feat(authentik): move to enterprise (#3902)
This commit is contained in:
Stavros Kois
@@ -1,30 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
# helm-docs templates
|
||||
*.gotmpl
|
||||
# docs folder
|
||||
/docs
|
||||
# icon
|
||||
icon.png
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,35 +0,0 @@
|
||||
apiVersion: v2
|
||||
appVersion: "2022.9.0"
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: https://library-charts.truecharts.org
|
||||
version: 10.6.1
|
||||
- condition: postgresql.enabled
|
||||
name: postgresql
|
||||
repository: https://charts.truecharts.org/
|
||||
version: 8.0.87
|
||||
- condition: redis.enabled
|
||||
name: redis
|
||||
repository: https://charts.truecharts.org
|
||||
version: 3.0.84
|
||||
description: authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
home: https://truecharts.org/docs/charts/incubator/authentik
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png
|
||||
keywords:
|
||||
- authentik
|
||||
kubeVersion: ">=1.16.0-0"
|
||||
maintainers:
|
||||
- email: info@truecharts.org
|
||||
name: TrueCharts
|
||||
url: https://truecharts.org
|
||||
name: authentik
|
||||
sources:
|
||||
- https://github.com/truecharts/charts/tree/master/charts/incubator/authentik
|
||||
- https://github.com/goauthentik/authentik
|
||||
- https://goauthentik.io/docs/
|
||||
version: 6.0.7
|
||||
annotations:
|
||||
truecharts.org/catagories: |
|
||||
- authentication
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/grade: U
|
||||
@@ -1,109 +0,0 @@
|
||||
# authentik
|
||||
|
||||
authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
|
||||
This readme is just an automatically generated general guide on installing our Helm Charts and Apps.
|
||||
For more information, please click here: [authentik](https://truecharts.org/docs/charts/incubator/authentik)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/truecharts/charts/tree/master/charts/incubator/authentik>
|
||||
* <https://github.com/goauthentik/authentik>
|
||||
* <https://goauthentik.io/docs/>
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>=1.16.0-0`
|
||||
|
||||
## Dependencies
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://charts.truecharts.org/ | postgresql | 8.0.87 |
|
||||
| https://charts.truecharts.org | redis | 3.0.84 |
|
||||
| https://library-charts.truecharts.org | common | 10.6.1 |
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
### TrueNAS SCALE
|
||||
|
||||
To install this Chart on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Installing-an-App).
|
||||
|
||||
### Helm
|
||||
|
||||
To install the chart with the release name `authentik`
|
||||
|
||||
```console
|
||||
helm repo add TrueCharts https://charts.truecharts.org
|
||||
helm repo update
|
||||
helm install authentik TrueCharts/authentik
|
||||
```
|
||||
|
||||
## Uninstall
|
||||
|
||||
### TrueNAS SCALE
|
||||
|
||||
**Upgrading, Rolling Back and Uninstalling the Chart**
|
||||
|
||||
To upgrade, rollback or delete this Chart from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Upgrade-rollback-delete-an-App).
|
||||
|
||||
### Helm
|
||||
|
||||
To uninstall the `authentik` deployment
|
||||
|
||||
```console
|
||||
helm uninstall authentik
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Helm
|
||||
|
||||
#### Available Settings
|
||||
|
||||
Read through the values.yaml file. It has several commented out suggested values.
|
||||
Other values may be used from the [values.yaml](https://github.com/truecharts/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common).
|
||||
|
||||
#### Configure using the command line
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
```console
|
||||
helm install authentik \
|
||||
--set env.TZ="America/New York" \
|
||||
TrueCharts/authentik
|
||||
```
|
||||
|
||||
#### Configure using a yaml file
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
|
||||
|
||||
```console
|
||||
helm install authentik TrueCharts/authentik -f values.yaml
|
||||
```
|
||||
|
||||
#### Connecting to other charts
|
||||
|
||||
If you need to connect this Chart to other Charts on TrueNAS SCALE, please refer to our [Linking Charts Internally](https://truecharts.org/docs/manual/SCALE%20Apps/linking-apps) quick-start guide.
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/docs/manual/SCALE%20Apps/Important-MUST-READ).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
---
|
||||
|
||||
All Rights Reserved - The TrueCharts Project
|
||||
@@ -1,28 +0,0 @@
|
||||
# Installation notes
|
||||
|
||||
## Credentials
|
||||
|
||||
Default username: `akadmin`
|
||||
|
||||
## Outposts
|
||||
|
||||
Enable each outpost by simple setting `enabled` to `true`.
|
||||
Scale users, just have to check the checkbox
|
||||
|
||||
> You have to create an outpost in the GUI first.
|
||||
> And afterwards enable it.
|
||||
> Applications > Outposts
|
||||
|
||||
### Host
|
||||
|
||||
`host` should not need to be overridden. Defaults to `https://localhost:9443`
|
||||
|
||||
### Host Browser
|
||||
|
||||
`host_browser` by default is set to the first ingress host you set
|
||||
|
||||
### Token
|
||||
|
||||
`token` is only needed if you accidentally deleted the bootstrap token within the UI.
|
||||
|
||||
> You can get one from Applications > Outposts > View Deployment Info
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 21 KiB |
@@ -1,846 +0,0 @@
|
||||
# Include{groups}
|
||||
portals:
|
||||
open:
|
||||
# Include{portalLink}
|
||||
questions:
|
||||
# Include{global}
|
||||
# Include{controller}
|
||||
# Include{controllerDeployment}
|
||||
# Include{replicas}
|
||||
# Include{replica1}
|
||||
# Include{strategy}
|
||||
# Include{recreate}
|
||||
# Include{controllerExpert}
|
||||
# Include{controllerExpertExtraArgs}
|
||||
- variable: authentik
|
||||
group: Container Configuration
|
||||
label: Authentik Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: credentials
|
||||
label: Credentials
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: password
|
||||
label: Password (Initial install only)
|
||||
description: Password for <akadmin> user. Can be used for any flow executor
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
required: true
|
||||
default: ""
|
||||
- variable: general
|
||||
label: General
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: disable_update_check
|
||||
label: Disable Update Check
|
||||
description: Disable the inbuilt update-checker
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: disable_startup_analytics
|
||||
label: Disable Startup Analytics
|
||||
description: Disable startup analytics
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: allow_user_name_change
|
||||
label: Allow User Name Change
|
||||
description: Enable the ability for users to change their Name
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: allow_user_mail_change
|
||||
label: Allow User Mail Change
|
||||
description: Enable the ability for users to change their Email address
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: allow_user_username_change
|
||||
label: Allow User Username Change
|
||||
description: Enable the ability for users to change their Usernames
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: gdpr_compliance
|
||||
label: GDPR Compliance
|
||||
description: When enabled, all the events caused by a user will be deleted upon the user's deletion
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: impersonation
|
||||
label: Impersonation
|
||||
description: Globally enable / disable impersonation
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: avatars
|
||||
label: Avatars
|
||||
description: Configure how authentik should show avatars for users
|
||||
schema:
|
||||
type: string
|
||||
default: gravatar
|
||||
- variable: token_length
|
||||
label: Token Length
|
||||
description: Configure the length of generated tokens
|
||||
schema:
|
||||
type: int
|
||||
default: 128
|
||||
- variable: footer_links
|
||||
label: Footer Links
|
||||
description: This option configures the footer links on the flow executor pages
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: mail
|
||||
label: e-Mail
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: host
|
||||
label: Mail Server Host
|
||||
description: Sets host of mail server
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: port
|
||||
label: Mail Server Port
|
||||
description: Sets port of mail server
|
||||
schema:
|
||||
type: int
|
||||
default: 25
|
||||
- variable: tls
|
||||
label: Use TLS for authentication
|
||||
description: Sets tls for mail server authentication
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: ssl
|
||||
label: Use SSL for authentication
|
||||
description: Sets ssl for mail server authentication
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: timeout
|
||||
label: Timeout of authentication
|
||||
description: Sets timeout for mail server authentication
|
||||
schema:
|
||||
type: int
|
||||
default: 10
|
||||
- variable: user
|
||||
label: Username
|
||||
description: Sets username of mail server
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: pass
|
||||
label: Password
|
||||
description: Sets password of mail server
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
default: ""
|
||||
- variable: from
|
||||
label: From Address
|
||||
description: Email address authentik will send from
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: error_reporting
|
||||
label: Error Reporting
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: enabled
|
||||
label: Enable Reporting
|
||||
description: Enables error reporting
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if:
|
||||
subquestions:
|
||||
- variable: send_pii
|
||||
label: Send Personal Data
|
||||
description: Whether or not to send personal data, like usernames
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: environment
|
||||
label: Environment
|
||||
description: Unique environment that is attached to your error reports, should be set to your email address for example.
|
||||
schema:
|
||||
type: string
|
||||
default: customer
|
||||
- variable: logging
|
||||
label: Logging
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: log_level
|
||||
label: Log Level
|
||||
description: Log level for the server and worker containers
|
||||
schema:
|
||||
type: string
|
||||
default: info
|
||||
enum:
|
||||
- value: trace
|
||||
description: trace
|
||||
- value: debug
|
||||
description: debug
|
||||
- value: info
|
||||
description: info
|
||||
- value: warning
|
||||
description: warning
|
||||
- value: error
|
||||
description: error
|
||||
- variable: metrics
|
||||
label: Metrics
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: enabled
|
||||
label: Metrics Endpoint
|
||||
description: Enables metrics endpoint for Authentik and embedded outpost
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: ldap
|
||||
label: LDAP
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: tls_ciphers
|
||||
label: TLS Ciphers
|
||||
description: Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources. Setting applies to all sources
|
||||
schema:
|
||||
type: string
|
||||
default: "null"
|
||||
- variable: outposts
|
||||
group: Container Configuration
|
||||
label: Outpost Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: ldap
|
||||
label: LDAP
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: enabled
|
||||
label: Enable LDAP outpost
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: overrideHost
|
||||
label: Override Host
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: host
|
||||
label: Authentik Host
|
||||
description: "URL of your Authentik server. (e.g. https://auth.domain.com)"
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: ""
|
||||
- variable: insecure
|
||||
label: Insecure
|
||||
description: Check only if you accessing Authentik in an unsecure way
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: overrideToken
|
||||
label: Override Token
|
||||
description: Overrides the random generated token to provide your own
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: token
|
||||
label: API Token
|
||||
description: You can get this from Applications > Outposts > View Deployment Info
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
required: true
|
||||
default: ""
|
||||
- variable: overrideBrowserHost
|
||||
label: Override Host Browser
|
||||
description: Overrides the Browser Host, by default the first ingress host is used
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: host_browser
|
||||
label: Host Browser
|
||||
description: URL to use in the browser, when it differs from << host >>
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: ""
|
||||
- variable: metrics
|
||||
label: Metrics Endpoint
|
||||
description: Enables metric endpoint in LDAP Outpost
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: proxy
|
||||
label: Proxy
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: enabled
|
||||
label: Enable Proxy outpost
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: overrideHost
|
||||
label: Override Host
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: host
|
||||
label: Authentik Host
|
||||
description: "URL of your Authentik server. (e.g. https://auth.domain.com)"
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: ""
|
||||
- variable: insecure
|
||||
label: Insecure
|
||||
description: Check only if you accessing Authentik in an unsecure way
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: overrideToken
|
||||
label: Override Token
|
||||
description: Overrides the random generated token to provide your own
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: token
|
||||
label: API Token
|
||||
description: You can get this from Applications > Outposts > View Deployment Info
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
required: true
|
||||
default: ""
|
||||
- variable: overrideBrowserHost
|
||||
label: Override Host Browser
|
||||
description: Overrides the Browser Host, by default the first ingress host is used
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: host_browser
|
||||
label: Host Browser
|
||||
description: URL to use in the browser, when it differs from << host >>
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: ""
|
||||
- variable: metrics
|
||||
label: Metrics Endpoint
|
||||
description: Enables metric endpoint in Proxy Outpost
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: geoip
|
||||
group: Container Configuration
|
||||
label: GeoIP Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: enabled
|
||||
label: Enable GeoIP Container
|
||||
description: Enables GeoIP container
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestions_if: true
|
||||
subquestions:
|
||||
- variable: account_id
|
||||
label: Account ID
|
||||
description: Your MaxMind account ID
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
required: true
|
||||
default: ""
|
||||
- variable: license_key
|
||||
label: License Key
|
||||
description: Your case-sensitive MaxMind license key
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
required: true
|
||||
default: ""
|
||||
- variable: edition_ids
|
||||
label: Edition IDs
|
||||
description: List of space-separated database edition IDs. Edition IDs may consist of letters, digits, and dashes
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: GeoLite2-City
|
||||
- variable: frequency
|
||||
label: Frequency
|
||||
description: The number of hours between geoipupdate runs
|
||||
schema:
|
||||
type: int
|
||||
min: 1
|
||||
default: 8
|
||||
- variable: host_server
|
||||
label: Host Server
|
||||
description: The host name of the server to use
|
||||
schema:
|
||||
type: string
|
||||
default: updates.maxmind.com
|
||||
- variable: preserve_file_times
|
||||
label: Preserve File Times
|
||||
description: Whether to preserve modification times of files downloaded from the server
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: verbose
|
||||
label: Verbose
|
||||
description: Enable verbose mode. Prints out the steps that geoipupdate takes
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: proxy
|
||||
label: Proxy
|
||||
description: The proxy host name or IP address
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: proxy_user_pass
|
||||
label: Proxy Pass
|
||||
description: The proxy user name and password, separated by a colon
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
default: ""
|
||||
# Include{containerConfig}
|
||||
# Include{serviceRoot}
|
||||
- variable: main
|
||||
label: Main Service
|
||||
description: The Primary service on which the healthcheck runs, often the webUI
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: main
|
||||
label: Main Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10229
|
||||
required: true
|
||||
# Include{advancedPortHTTPS}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9443
|
||||
- variable: http
|
||||
label: http Service
|
||||
description: The http service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: http
|
||||
label: http Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10230
|
||||
required: true
|
||||
# Include{advancedPortHTTP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9000
|
||||
- variable: metrics
|
||||
label: metrics Service
|
||||
description: The metrics service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: metrics
|
||||
label: metrics Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10231
|
||||
required: true
|
||||
# Include{advancedPortHTTP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9301
|
||||
- variable: ldapldaps
|
||||
label: LDAPS Service
|
||||
description: The LDAPS service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: ldapldaps
|
||||
label: LDAPS Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 636
|
||||
required: true
|
||||
# Include{advancedPortTCP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 6636
|
||||
- variable: ldapldap
|
||||
label: LDAP Service
|
||||
description: The LDAPS service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: ldapldap
|
||||
label: LDAP Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 389
|
||||
required: true
|
||||
# Include{advancedPortTCP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 3389
|
||||
- variable: ldapmetrics
|
||||
label: LDAP Metrics Service
|
||||
description: The LDAP Metrics service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: ldapmetrics
|
||||
label: LDAP Metrics Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10232
|
||||
required: true
|
||||
# Include{advancedPortHTTP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9302
|
||||
- variable: proxyhttps
|
||||
label: Proxy HTTPS Service
|
||||
description: The Proxy HTTPS service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: proxyhttps
|
||||
label: Proxy HTTPS Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10233
|
||||
required: true
|
||||
# Include{advancedPortHTTPS}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9444
|
||||
- variable: proxyhttp
|
||||
label: Proxy HTTP Service
|
||||
description: The Proxy HTTP service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: proxyhttp
|
||||
label: Proxy HTTP Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10234
|
||||
required: true
|
||||
# Include{advancedPortHTTP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9001
|
||||
- variable: proxymetrics
|
||||
label: Proxy Metrics Service
|
||||
description: The Proxy HTTP service.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelectorLoadBalancer}
|
||||
# Include{serviceSelectorExtras}
|
||||
- variable: proxymetrics
|
||||
label: Proxy Metrics Service Port Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: Port
|
||||
description: This port exposes the container port on the service
|
||||
schema:
|
||||
type: int
|
||||
default: 10235
|
||||
required: true
|
||||
# Include{advancedPortHTTP}
|
||||
- variable: targetPort
|
||||
label: Target Port
|
||||
description: The internal(!) port on the container the Application runs on
|
||||
schema:
|
||||
type: int
|
||||
default: 9303
|
||||
# Include{serviceExpertRoot}
|
||||
default: false
|
||||
# Include{serviceExpert}
|
||||
# Include{serviceList}
|
||||
# Include{persistenceRoot}
|
||||
- variable: media
|
||||
label: App Media Storage
|
||||
description: Stores the Application Media.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{persistenceBasic}
|
||||
# Include{persistenceAdvanced}
|
||||
- variable: templates
|
||||
label: App Templates Storage
|
||||
description: Stores the Application Templates.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{persistenceBasic}
|
||||
# Include{persistenceAdvanced}
|
||||
- variable: certs
|
||||
label: App Certs Storage
|
||||
description: Stores the Application Certs.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{persistenceBasic}
|
||||
# Include{persistenceAdvanced}
|
||||
- variable: geoip
|
||||
label: App GeoIP Storage
|
||||
description: Stores the Application GeoIP.
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{persistenceBasic}
|
||||
# Include{persistenceAdvanced}
|
||||
# Include{persistenceList}
|
||||
# Include{ingressRoot}
|
||||
- variable: main
|
||||
label: Main (HTTPS) Ingress
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
- variable: http
|
||||
label: HTTP Ingress
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
- variable: proxyhttps
|
||||
label: Proxy HTTPS Ingress
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
- variable: proxyhttp
|
||||
label: Proxy HTTP Ingress
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
# Include{ingressList}
|
||||
# Include{security}
|
||||
# Include{securityContextAdvancedRoot}
|
||||
- variable: privileged
|
||||
label: Privileged mode
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: readOnlyRootFilesystem
|
||||
label: ReadOnly Root Filesystem
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: allowPrivilegeEscalation
|
||||
label: Allow Privilege Escalation
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: runAsNonRoot
|
||||
label: runAsNonRoot
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
# Include{securityContextAdvanced}
|
||||
# Include{podSecurityContextRoot}
|
||||
- variable: runAsUser
|
||||
label: runAsUser
|
||||
description: The UserID of the user running the application
|
||||
schema:
|
||||
type: int
|
||||
default: 1000
|
||||
- variable: runAsGroup
|
||||
label: runAsGroup
|
||||
description: The groupID this App of the user running the application
|
||||
schema:
|
||||
type: int
|
||||
default: 1000
|
||||
- variable: fsGroup
|
||||
label: fsGroup
|
||||
description: The group that should own ALL storage.
|
||||
schema:
|
||||
type: int
|
||||
default: 568
|
||||
# Include{podSecurityContextAdvanced}
|
||||
# Include{resources}
|
||||
# Include{advanced}
|
||||
# Include{addons}
|
||||
# Include{documentation}
|
||||
@@ -1,143 +0,0 @@
|
||||
{{/* Define the configmap */}}
|
||||
{{- define "authentik.config" -}}
|
||||
|
||||
{{- $authServerWorkerConfigName := printf "%s-authentik-config" (include "tc.common.names.fullname" .) }}
|
||||
{{- $authServerConfigName := printf "%s-authentik-server-config" (include "tc.common.names.fullname" .) }}
|
||||
{{- $geoipConfigName := printf "%s-geoip-config" (include "tc.common.names.fullname" .) }}
|
||||
{{- $ldapConfigName := printf "%s-ldap-config" (include "tc.common.names.fullname" .) }}
|
||||
{{- $proxyConfigName := printf "%s-proxy-config" (include "tc.common.names.fullname" .) }}
|
||||
{{ $host := printf "https://localhost:%v" .Values.service.main.ports.main.targetPort }}
|
||||
{{- if .Values.ingress.main.enabled }}
|
||||
{{ $first := (first .Values.ingress.main.hosts) }}
|
||||
{{- if $first }}
|
||||
{{ $host = printf "https://%s" $first.host }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This configmap are loaded on both main authentik container and worker */}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $authServerWorkerConfigName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_REDIS__HOST: {{ printf "%v-%v" .Release.Name "redis" }}
|
||||
AUTHENTIK_REDIS__PORT: "6379"
|
||||
AUTHENTIK_POSTGRESQL__NAME: {{ .Values.postgresql.postgresqlDatabase }}
|
||||
AUTHENTIK_POSTGRESQL__USER: {{ .Values.postgresql.postgresqlUsername }}
|
||||
AUTHENTIK_POSTGRESQL__HOST: {{ printf "%v-%v" .Release.Name "postgresql" }}
|
||||
AUTHENTIK_POSTGRESQL__PORT: "5432"
|
||||
{{/* Mail */}}
|
||||
{{- with .Values.authentik.mail.port }}
|
||||
AUTHENTIK_EMAIL__PORT: {{ . | quote }}
|
||||
{{- end }}
|
||||
AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.mail.tls | quote }}
|
||||
AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.mail.ssl | quote }}
|
||||
{{- with .Values.authentik.mail.timeout }}
|
||||
AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{/* Logging */}}
|
||||
{{- with .Values.authentik.logging.log_level }}
|
||||
AUTHENTIK_LOG_LEVEL: {{ . }}
|
||||
{{- end }}
|
||||
{{/* General */}}
|
||||
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disable_startup_analytics | quote }}
|
||||
AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disable_update_check | quote }}
|
||||
{{- with .Values.authentik.general.avatars }}
|
||||
AUTHENTIK_AVATARS: {{ . }}
|
||||
{{- end }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allow_user_name_change | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allow_user_mail_change | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allow_user_username_change | quote }}
|
||||
AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdpr_compliance | quote }}
|
||||
AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
|
||||
AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.token_length | quote }}
|
||||
{{- with .Values.authentik.general.footer_links }}
|
||||
AUTHENTIK_FOOTER_LINKS: {{ . | squote }}
|
||||
{{- end }}
|
||||
{{/* Error Reporting */}}
|
||||
AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.error_reporting.enabled | quote }}
|
||||
AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.error_reporting.send_pii | quote }}
|
||||
{{- with .Values.authentik.error_reporting.environment }}
|
||||
AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . }}
|
||||
{{- end }}
|
||||
{{/* LDAP */}}
|
||||
{{- with .Values.authentik.ldap.tls_ciphers }}
|
||||
AUTHENTIK_LDAP__TLS__CIPHERS: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{/* Outposts */}}
|
||||
AUTHENTIK_OUTPOSTS__DISCOVER: {{ "false" | quote }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This configmap are loaded on both main authentik container and worker */}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $authServerConfigName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{/* Listen */}}
|
||||
AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.main.ports.main.targetPort | default 9443 }}
|
||||
AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.http.ports.http.targetPort | default 9000 }}
|
||||
AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.metrics.ports.metrics.targetPort | default 9301 }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This configmap is loaded on ldap container */}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $ldapConfigName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | default "true" | quote }}
|
||||
AUTHENTIK_HOST: {{ .Values.outposts.ldap.host | default (printf "https://localhost:%v" .Values.service.main.ports.main.targetPort) }}
|
||||
AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.ldap.host_browser | default $host }}
|
||||
AUTHENTIK_LISTEN__LDAPS: 0.0.0.0:{{ .Values.service.ldapldaps.ports.ldapldaps.targetPort | default 6636 }}
|
||||
AUTHENTIK_LISTEN__LDAP: 0.0.0.0:{{ .Values.service.ldapldap.ports.ldapldap.targetPort | default 3389 }}
|
||||
AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort | default 9302 }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This configmap is loaded on ldap container */}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $proxyConfigName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
AUTHENTIK_INSECURE: {{ .Values.outposts.proxy.insecure | default "true" | quote }}
|
||||
AUTHENTIK_HOST: {{ .Values.outposts.proxy.host | default (printf "https://localhost:%v" .Values.service.main.ports.main.targetPort) }}
|
||||
AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.proxy.host_browser | default $host }}
|
||||
AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.proxyhttps.ports.proxyhttps.targetPort | default 9444 }}
|
||||
AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.proxyhttp.ports.proxyhttp.targetPort | default 9001 }}
|
||||
AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.proxymetrics.ports.proxymetrics.targetPort | default 9303 }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This configmap is loaded on geoip container */}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $geoipConfigName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- with .Values.geoip.edition_ids }}
|
||||
GEOIPUPDATE_EDITION_IDS: {{ . }}
|
||||
{{- end }}
|
||||
GEOIPUPDATE_FREQUENCY: {{ .Values.geoip.frequency | quote }}
|
||||
{{- with .Values.geoip.host_server }}
|
||||
GEOIPUPDATE_HOST: {{ . }}
|
||||
{{- end }}
|
||||
GEOIPUPDATE_PRESERVE_FILE_TIMES: {{ ternary "1" "0" .Values.geoip.preserve_file_times | quote }}
|
||||
GEOIPUPDATE_VERBOSE: {{ ternary "1" "0" .Values.geoip.verbose | quote }}
|
||||
{{- end -}}
|
||||
@@ -1,20 +0,0 @@
|
||||
{{/* Define the geoip container */}}
|
||||
{{- define "authentik.geoip" -}}
|
||||
image: {{ .Values.geoipImage.repository }}:{{ .Values.geoipImage.tag }}
|
||||
imagePullPolicy: {{ .Values.geoipImage.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
- name: geoip
|
||||
mountPath: "/usr/share/GeoIP"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-geoip-secret'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-geoip-config'
|
||||
{{/* TODO: Add healthchecks */}}
|
||||
{{/* TODO: https://github.com/maxmind/geoipupdate/issues/105 */}}
|
||||
{{- end -}}
|
||||
@@ -1,48 +0,0 @@
|
||||
{{/* Define the ldap container */}}
|
||||
{{- define "authentik.ldap" -}}
|
||||
image: {{ .Values.ldapImage.repository }}:{{ .Values.ldapImage.tag }}
|
||||
imagePullPolicy: {{ .Values.ldapImage.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.podSecurityContext.runAsUser }}
|
||||
runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-ldap-secret'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-ldap-config'
|
||||
ports:
|
||||
- containerPort: {{ .Values.service.ldapldaps.ports.ldapldaps.targetPort }}
|
||||
name: ldapldaps
|
||||
- containerPort: {{ .Values.service.ldapldap.ports.ldapldap.targetPort }}
|
||||
name: ldapldap
|
||||
{{- if .Values.outposts.ldap.metrics }}
|
||||
- containerPort: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
|
||||
name: ldapmetrics
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
|
||||
{{- end -}}
|
||||
@@ -1,48 +0,0 @@
|
||||
{{/* Define the proxy container */}}
|
||||
{{- define "authentik.proxy" -}}
|
||||
image: {{ .Values.proxyImage.repository }}:{{ .Values.proxyImage.tag }}
|
||||
imagePullPolicy: {{ .Values.proxyImage.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.podSecurityContext.runAsUser }}
|
||||
runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-proxy-secret'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-proxy-config'
|
||||
ports:
|
||||
- containerPort: {{ .Values.service.proxyhttps.ports.proxyhttps.targetPort }}
|
||||
name: proxyhttps
|
||||
- containerPort: {{ .Values.service.proxyhttp.ports.proxyhttp.targetPort }}
|
||||
name: proxyhttp
|
||||
{{- if .Values.outposts.proxy.metrics }}
|
||||
- containerPort: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
|
||||
name: proxymetrics
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /outpost.goauthentik.io/ping
|
||||
port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
|
||||
initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
|
||||
{{- end -}}
|
||||
@@ -1,109 +0,0 @@
|
||||
{{/* Define the secret */}}
|
||||
{{- define "authentik.secret" -}}
|
||||
|
||||
{{- $authentikSecretName := printf "%s-authentik-secret" (include "tc.common.names.fullname" .) }}
|
||||
{{- $geoipSecretName := printf "%s-geoip-secret" (include "tc.common.names.fullname" .) }}
|
||||
{{- $ldapSecretName := printf "%s-ldap-secret" (include "tc.common.names.fullname" .) }}
|
||||
{{- $proxySecretName := printf "%s-proxy-secret" (include "tc.common.names.fullname" .) }}
|
||||
{{- $token := randAlphaNum 128 | b64enc }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This secrets are loaded on both main authentik container and worker */}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $authentikSecretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{/* Secret Key */}}
|
||||
{{- with (lookup "v1" "Secret" .Release.Namespace $authentikSecretName) }}
|
||||
AUTHENTIK_SECRET_KEY: {{ index .data "AUTHENTIK_SECRET_KEY" }}
|
||||
{{ $token = index .data "AUTHENTIK_BOOTSTRAP_TOKEN" }}
|
||||
{{- else }}
|
||||
AUTHENTIK_SECRET_KEY: {{ randAlphaNum 32 | b64enc }}
|
||||
{{- end }}
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: {{ $token }}
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.postgresql.postgresqlPassword | trimAll "\"" | b64enc }}
|
||||
AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.redisPassword | trimAll "\"" | b64enc }}
|
||||
{{/* Credentials */}}
|
||||
{{- with .Values.authentik.credentials.password }}
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{/* Mail */}}
|
||||
{{- with .Values.authentik.mail.host }}
|
||||
AUTHENTIK_EMAIL__HOST: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- with .Values.authentik.mail.user }}
|
||||
AUTHENTIK_EMAIL__USERNAME: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- with .Values.authentik.mail.pass }}
|
||||
AUTHENTIK_EMAIL__PASSWORD: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- with .Values.authentik.mail.from }}
|
||||
AUTHENTIK_EMAIL__FROM: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This secrets are loaded on geoip container */}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $geoipSecretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{/* Credentials */}}
|
||||
{{- with .Values.geoip.account_id }}
|
||||
GEOIPUPDATE_ACCOUNT_ID: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- with .Values.geoip.license_key }}
|
||||
GEOIPUPDATE_LICENSE_KEY: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{/* Proxy */}}
|
||||
{{- with .Values.geoip.proxy }}
|
||||
GEOIPUPDATE_PROXY: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- with .Values.geoip.proxy_user_pass }}
|
||||
GEOIPUPDATE_PROXY_USER_PASSWORD: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This secrets are loaded on ldap container */}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $ldapSecretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- with .Values.outposts.ldap.token }}
|
||||
AUTHENTIK_TOKEN: {{ . | b64enc }}
|
||||
{{- else }}
|
||||
AUTHENTIK_TOKEN: {{ $token }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
|
||||
{{/* This secrets are loaded on ldap container */}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $proxySecretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- with .Values.outposts.proxy.token }}
|
||||
AUTHENTIK_TOKEN: {{ . | b64enc }}
|
||||
{{- else }}
|
||||
AUTHENTIK_TOKEN: {{ $token }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,52 +0,0 @@
|
||||
{{/* Define the worker container */}}
|
||||
{{- define "authentik.worker" -}}
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.podSecurityContext.runAsUser }}
|
||||
runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
|
||||
readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
|
||||
runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
|
||||
args: ["worker"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-authentik-secret'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-authentik-config'
|
||||
volumeMounts:
|
||||
- name: media
|
||||
mountPath: "/media"
|
||||
- name: templates
|
||||
mountPath: "/templates"
|
||||
- name: certs
|
||||
mountPath: "/certs"
|
||||
- name: geoip
|
||||
mountPath: "/geoip"
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
|
||||
failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
|
||||
{{- end -}}
|
||||
@@ -1,43 +0,0 @@
|
||||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.common.loader.init" . }}
|
||||
|
||||
{{/* Render secret */}}
|
||||
{{- include "authentik.secret" . }}
|
||||
|
||||
{{/* Render config */}}
|
||||
{{- include "authentik.config" . }}
|
||||
|
||||
{{- if .Values.authentik.metrics.enabled -}}
|
||||
{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}}
|
||||
{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}}
|
||||
{{- $_ := set .Values.podAnnotations "prometheus.io/port" (.Values.service.metrics.ports.metrics.targetPort | default 9301 | quote) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.workerContainer.enabled -}}
|
||||
{{- $_ := set .Values.additionalContainers "worker" (include "authentik.worker" . | fromYaml) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.geoip.enabled -}}
|
||||
{{- $_ := set .Values.additionalContainers "geoip" (include "authentik.geoip" . | fromYaml) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.outposts.ldap.enabled -}}
|
||||
{{- $_ := set .Values.additionalContainers "ldap-outpost" (include "authentik.ldap" . | fromYaml) -}}
|
||||
{{/* - if .Values.outposts.ldap.metrics - */}}
|
||||
{{/* https://github.com/prometheus/prometheus/issues/3756 */}}
|
||||
{{/* TODO: Figure how the pipe works to connect it to prometheus operator */}}
|
||||
{{/* We can't define multiple ports/endpoints with annotations */}}
|
||||
{{/* - end - */}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.outposts.proxy.enabled -}}
|
||||
{{- $_ := set .Values.additionalContainers "proxy-outpost" (include "authentik.proxy" . | fromYaml) -}}
|
||||
{{/* - if .Values.outposts.proxy.metrics - */}}
|
||||
{{/* https://github.com/prometheus/prometheus/issues/3756 */}}
|
||||
{{/* TODO: Figure how the pipe works to connect it to prometheus operator */}}
|
||||
{{/* We can't define multiple ports/endpoints with annotations */}}
|
||||
{{/* - end - */}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.common.loader.apply" . }}
|
||||
@@ -1,237 +0,0 @@
|
||||
image:
|
||||
repository: tccr.io/truecharts/authentik
|
||||
tag: 2022.9.0@sha256:e3ccba4164bd4f8715eba5f28e1dfeb80b090a60875732b68a1e7e857c6e27a1
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
geoipImage:
|
||||
repository: tccr.io/truecharts/geoipupdate
|
||||
tag: v4.9@sha256:ce42b4252c8cd4a9e39275fd7c3312e5df7bda0d7034df565af4362d7e0d26ce
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
ldapImage:
|
||||
repository: tccr.io/truecharts/authentik-ldap
|
||||
tag: 2022.9.0@sha256:7a105527dfd259a7d77a1516ee9729658809279101070a11172c4aa7dc398d33
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
proxyImage:
|
||||
repository: tccr.io/truecharts/authentik-proxy
|
||||
tag: 2022.9.0@sha256:b3756005a151b03de939f1c7f3034ab0ec16d18c9f11e025e60831707d5188b8
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
args: ["server"]
|
||||
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
workerContainer:
|
||||
enabled: true
|
||||
|
||||
authentik:
|
||||
credentials:
|
||||
password: "supersecret"
|
||||
general:
|
||||
disable_update_check: false
|
||||
disable_startup_analytics: true
|
||||
allow_user_name_change: true
|
||||
allow_user_mail_change: true
|
||||
allow_user_username_change: true
|
||||
gdpr_compliance: true
|
||||
impersonation: true
|
||||
avatars: "gravatar"
|
||||
token_length: 128
|
||||
# Use single quotes for footer_links
|
||||
footer_links: '[{"name": "Link Name", "href": "https://mylink.com"}]'
|
||||
mail:
|
||||
host: ""
|
||||
port: 25
|
||||
tls: false
|
||||
ssl: false
|
||||
timeout: 10
|
||||
user: ""
|
||||
pass: ""
|
||||
from: ""
|
||||
error_reporting:
|
||||
enabled: false
|
||||
send_pii: false
|
||||
environment: "customer"
|
||||
logging:
|
||||
log_level: "info"
|
||||
ldap:
|
||||
tls_ciphers: "null"
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
geoip:
|
||||
enabled: false
|
||||
account_id: ""
|
||||
license_key: ""
|
||||
proxy: ""
|
||||
proxy_user_pass: ""
|
||||
edition_ids: "GeoLite2-City"
|
||||
frequency: 8
|
||||
host_server: "updates.maxmind.com"
|
||||
preserve_file_times: false
|
||||
verbose: false
|
||||
|
||||
outposts:
|
||||
ldap:
|
||||
# -- First you have to create an Outpost in the GUI. Applications > Outposts
|
||||
enabled: false
|
||||
# -- Host Browser by default is set to the first ingress host you set
|
||||
# host_browser: ""
|
||||
# -- Host should not need to be overridden. Defaults to https://localhost:9443
|
||||
# host: ""
|
||||
# -- As we use https://localhost:9443 it's an unsecure connection
|
||||
# insecure: false
|
||||
# -- Token is only needed if you accidentally deleted the token within the UI
|
||||
# token: ""
|
||||
metrics: false
|
||||
proxy:
|
||||
# -- First you have to create an Outpost in the GUI. Applications > Outposts
|
||||
enabled: false
|
||||
# -- Host Browser by default is set to the first ingress host you set
|
||||
# host_browser: ""
|
||||
# -- As we use https://localhost:9443 it's an unsecure connection
|
||||
# insecure: false
|
||||
# -- Host should not need to be overridden. Defaults to https://localhost:9443
|
||||
# host: ""
|
||||
# -- Token is only needed if you accidentally deleted the token within the UI
|
||||
# token: ""
|
||||
metrics: false
|
||||
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-authentik-secret'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-authentik-config'
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-authentik-server-config'
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
type: HTTP
|
||||
path: /-/health/live/
|
||||
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
||||
readiness:
|
||||
type: HTTP
|
||||
path: /-/health/ready/
|
||||
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
||||
startup:
|
||||
type: HTTP
|
||||
path: /-/health/ready/
|
||||
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
protocol: HTTPS
|
||||
port: 10229
|
||||
targetPort: 9443
|
||||
http:
|
||||
enabled: true
|
||||
ports:
|
||||
http:
|
||||
enabled: true
|
||||
protocol: HTTP
|
||||
port: 10230
|
||||
targetPort: 9000
|
||||
metrics:
|
||||
enabled: true
|
||||
ports:
|
||||
metrics:
|
||||
enabled: true
|
||||
protocol: HTTP
|
||||
port: 10231
|
||||
targetPort: 9301
|
||||
ldapldaps:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
ldapldaps:
|
||||
enabled: true
|
||||
port: 636
|
||||
targetPort: 6636
|
||||
ldapldap:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
ldapldap:
|
||||
enabled: true
|
||||
port: 389
|
||||
targetPort: 3389
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
port: 10232
|
||||
protocol: HTTP
|
||||
targetPort: 9302
|
||||
proxyhttps:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
proxyhttps:
|
||||
enabled: true
|
||||
port: 10233
|
||||
protocol: HTTPS
|
||||
targetPort: 9444
|
||||
proxyhttp:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
proxyhttp:
|
||||
enabled: true
|
||||
port: 10234
|
||||
protocl: HTTP
|
||||
targetPort: 9001
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
port: 10235
|
||||
protocol: HTTP
|
||||
targetPort: 9303
|
||||
|
||||
ingress:
|
||||
http:
|
||||
autoLink: true
|
||||
proxyhttps:
|
||||
autoLink: true
|
||||
proxyhttp:
|
||||
autoLink: true
|
||||
|
||||
persistence:
|
||||
media:
|
||||
enabled: true
|
||||
mountPath: "/media"
|
||||
templates:
|
||||
enabled: true
|
||||
mountPath: "/templates"
|
||||
certs:
|
||||
enabled: true
|
||||
mountPath: "/certs"
|
||||
geoip:
|
||||
enabled: true
|
||||
mountPath: "/geoip"
|
||||
|
||||
postgresql:
|
||||
enabled: true
|
||||
existingSecret: "dbcreds"
|
||||
postgresqlUsername: authentik
|
||||
postgresqlDatabase: authentik
|
||||
|
||||
redis:
|
||||
enabled: true
|
||||
existingSecret: "rediscreds"
|
||||
|
||||
portal:
|
||||
enabled: true
|
||||
Reference in New Issue
Block a user