diff --git a/charts/incubator/authentik/Chart.yaml b/charts/incubator/authentik/Chart.yaml index e2291dc242a..865dc513445 100644 --- a/charts/incubator/authentik/Chart.yaml +++ b/charts/incubator/authentik/Chart.yaml @@ -27,7 +27,7 @@ sources: - https://github.com/truecharts/charts/tree/master/charts/incubator/authentik - https://github.com/goauthentik/authentik - https://goauthentik.io/docs/ -version: 5.0.0 +version: 6.0.0 annotations: truecharts.org/catagories: | - authentication diff --git a/charts/incubator/authentik/docs/installation_notes.md b/charts/incubator/authentik/docs/installation_notes.md new file mode 100644 index 00000000000..0cf991a117e --- /dev/null +++ b/charts/incubator/authentik/docs/installation_notes.md @@ -0,0 +1,25 @@ +# Installation notes + +## Credentials + +Default username: `akadmin` + +## Outposts + +Enable each outpost by simple setting `enabled` to `true`. +Scale users, just have to check the checkbox + +> You have to create an outpost in the GUI first. +> Applications > Outposts + +### Host + +`host` should not need to be overridden. Defaults to `http://localhost:9000` + +### Host Browser + +`host_browser` by default is set to the first ingress host you set + +### Token + +`token` is only needed if you accidentally deleted it within the UI diff --git a/charts/incubator/authentik/questions.yaml b/charts/incubator/authentik/questions.yaml index 9ab7c5f3864..681cd63723c 100644 --- a/charts/incubator/authentik/questions.yaml +++ b/charts/incubator/authentik/questions.yaml @@ -13,348 +13,439 @@ questions: # Include{controllerExpert} # Include{controllerExpertExtraArgs} - variable: authentik - group: "Container Configuration" - label: "Authentik Configuration" + group: Container Configuration + label: Authentik Configuration schema: additional_attrs: true type: dict attrs: - variable: credentials - label: "Credentials" + label: Credentials schema: additional_attrs: true type: dict attrs: - variable: password - label: "Password (Initial install only)" - description: "Password for user. Can be used for any flow executor" - schema: - type: string - private: true - required: true - default: "" - - variable: token - label: "Token (Initial install only)" - description: "The string you specify for this variable is the token key you can use to authenticate yourself to the API" + label: Password (Initial install only) + description: Password for user. Can be used for any flow executor schema: type: string private: true required: true default: "" - variable: general - label: "General" + label: General schema: additional_attrs: true type: dict attrs: - variable: disable_update_check - label: "Disable Update Check" - description: "Disable the inbuilt update-checker" + label: Disable Update Check + description: Disable the inbuilt update-checker schema: type: boolean default: false - variable: disable_startup_analytics - label: "Disable Startup Analytics" - description: "Disable startup analytics" + label: Disable Startup Analytics + description: Disable startup analytics schema: type: boolean default: true - variable: allow_user_name_change - label: "Allow User Name Change" - description: "Enable the ability for users to change their Name" + label: Allow User Name Change + description: Enable the ability for users to change their Name schema: type: boolean default: true - variable: allow_user_mail_change - label: "Allow User Mail Change" - description: "Enable the ability for users to change their Email address" + label: Allow User Mail Change + description: Enable the ability for users to change their Email address schema: type: boolean default: true - variable: allow_user_username_change - label: "Allow User Username Change" - description: "Enable the ability for users to change their Usernames" + label: Allow User Username Change + description: Enable the ability for users to change their Usernames schema: type: boolean default: true - variable: gdpr_compliance - label: "GDPR Compliance" - description: "When enabled, all the events caused by a user will be deleted upon the user's deletion" + label: GDPR Compliance + description: When enabled, all the events caused by a user will be deleted upon the user's deletion schema: type: boolean default: true - variable: impersonation - label: "Impersonation" - description: "Globally enable/disable impersonation" + label: Impersonation + description: Globally enable / disable impersonation schema: type: boolean default: true - variable: avatars - label: "Avatars" - description: "Configure how authentik should show avatars for users" + label: Avatars + description: Configure how authentik should show avatars for users schema: type: string - default: "gravatar" + default: gravatar - variable: token_length - label: "Token Length" - description: "Configure the length of generated tokens" + label: Token Length + description: Configure the length of generated tokens schema: type: int default: 128 - variable: footer_links - label: "Footer Links" - description: "This option configures the footer links on the flow executor pages" + label: Footer Links + description: This option configures the footer links on the flow executor pages schema: type: string default: "" - variable: mail - label: "e-Mail" + label: e-Mail schema: additional_attrs: true type: dict attrs: - variable: host - label: "Mail Server Host" - description: "Sets host of mail server" + label: Mail Server Host + description: Sets host of mail server schema: type: string default: "" - variable: port - label: "Mail Server Port" - description: "Sets port of mail server" + label: Mail Server Port + description: Sets port of mail server schema: type: int default: 25 - variable: tls - label: "Use TLS for authentication" - description: "Sets tls for mail server authentication" + label: Use TLS for authentication + description: Sets tls for mail server authentication schema: type: boolean default: false - variable: ssl - label: "Use SSL for authentication" - description: "Sets ssl for mail server authentication" + label: Use SSL for authentication + description: Sets ssl for mail server authentication schema: type: boolean default: false - variable: timeout - label: "Timeout of authentication" - description: "Sets timeout for mail server authentication" + label: Timeout of authentication + description: Sets timeout for mail server authentication schema: type: int default: 10 - variable: user - label: "Username" - description: "Sets username of mail server" + label: Username + description: Sets username of mail server schema: type: string default: "" - variable: pass - label: "Password" - description: "Sets password of mail server" + label: Password + description: Sets password of mail server schema: type: string private: true default: "" - variable: from - label: "From Address" - description: "Email address authentik will send from" + label: From Address + description: Email address authentik will send from schema: type: string default: "" - variable: error_reporting - label: "Error Reporting" + label: Error Reporting schema: additional_attrs: true type: dict attrs: - variable: enabled - label: "Enable Reporting" - description: "Enables error reporting" + label: Enable Reporting + description: Enables error reporting schema: type: boolean default: false show_subquestions_if: subquestions: - variable: send_pii - label: "Send Personal Data" - description: "Whether or not to send personal data, like usernames" + label: Send Personal Data + description: Whether or not to send personal data, like usernames schema: type: boolean default: false - variable: environment - label: "Environment" - description: "Unique environment that is attached to your error reports, should be set to your email address for example." + label: Environment + description: Unique environment that is attached to your error reports, should be set to your email address for example. schema: type: string - default: "customer" + default: customer - variable: logging - label: "Logging" + label: Logging schema: additional_attrs: true type: dict attrs: - variable: log_level - label: "Log Level" - description: "Log level for the server and worker containers" + label: Log Level + description: Log level for the server and worker containers schema: type: string - default: "info" + default: info enum: - value: trace - description: "trace" + description: trace - value: debug - description: "debug" + description: debug - value: info - description: "info" + description: info - value: warning - description: "warning" + description: warning - value: error - description: "error" + description: error - variable: metrics - label: "Metrics" + label: Metrics schema: additional_attrs: true type: dict attrs: - variable: enabled - label: "Metrics Endpoint" - description: "Enables metrics endpoint for Authentik and embedded outpost" + label: Metrics Endpoint + description: Enables metrics endpoint for Authentik and embedded outpost schema: type: boolean default: false - variable: ldap - label: "LDAP" + label: LDAP schema: additional_attrs: true type: dict attrs: - variable: tls_ciphers - label: "TLS Ciphers" - description: "Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources. Setting applies to all sources" + label: TLS Ciphers + description: Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources. Setting applies to all sources schema: type: string default: "null" - variable: outposts - group: "Container Configuration" - label: "Outpost Configuration" + group: Container Configuration + label: Outpost Configuration schema: additional_attrs: true type: dict attrs: - variable: ldap - label: "LDAP" + label: LDAP schema: additional_attrs: true type: dict attrs: - variable: enabled - label: "Enable LDAP outpost" - description: "Enable only AFTER you created an LDAP Provider and an API Token" + label: Enable LDAP outpost schema: type: boolean default: false show_subquestions_if: true subquestions: - - variable: insecure - label: "Insecure" - description: "Check only if you accessing Authentik in an unsecure way" + - variable: overrideHost + label: Override Host schema: type: boolean default: false - - variable: host - label: "Authentik Host" - description: "URL of your Authentik server. (e.g. https://auth.domain.com)" + show_subquestions_if: true + subquestions: + - variable: host + label: Authentik Host + description: "URL of your Authentik server. (e.g. https://auth.domain.com)" + schema: + type: string + required: true + default: "" + - variable: insecure + label: Insecure + description: Check only if you accessing Authentik in an unsecure way + schema: + type: boolean + default: false + - variable: overrideToken + label: Override Token + description: Overrides the random generated token to provide your own schema: - type: string - required: true - default: "" - - variable: token - label: "API Token" - description: "Generated in the Authentik GUI > Directory > Token & App Passwords" + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: API Token + description: Generated in the Authentik GUI > Directory > Token & App Passwords + schema: + type: string + private: true + required: true + default: "" + - variable: overrideBrowserHost + label: Override Host Browser + description: Overrides the Browser Host, by default the first ingress host is used schema: - type: string - private: true - required: true - default: "" + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: host_browser + label: Host Browser + description: URL to use in the browser, when it differs from << host >> + schema: + type: string + required: true + default: "" - variable: metrics - label: "Metrics Endpoint" - description: "Enables metric endpoint in LDAP Outpost" + label: Metrics Endpoint + description: Enables metric endpoint in LDAP Outpost + schema: + type: boolean + default: false + - variable: proxy + label: Proxy + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Proxy outpost + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: overrideHost + label: Override Host + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: host + label: Authentik Host + description: "URL of your Authentik server. (e.g. https://auth.domain.com)" + schema: + type: string + required: true + default: "" + - variable: insecure + label: Insecure + description: Check only if you accessing Authentik in an unsecure way + schema: + type: boolean + default: false + - variable: overrideToken + label: Override Token + description: Overrides the random generated token to provide your own + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: API Token + description: Generated in the Authentik GUI > Directory > Token & App Passwords + schema: + type: string + private: true + required: true + default: "" + - variable: overrideBrowserHost + label: Override Host Browser + description: Overrides the Browser Host, by default the first ingress host is used + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: host_browser + label: Host Browser + description: URL to use in the browser, when it differs from << host >> + schema: + type: string + required: true + default: "" + - variable: metrics + label: Metrics Endpoint + description: Enables metric endpoint in Proxy Outpost schema: type: boolean default: false - variable: geoip - group: "Container Configuration" - label: "GeoIP Configuration" + group: Container Configuration + label: GeoIP Configuration schema: additional_attrs: true type: dict attrs: - variable: enabled - label: "Enable GeoIP Container" - description: "Enables GeoIP container" + label: Enable GeoIP Container + description: Enables GeoIP container schema: type: boolean default: false show_subquestions_if: true subquestions: - variable: account_id - label: "Account ID" - description: "Your MaxMind account ID" + label: Account ID + description: Your MaxMind account ID schema: type: string private: true required: true default: "" - variable: license_key - label: "License Key" - description: "Your case-sensitive MaxMind license key" + label: License Key + description: Your case-sensitive MaxMind license key schema: type: string private: true required: true default: "" - variable: edition_ids - label: "Edition IDs" - description: "List of space-separated database edition IDs. Edition IDs may consist of letters, digits, and dashes" + label: Edition IDs + description: List of space-separated database edition IDs. Edition IDs may consist of letters, digits, and dashes schema: type: string required: true - default: "GeoLite2-City" + default: GeoLite2-City - variable: frequency - label: "Frequency" - description: "The number of hours between geoipupdate runs" + label: Frequency + description: The number of hours between geoipupdate runs schema: type: int min: 1 default: 8 - variable: host_server - label: "Host Server" - description: "The host name of the server to use" + label: Host Server + description: The host name of the server to use schema: type: string - default: "updates.maxmind.com" + default: updates.maxmind.com - variable: preserve_file_times - label: "Preserve File Times" - description: "Whether to preserve modification times of files downloaded from the server" + label: Preserve File Times + description: Whether to preserve modification times of files downloaded from the server schema: type: boolean default: false - variable: verbose - label: "Verbose" - description: "Enable verbose mode. Prints out the steps that geoipupdate takes" + label: Verbose + description: Enable verbose mode. Prints out the steps that geoipupdate takes schema: type: boolean default: false - variable: proxy - label: "Proxy" - description: "The proxy host name or IP address" + label: Proxy + description: The proxy host name or IP address schema: type: string default: "" - variable: proxy_user_pass - label: "Proxy Pass" - description: "The proxy user name and password, separated by a colon" + label: Proxy Pass + description: The proxy user name and password, separated by a colon schema: type: string private: true @@ -362,192 +453,265 @@ questions: # Include{containerConfig} # Include{serviceRoot} - variable: main - label: "Main Service" - description: "The Primary service on which the healthcheck runs, often the webUI" + label: Main Service + description: The Primary service on which the healthcheck runs, often the webUI schema: additional_attrs: true type: dict attrs: # Include{serviceSelector} - variable: main - label: "Main Service Port Configuration" + label: Main Service Port Configuration schema: additional_attrs: true type: dict attrs: - variable: port - label: "Port" - description: "This port exposes the container port on the service" + label: Port + description: This port exposes the container port on the service schema: type: int default: 10229 required: true # Include{advancedPortHTTPS} - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" + label: Target Port + description: The internal(!) port on the container the Application runs on schema: type: int default: 9443 - variable: http - label: "http Service" - description: "The http service." + label: http Service + description: The http service. schema: additional_attrs: true type: dict attrs: # Include{serviceSelector} - variable: http - label: "http Service Port Configuration" + label: http Service Port Configuration schema: additional_attrs: true type: dict attrs: - variable: port - label: "Port" - description: "This port exposes the container port on the service" + label: Port + description: This port exposes the container port on the service schema: type: int default: 10230 required: true # Include{advancedPortHTTP} - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" + label: Target Port + description: The internal(!) port on the container the Application runs on schema: type: int default: 9000 - variable: metrics - label: "metrics Service" - description: "The metrics service." + label: metrics Service + description: The metrics service. schema: additional_attrs: true type: dict attrs: # Include{serviceSelector} - variable: metrics - label: "metrics Service Port Configuration" + label: metrics Service Port Configuration schema: additional_attrs: true type: dict attrs: - variable: port - label: "Port" - description: "This port exposes the container port on the service" + label: Port + description: This port exposes the container port on the service schema: type: int default: 10231 required: true # Include{advancedPortHTTP} - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" + label: Target Port + description: The internal(!) port on the container the Application runs on schema: type: int default: 9301 - - variable: ldap - label: "LDAP Service" - description: "The LDAP service." + - variable: ldapldaps + label: LDAPS Service + description: The LDAPS service. schema: additional_attrs: true type: dict attrs: # Include{serviceSelector} - - variable: ldap1 - label: "ldap1 Service Port Configuration" + - variable: ldapldaps + label: LDAPS Service Port Configuration schema: additional_attrs: true type: dict attrs: - variable: port - label: "Port" - description: "This port exposes the container port on the service" - schema: - type: int - default: 389 - required: true -# Include{advancedPortHTTP} - - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" - schema: - type: int - default: 3389 - - variable: ldap2 - label: "ldap2 Service Port Configuration" - schema: - additional_attrs: true - type: dict - attrs: - - variable: port - label: "Port" - description: "This port exposes the container port on the service" + label: Port + description: This port exposes the container port on the service schema: type: int default: 636 required: true - - variable: advanced - label: "Show Advanced settings" - schema: - type: boolean - default: false - show_subquestions_if: true - subquestions: - - variable: protocol - label: "Port Type" - schema: - type: string - default: "HTTP" - enum: - - value: HTTP - description: "HTTP" - - value: "HTTPS" - description: "HTTPS" - - value: TCP - description: "TCP" - - value: "UDP" - description: "UDP" - - variable: nodePort - label: "Node Port (Optional)" - description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" - schema: - type: int - min: 9000 - max: 65535 +# Include{advancedPortTCP} - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" + label: Target Port + description: The internal(!) port on the container the Application runs on schema: type: int default: 6636 - - variable: ldap-metrics - label: "LDAP metrics Service Port Configuration" + - variable: ldapldap + label: LDAP Service + description: The LDAPS service. + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: ldapldap + label: LDAP Service Port Configuration schema: additional_attrs: true type: dict attrs: - variable: port - label: "Port" - description: "This port exposes the container port on the service" + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 389 + required: true +# Include{advancedPortTCP} + - variable: targetPort + label: Target Port + description: The internal(!) port on the container the Application runs on + schema: + type: int + default: 3389 + - variable: ldapmetrics + label: LDAP Metrics Service + description: The LDAP Metrics service. + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: ldapmetrics + label: LDAP Metrics Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service schema: type: int default: 10232 required: true # Include{advancedPortHTTP} - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" + label: Target Port + description: The internal(!) port on the container the Application runs on schema: type: int - default: 9300 + default: 9302 + - variable: proxyhttps + label: Proxy HTTPS Service + description: The Proxy HTTPS service. + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: proxyhttps + label: Proxy HTTPS Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10233 + required: true +# Include{advancedPortHTTPS} + - variable: targetPort + label: Target Port + description: The internal(!) port on the container the Application runs on + schema: + type: int + default: 9444 + - variable: proxyhttp + label: Proxy HTTP Service + description: The Proxy HTTP service. + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: proxyhttp + label: Proxy HTTP Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10234 + required: true +# Include{advancedPortHTTP} + - variable: targetPort + label: Target Port + description: The internal(!) port on the container the Application runs on + schema: + type: int + default: 9001 + - variable: proxymetrics + label: Proxy Metrics Service + description: The Proxy HTTP service. + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: proxymetrics + label: Proxy Metrics Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10235 + required: true +# Include{advancedPortHTTP} + - variable: targetPort + label: Target Port + description: The internal(!) port on the container the Application runs on + schema: + type: int + default: 9303 # Include{serviceExpertRoot} default: false # Include{serviceExpert} # Include{serviceList} # Include{persistenceRoot} - variable: media - label: "App Media Storage" - description: "Stores the Application Media." + label: App Media Storage + description: Stores the Application Media. schema: additional_attrs: true type: dict @@ -555,8 +719,8 @@ questions: # Include{persistenceBasic} # Include{persistenceAdvanced} - variable: templates - label: "App Templates Storage" - description: "Stores the Application Templates." + label: App Templates Storage + description: Stores the Application Templates. schema: additional_attrs: true type: dict @@ -564,8 +728,8 @@ questions: # Include{persistenceBasic} # Include{persistenceAdvanced} - variable: certs - label: "App Certs Storage" - description: "Stores the Application Certs." + label: App Certs Storage + description: Stores the Application Certs. schema: additional_attrs: true type: dict @@ -573,8 +737,8 @@ questions: # Include{persistenceBasic} # Include{persistenceAdvanced} - variable: geoip - label: "App GeoIP Storage" - description: "Stores the Application GeoIP." + label: App GeoIP Storage + description: Stores the Application GeoIP. schema: additional_attrs: true type: dict @@ -584,7 +748,37 @@ questions: # Include{persistenceList} # Include{ingressRoot} - variable: main - label: "Main Ingress" + label: Main (HTTPS) Ingress + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} +# Include{ingressTLS} +# Include{ingressTraefik} +# Include{ingressExpert} + - variable: http + label: HTTP Ingress + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} +# Include{ingressTLS} +# Include{ingressTraefik} +# Include{ingressExpert} + - variable: proxyhttps + label: Proxy HTTPS Ingress + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} +# Include{ingressTLS} +# Include{ingressTraefik} +# Include{ingressExpert} + - variable: proxyhttp + label: Proxy HTTP Ingress schema: additional_attrs: true type: dict @@ -597,42 +791,42 @@ questions: # Include{security} # Include{securityContextAdvancedRoot} - variable: privileged - label: "Privileged mode" + label: Privileged mode schema: type: boolean default: false - variable: readOnlyRootFilesystem - label: "ReadOnly Root Filesystem" + label: ReadOnly Root Filesystem schema: type: boolean default: true - variable: allowPrivilegeEscalation - label: "Allow Privilege Escalation" + label: Allow Privilege Escalation schema: type: boolean default: false - variable: runAsNonRoot - label: "runAsNonRoot" + label: runAsNonRoot schema: type: boolean default: true # Include{securityContextAdvanced} # Include{podSecurityContextRoot} - variable: runAsUser - label: "runAsUser" - description: "The UserID of the user running the application" + label: runAsUser + description: The UserID of the user running the application schema: type: int default: 1000 - variable: runAsGroup - label: "runAsGroup" - description: "The groupID this App of the user running the application" + label: runAsGroup + description: The groupID this App of the user running the application schema: type: int default: 1000 - variable: fsGroup - label: "fsGroup" - description: "The group that should own ALL storage." + label: fsGroup + description: The group that should own ALL storage. schema: type: int default: 568 diff --git a/charts/incubator/authentik/templates/_config.tpl b/charts/incubator/authentik/templates/_config.tpl index b8868f9168f..8a9aefb8137 100644 --- a/charts/incubator/authentik/templates/_config.tpl +++ b/charts/incubator/authentik/templates/_config.tpl @@ -1,16 +1,26 @@ {{/* Define the configmap */}} {{- define "authentik.config" -}} -{{- $authentikConfigName := printf "%s-authentik-config" (include "tc.common.names.fullname" .) }} +{{- $authServerWorkerConfigName := printf "%s-authentik-config" (include "tc.common.names.fullname" .) }} +{{- $authServerConfigName := printf "%s-authentik-server-config" (include "tc.common.names.fullname" .) }} {{- $geoipConfigName := printf "%s-geoip-config" (include "tc.common.names.fullname" .) }} {{- $ldapConfigName := printf "%s-ldap-config" (include "tc.common.names.fullname" .) }} +{{- $proxyConfigName := printf "%s-proxy-config" (include "tc.common.names.fullname" .) }} +{{ $host := printf "http://localhost:%v" .Values.service.http.ports.http.targetPort }} +{{- if .Values.ingress.main.enabled }} + {{ $first := (first .Values.ingress.main.hosts) }} + {{- if $first }} + {{ $host = printf "https://%s" $first.host }} + {{- end }} +{{- end }} --- + {{/* This configmap are loaded on both main authentik container and worker */}} apiVersion: v1 kind: ConfigMap metadata: - name: {{ $authentikConfigName }} + name: {{ $authServerWorkerConfigName }} labels: {{- include "tc.common.labels" . | nindent 4 }} data: @@ -59,9 +69,26 @@ data: {{- with .Values.authentik.ldap.tls_ciphers }} AUTHENTIK_LDAP__TLS__CIPHERS: {{ . | quote }} {{- end }} - {{/* Metrics */}} - AUTHENTIK_LISTEN__METRICS: {{ .Values.authentik.metrics.internalPort | quote }} + {{/* Outposts */}} + AUTHENTIK_OUTPOSTS__DISCOVER: {{ "false" | quote }} + --- + +{{/* This configmap are loaded on both main authentik container and worker */}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ $authServerConfigName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + {{/* Listen */}} + AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.main.ports.main.targetPort | default 9443 }} + AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.http.ports.http.targetPort | default 9000 }} + AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.metrics.ports.metrics.targetPort | default 9301 }} + +--- + {{/* This configmap is loaded on ldap container */}} apiVersion: v1 kind: ConfigMap @@ -70,11 +97,32 @@ metadata: labels: {{- include "tc.common.labels" . | nindent 4 }} data: - AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | quote }} - {{- with .Values.outposts.ldap.host }} - AUTHENTIK_HOST: {{ . }} - {{- end }} + AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | default "true" | quote }} + AUTHENTIK_HOST: {{ .Values.outposts.ldap.host | default (printf "http://localhost:%v" .Values.service.http.ports.http.targetPort) }} + AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.ldap.host_browser | default $host }} + AUTHENTIK_LISTEN__LDAPS: 0.0.0.0:{{ .Values.service.ldapldaps.ports.ldapldaps.targetPort | default 6636 }} + AUTHENTIK_LISTEN__LDAP: 0.0.0.0:{{ .Values.service.ldapldap.ports.ldapldap.targetPort | default 3389 }} + AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort | default 9302 }} + --- + +{{/* This configmap is loaded on ldap container */}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ $proxyConfigName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + AUTHENTIK_INSECURE: {{ .Values.outposts.proxy.insecure | default "true" | quote }} + AUTHENTIK_HOST: {{ .Values.outposts.proxy.host | default (printf "http://localhost:%v" .Values.service.http.ports.http.targetPort) }} + AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.proxy.host_browser | default $host }} + AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.proxyhttps.ports.proxyhttps.targetPort | default 9444 }} + AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.proxyhttp.ports.proxyhttp.targetPort | default 9001 }} + AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.proxymetrics.ports.proxymetrics.targetPort | default 9303 }} + +--- + {{/* This configmap is loaded on geoip container */}} apiVersion: v1 kind: ConfigMap @@ -90,6 +138,6 @@ data: {{- with .Values.geoip.host_server }} GEOIPUPDATE_HOST: {{ . }} {{- end }} - GEOIPUPDATE_PRESERVE_FILE_TIMES: '{{ ternary "1" "0" .Values.geoip.preserve_file_times }}' - GEOIPUPDATE_VERBOSE: '{{ ternary "1" "0" .Values.geoip.verbose }}' -{{- end }} + GEOIPUPDATE_PRESERVE_FILE_TIMES: {{ ternary "1" "0" .Values.geoip.preserve_file_times | quote }} + GEOIPUPDATE_VERBOSE: {{ ternary "1" "0" .Values.geoip.verbose | quote }} +{{- end -}} diff --git a/charts/incubator/authentik/templates/_geoip.tpl b/charts/incubator/authentik/templates/_geoip.tpl index 64a4ee9bc8a..054ec154774 100644 --- a/charts/incubator/authentik/templates/_geoip.tpl +++ b/charts/incubator/authentik/templates/_geoip.tpl @@ -1,7 +1,7 @@ {{/* Define the geoip container */}} {{- define "authentik.geoip" -}} image: {{ .Values.geoipImage.repository }}:{{ .Values.geoipImage.tag }} -imagePullPolicy: '{{ .Values.geoipImage.pullPolicy }}' +imagePullPolicy: {{ .Values.geoipImage.pullPolicy }} securityContext: runAsUser: 0 runAsGroup: 0 diff --git a/charts/incubator/authentik/templates/_ldap.tpl b/charts/incubator/authentik/templates/_ldap.tpl index 3e87f36f96d..57f48995377 100644 --- a/charts/incubator/authentik/templates/_ldap.tpl +++ b/charts/incubator/authentik/templates/_ldap.tpl @@ -1,7 +1,7 @@ {{/* Define the ldap container */}} {{- define "authentik.ldap" -}} image: {{ .Values.ldapImage.repository }}:{{ .Values.ldapImage.tag }} -imagePullPolicy: '{{ .Values.ldapImage.pullPolicy }}' +imagePullPolicy: {{ .Values.ldapImage.pullPolicy }} securityContext: runAsUser: {{ .Values.podSecurityContext.runAsUser }} runAsGroup: {{ .Values.podSecurityContext.runAsGroup }} @@ -13,40 +13,36 @@ envFrom: - configMapRef: name: '{{ include "tc.common.names.fullname" . }}-ldap-config' ports: - - containerPort: 3389 - - containerPort: 6636 -{{ if .Values.outposts.ldap.metrics }} - - containerPort: 9300 - name: ldap-metrics -{{ end }} + - containerPort: {{ .Values.service.ldapldaps.ports.ldapldaps.targetPort }} + name: ldapldaps + - containerPort: {{ .Values.service.ldapldap.ports.ldapldap.targetPort }} + name: ldapldap +{{- if .Values.outposts.ldap.metrics }} + - containerPort: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }} + name: ldapmetrics +{{- end }} readinessProbe: - exec: - command: - - "wget" - - "--spider" - - "http://localhost:9300/outpost.goauthentik.io/ping" + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }} initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }} failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }} livenessProbe: - exec: - command: - - "wget" - - "--spider" - - "http://localhost:9300/outpost.goauthentik.io/ping" + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }} initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }} failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }} startupProbe: - exec: - command: - - "wget" - - "--spider" - - "http://localhost:9300/outpost.goauthentik.io/ping" + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }} initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }} failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }} {{- end -}} diff --git a/charts/incubator/authentik/templates/_proxy.tpl b/charts/incubator/authentik/templates/_proxy.tpl new file mode 100644 index 00000000000..c056b344cd6 --- /dev/null +++ b/charts/incubator/authentik/templates/_proxy.tpl @@ -0,0 +1,48 @@ +{{/* Define the proxy container */}} +{{- define "authentik.proxy" -}} +image: {{ .Values.proxyImage.repository }}:{{ .Values.proxyImage.tag }} +imagePullPolicy: {{ .Values.proxyImage.pullPolicy }} +securityContext: + runAsUser: {{ .Values.podSecurityContext.runAsUser }} + runAsGroup: {{ .Values.podSecurityContext.runAsGroup }} + readOnlyRootFilesystem: true + runAsNonRoot: true +envFrom: + - secretRef: + name: '{{ include "tc.common.names.fullname" . }}-proxy-secret' + - configMapRef: + name: '{{ include "tc.common.names.fullname" . }}-proxy-config' +ports: + - containerPort: {{ .Values.service.proxyhttps.ports.proxyhttps.targetPort }} + name: proxyhttps + - containerPort: {{ .Values.service.proxyhttp.ports.proxyhttp.targetPort }} + name: proxyhttp +{{- if .Values.outposts.proxy.metrics }} + - containerPort: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }} + name: proxymetrics +{{- end }} +readinessProbe: + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }} + initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }} + timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }} + failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }} +livenessProbe: + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }} + initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }} + timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }} + failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }} +startupProbe: + httpGet: + path: /outpost.goauthentik.io/ping + port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }} + initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }} + timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }} + failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }} +{{- end -}} diff --git a/charts/incubator/authentik/templates/_secret.tpl b/charts/incubator/authentik/templates/_secret.tpl index 4547e3dd7f9..000911b166e 100644 --- a/charts/incubator/authentik/templates/_secret.tpl +++ b/charts/incubator/authentik/templates/_secret.tpl @@ -4,8 +4,11 @@ {{- $authentikSecretName := printf "%s-authentik-secret" (include "tc.common.names.fullname" .) }} {{- $geoipSecretName := printf "%s-geoip-secret" (include "tc.common.names.fullname" .) }} {{- $ldapSecretName := printf "%s-ldap-secret" (include "tc.common.names.fullname" .) }} +{{- $proxySecretName := printf "%s-proxy-secret" (include "tc.common.names.fullname" .) }} +{{- $token := randAlphaNum 32 | b64enc }} --- + {{/* This secrets are loaded on both main authentik container and worker */}} apiVersion: v1 kind: Secret @@ -18,9 +21,11 @@ data: {{/* Secret Key */}} {{- with (lookup "v1" "Secret" .Release.Namespace $authentikSecretName) }} AUTHENTIK_SECRET_KEY: {{ index .data "AUTHENTIK_SECRET_KEY" }} + {{ $token = index .data "AUTHENTIK_BOOTSTRAP_TOKEN" }} {{- else }} AUTHENTIK_SECRET_KEY: {{ randAlphaNum 32 | b64enc }} {{- end }} + AUTHENTIK_BOOTSTRAP_TOKEN: {{ $token }} {{/* Dependencies */}} AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.postgresql.postgresqlPassword | trimAll "\"" | b64enc }} AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.redisPassword | trimAll "\"" | b64enc }} @@ -28,9 +33,6 @@ data: {{- with .Values.authentik.credentials.password }} AUTHENTIK_BOOTSTRAP_PASSWORD: {{ . | b64enc }} {{- end }} - {{- with .Values.authentik.credentials.token }} - AUTHENTIK_BOOTSTRAP_TOKEN: {{ . | b64enc }} - {{- end }} {{/* Mail */}} {{- with .Values.authentik.mail.host }} AUTHENTIK_EMAIL__HOST: {{ . | b64enc }} @@ -44,20 +46,9 @@ data: {{- with .Values.authentik.mail.from }} AUTHENTIK_EMAIL__FROM: {{ . | b64enc }} {{- end }} + --- -{{/* This secrets are loaded on ldap container */}} -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $ldapSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - {{- with .Values.outposts.ldap.token }} - AUTHENTIK_TOKEN: {{ . | b64enc }} - {{- end }} ---- + {{/* This secrets are loaded on geoip container */}} apiVersion: v1 kind: Secret @@ -81,4 +72,38 @@ data: {{- with .Values.geoip.proxy_user_pass }} GEOIPUPDATE_PROXY_USER_PASSWORD: {{ . | b64enc }} {{- end }} + +--- + +{{/* This secrets are loaded on ldap container */}} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ $ldapSecretName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + {{- with .Values.outposts.ldap.token }} + AUTHENTIK_TOKEN: {{ . | b64enc }} + {{- else }} + AUTHENTIK_TOKEN: {{ $token }} + {{- end }} + +--- + +{{/* This secrets are loaded on ldap container */}} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ $proxySecretName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + {{- with .Values.outposts.proxy.token }} + AUTHENTIK_TOKEN: {{ . | b64enc }} + {{- else }} + AUTHENTIK_TOKEN: {{ $token }} + {{- end }} {{- end }} diff --git a/charts/incubator/authentik/templates/_worker.tpl b/charts/incubator/authentik/templates/_worker.tpl index 2a00d08c0bf..64c3b583b04 100644 --- a/charts/incubator/authentik/templates/_worker.tpl +++ b/charts/incubator/authentik/templates/_worker.tpl @@ -1,12 +1,12 @@ {{/* Define the worker container */}} {{- define "authentik.worker" -}} image: {{ .Values.image.repository }}:{{ .Values.image.tag }} -imagePullPolicy: '{{ .Values.image.pullPolicy }}' +imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: runAsUser: {{ .Values.podSecurityContext.runAsUser }} runAsGroup: {{ .Values.podSecurityContext.runAsGroup }} - readOnlyRootFilesystem: false - runAsNonRoot: true + readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }} + runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }} args: ["worker"] envFrom: - secretRef: @@ -28,8 +28,8 @@ readinessProbe: - /lifecycle/ak - healthcheck initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }} failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }} livenessProbe: exec: @@ -37,8 +37,8 @@ livenessProbe: - /lifecycle/ak - healthcheck initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }} failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }} startupProbe: exec: @@ -46,7 +46,7 @@ startupProbe: - /lifecycle/ak - healthcheck initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }} timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }} + periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }} failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }} {{- end -}} diff --git a/charts/incubator/authentik/templates/common.yaml b/charts/incubator/authentik/templates/common.yaml index 8acd79b2756..2ee1207483c 100644 --- a/charts/incubator/authentik/templates/common.yaml +++ b/charts/incubator/authentik/templates/common.yaml @@ -10,7 +10,7 @@ {{- if .Values.authentik.metrics.enabled -}} {{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}} {{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}} -{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" ( .Values.service.metrics.ports.metrics.targetPort | quote) -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" (.Values.service.metrics.ports.metrics.targetPort | default 9301 | quote) -}} {{- end -}} {{- if .Values.workerContainer.enabled -}} @@ -22,8 +22,18 @@ {{- end -}} {{- if .Values.outposts.ldap.enabled -}} -{{- $_ := set .Values.additionalContainers "ldap" (include "authentik.ldap" . | fromYaml) -}} +{{- $_ := set .Values.additionalContainers "ldap-outpost" (include "authentik.ldap" . | fromYaml) -}} {{/* - if .Values.outposts.ldap.metrics - */}} +{{/* https://github.com/prometheus/prometheus/issues/3756 */}} +{{/* TODO: Figure how the pipe works to connect it to prometheus operator */}} +{{/* We can't define multiple ports/endpoints with annotations */}} +{{/* - end - */}} +{{- end -}} + +{{- if .Values.outposts.proxy.enabled -}} +{{- $_ := set .Values.additionalContainers "proxy-outpost" (include "authentik.proxy" . | fromYaml) -}} +{{/* - if .Values.outposts.proxy.metrics - */}} +{{/* https://github.com/prometheus/prometheus/issues/3756 */}} {{/* TODO: Figure how the pipe works to connect it to prometheus operator */}} {{/* We can't define multiple ports/endpoints with annotations */}} {{/* - end - */}} diff --git a/charts/incubator/authentik/values.yaml b/charts/incubator/authentik/values.yaml index ecb14b96a66..e74d9301358 100644 --- a/charts/incubator/authentik/values.yaml +++ b/charts/incubator/authentik/values.yaml @@ -13,19 +13,26 @@ ldapImage: tag: 2022.8.2@sha256:53c681184a447add074fda306acd58e69e48a6189dc5046de27769f1dceac835 pullPolicy: IfNotPresent -extraArgs: ["server"] +proxyImage: + repository: tccr.io/truecharts/authentik-proxy + tag: 2022.8.2@sha256:ecc83a3c15e3c093e6c8002f534b16769e2e1e953cd508071c7920a4d8bd7c3d + pullPolicy: IfNotPresent + +args: ["server"] podSecurityContext: runAsUser: 1000 runAsGroup: 1000 +securityContext: + readOnlyRootFilesystem: false + workerContainer: enabled: true authentik: credentials: password: "supersecret" - token: "supersecretapitoken" general: disable_update_check: false disable_startup_analytics: true @@ -57,9 +64,6 @@ authentik: tls_ciphers: "null" metrics: enabled: true - # LDAP Outpost listens on 9300. To avoid conflicts - # This sets internal Authentik metrics port to 9301 - internalPort: 9301 geoip: enabled: false @@ -75,43 +79,51 @@ geoip: outposts: ldap: + # -- First you have to create an Outpost in the GUI. Applications > Outposts enabled: false - insecure: false - host: "" - token: "test" - metrics: true + # -- Host Browser by default is set to the first ingress host you set + # host_browser: "" + # -- Host should not need to be overridden. Defaults to http://localhost:9000 + # host: "" + # -- As we use http://localhost:9000 it's an unsecure connection + # insecure: false + # -- Token is only needed if you accidentally deleted the token within the UI + # token: "" + metrics: false + proxy: + # -- First you have to create an Outpost in the GUI. Applications > Outposts + enabled: false + # -- Host Browser by default is set to the first ingress host you set + # host_browser: "" + # -- As we use http://localhost:9000 it's an unsecure connection + # insecure: false + # -- Host should not need to be overridden. Defaults to http://localhost:9000 + # host: "" + # -- Token is only needed if you accidentally deleted the token within the UI + # token: "" + metrics: false envFrom: - secretRef: name: '{{ include "tc.common.names.fullname" . }}-authentik-secret' - configMapRef: name: '{{ include "tc.common.names.fullname" . }}-authentik-config' + - configMapRef: + name: '{{ include "tc.common.names.fullname" . }}-authentik-server-config' probes: liveness: - enabled: true - custom: true - spec: - exec: - command: - - /lifecycle/ak - - healthcheck + type: HTTP + path: /-/health/live/ + port: "{{ .Values.service.http.ports.http.targetPort }}" readiness: - enabled: true - custom: true - spec: - exec: - command: - - /lifecycle/ak - - healthcheck + type: HTTP + path: /-/health/ready/ + port: "{{ .Values.service.http.ports.http.targetPort }}" startup: - enabled: true - custom: true - spec: - exec: - command: - - /lifecycle/ak - - healthcheck + type: HTTP + path: /-/health/ready/ + port: "{{ .Values.service.http.ports.http.targetPort }}" service: main: @@ -136,22 +148,66 @@ service: protocol: HTTP port: 10231 targetPort: 9301 - ldap: + ldapldaps: enabled: true + type: ClusterIP ports: - ldap1: - enabled: true - port: 389 - targetPort: 3389 - ldap2: + ldapldaps: enabled: true port: 636 targetPort: 6636 - ldap-metrics: + ldapldap: + enabled: true + type: ClusterIP + ports: + ldapldap: + enabled: true + port: 389 + targetPort: 3389 + ldapmetrics: + enabled: true + type: ClusterIP + ports: + ldapmetrics: enabled: true port: 10232 protocol: HTTP - targetPort: 9300 + targetPort: 9302 + proxyhttps: + enabled: true + type: ClusterIP + ports: + proxyhttps: + enabled: true + port: 10233 + protocol: HTTPS + targetPort: 9444 + proxyhttp: + enabled: true + type: ClusterIP + ports: + proxyhttp: + enabled: true + port: 10234 + protocl: HTTP + targetPort: 9001 + proxymetrics: + enabled: true + type: ClusterIP + ports: + proxymetrics: + enabled: true + port: 10235 + protocol: HTTP + targetPort: 9303 + +ingress: + http: + autoLink: true + proxyhttps: + autoLink: true + proxyhttp: + autoLink: true persistence: media: diff --git a/cspell.config.yaml b/cspell.config.yaml index 6805ae4c151..b9ae14b4863 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -2,6 +2,7 @@ version: "0.2" words: - ADLIST - airsonic + - akadmin - aliasgroup - allowtransparency - APITOKEN @@ -43,8 +44,11 @@ words: - Fireshare - FLUSHTABLES - fullname + - geoip + - geoipupdate - gibibyte - gluster + - goauthentik - GUNICORN - healthcheck - healthchecks @@ -75,6 +79,10 @@ words: - kubectl - kubernetes - lancache + - ldapldap + - ldapldaps + - ldapmetrics + - ldaps - lebbing - letsencrypt - lidarr @@ -86,6 +94,7 @@ words: - mailenabled - Mailgun - mariadbcreds + - maxmind - mattwebbio - mediafiles - meshroom @@ -124,6 +133,9 @@ words: - prefs - Preload - proto + - proxyhttp + - proxyhttps + - proxymetrics - puid - putregexhere - pvcname