authentik_user" "riotpiao" {
|
|
attributes = jsonencode({})
|
|
email = "[email protected]"
|
|
groups = ["9d72cbf2-9d52-4d3c-bba9-0068525d7a91", "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88", "e640d887-eb85-431b-b5b2-5b6a8a7e0a44", "22a3c296-0d98-433f-8456-ebc2f1c8d489", "4084c8d6-0c12-46af-acf8-7372172b9016", "cbd8ce0d-c364-47a2-976c-c93211175b83"]
|
|
is_active = true
|
|
name = "rock"
|
|
password = null # sensitive
|
|
path = "users"
|
|
type = "internal"
|
|
username = "riotpiao"
|
|
}
|
|
|
|
# __generated__ by Terraform from "e640d887-eb85-431b-b5b2-5b6a8a7e0a44"
|
|
resource "authentik_group" "minio_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = false
|
|
name = "minio-admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "38"
|
|
resource "authentik_user" "core_cli" {
|
|
attributes = jsonencode({})
|
|
email = "[email protected]"
|
|
groups = []
|
|
is_active = true
|
|
name = "Core CLI (scoped)"
|
|
password = null # sensitive
|
|
path = "users"
|
|
type = "internal"
|
|
username = "core-cli"
|
|
}
|
|
|
|
# __generated__ by Terraform from "5f2e1e79-7d7e-4ef0-9b99-3c6df19c0b88"
|
|
resource "authentik_group" "grafana_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = false
|
|
name = "grafana-admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "22a3c296-0d98-433f-8456-ebc2f1c8d489"
|
|
resource "authentik_group" "argocd_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = false
|
|
name = "argocd-admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "cbd8ce0d-c364-47a2-976c-c93211175b83"
|
|
resource "authentik_group" "homelab_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = false
|
|
name = "homelab-admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "forgejo"
|
|
resource "authentik_application" "forgejo_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = "/static/authentik/sources/gitlab.svg"
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "forgejo"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 3
|
|
slug = "forgejo"
|
|
uuid = "f70eb945-bf90-4f8c-875b-74db857b6c22"
|
|
}
|
|
|
|
# __generated__ by Terraform from "argocd"
|
|
resource "authentik_application" "argocd_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "argocd"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 4
|
|
slug = "argocd"
|
|
uuid = "781fa91e-7fcd-4e54-a9e5-fe809774e9d1"
|
|
}
|
|
|
|
# __generated__ by Terraform from "core-cli"
|
|
resource "authentik_application" "core_cli_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "core-cli"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 0
|
|
slug = "core-cli"
|
|
uuid = "f15c69b4-414b-49da-9e65-eef0a0dbf1ee"
|
|
}
|
|
|
|
# __generated__ by Terraform from "4"
|
|
resource "authentik_provider_oauth2" "argocd_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "minutes=5"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "https://argocd.riotpiao.homelab.com/auth/callback"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "argocd"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "argocd"
|
|
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "4084c8d6-0c12-46af-acf8-7372172b9016"
|
|
resource "authentik_group" "forgejo_admins" {
|
|
attributes = jsonencode({})
|
|
is_superuser = false
|
|
name = "forgejo-admins"
|
|
parent = null
|
|
roles = null
|
|
users = [5, 4]
|
|
}
|
|
|
|
# __generated__ by Terraform from "grafana"
|
|
resource "authentik_application" "grafana_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "grafana"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 1
|
|
slug = "grafana"
|
|
uuid = "0acc3c58-d218-4d1a-8f54-6e838851aadb"
|
|
}
|
|
|
|
# __generated__ by Terraform from "3"
|
|
resource "authentik_provider_oauth2" "forgejo_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "minutes=5"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "https://forgejo.riotpiao.homelab.com/user/oauth2/authentik/callback"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "forgejo"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "forgejo"
|
|
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "minio"
|
|
resource "authentik_application" "minio_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "Minio"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 2
|
|
slug = "minio"
|
|
uuid = "6f4ec073-f493-4e6a-96d4-1634e4e9f80f"
|
|
}
|
|
|
|
# __generated__ by Terraform from "40"
|
|
resource "authentik_provider_oauth2" "core_cli_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "hours=1"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "urn:ietf:wg:oauth:2.0:oob"
|
|
}, {
|
|
matching_mode = "strict"
|
|
url = "https://authentik.riotpiao.homelab.com/application/o/callback/"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "41e57c24-e38d-4d23-b81f-a6f002ca5df9"
|
|
client_id = "core-cli"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "core-cli"
|
|
property_mappings = []
|
|
refresh_token_validity = "days=30"
|
|
signing_key = null
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "38"
|
|
resource "authentik_provider_oauth2" "device_code_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "hours=1"
|
|
allowed_redirect_uris = []
|
|
authentication_flow = "dc6cfe87-94ac-4178-a2b2-a6ad5d4677dc"
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "device-code-c5e6da866bd4"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "0254061b-16b3-486e-9800-1fe1580186a6"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "Device Code Flow"
|
|
property_mappings = []
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "0d1c1578-9358-4602-af76-8472f4b4e115"
|
|
resource "authentik_group" "authentik_read_only" {
|
|
attributes = jsonencode({
|
|
notes = "An group with an auto-generated role that allows read-only permissions on all objects.\n"
|
|
})
|
|
is_superuser = false
|
|
name = "authentik Read-only"
|
|
parent = null
|
|
roles = null
|
|
users = []
|
|
}
|
|
|
|
# __generated__ by Terraform from "2"
|
|
resource "authentik_provider_oauth2" "minio_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "minutes=5"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "https://minio.riotpiao.homelab.com/oauth_callback"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "minio"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "minio"
|
|
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "5"
|
|
resource "authentik_provider_oauth2" "temporal_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "minutes=5"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "https://temporal.riotpiao.homelab.com/auth/callback"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "temporal"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "temporal"
|
|
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "1"
|
|
resource "authentik_provider_oauth2" "grafana_provider" {
|
|
access_code_validity = "minutes=1"
|
|
access_token_validity = "minutes=5"
|
|
allowed_redirect_uris = [{
|
|
matching_mode = "strict"
|
|
url = "https://grafana.riotpiao.homelab.com/login/generic_oauth"
|
|
}]
|
|
authentication_flow = null
|
|
authorization_flow = "3bd78f72-7d78-40c5-baad-5a63203f75ac"
|
|
client_id = "grafana"
|
|
client_secret = null # sensitive
|
|
client_type = "confidential"
|
|
encryption_key = null
|
|
include_claims_in_id_token = true
|
|
invalidation_flow = "cedc5670-78d6-402b-aa24-26674aea799c"
|
|
issuer_mode = "per_provider"
|
|
jwks_sources = null
|
|
jwt_federation_providers = []
|
|
jwt_federation_sources = []
|
|
name = "grafana"
|
|
property_mappings = ["604befc4-8fa3-4d17-8192-044e7a8a88d3", "f38fa6f5-3f87-4470-9241-b98b0151a6c0", "5c9d75bd-3981-4e51-81d4-d1c7d26edf15"]
|
|
refresh_token_validity = "days=30"
|
|
signing_key = "0a93e63b-1427-44c8-aa12-4f9f213f5a50"
|
|
sub_mode = "hashed_user_id"
|
|
}
|
|
|
|
# __generated__ by Terraform from "device-code"
|
|
resource "authentik_application" "device_code_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "device-code"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 38
|
|
slug = "device-code"
|
|
uuid = "7f6ff50a-3554-4b5b-8419-622db0091ea3"
|
|
}
|
|
|
|
# __generated__ by Terraform from "temporal"
|
|
resource "authentik_application" "temporal_app" {
|
|
backchannel_providers = []
|
|
group = null
|
|
meta_description = null
|
|
meta_icon = null
|
|
meta_launch_url = null
|
|
meta_publisher = null
|
|
name = "temporal"
|
|
open_in_new_tab = false
|
|
policy_engine_mode = "any"
|
|
protocol_provider = 5
|
|
slug = "temporal"
|
|
uuid = "1d51178b-5619-4ba4-bd50-c102f2864cdd"
|
|
}
|