feat(authentik): make manual outpost much easier for both helm and scale gui (#3679)

* feat(authentik): some rework

* disable built in outposts as we aim to spin our own

* piping the proxy outpost

* use bootstrap token for outposts

* remove comments

* add some docs about the token

* set defaults for outposts with ability to override

* add some docs

* empty space

* add spaces for readability

* different ports for metrics

* add comments for metrics

* remove service from gui

* rename prots

* rearrange

* update ports to solve conflicts

* reenable outpost

* turn off outposts

* rearrange

* try previous image

* nop

* major bump

* add ingresses

* set default $host

* quote true

* test with outposts enabled

* update docs

* try only ldap outpost

* update docs

* expose services of outpost to gui and values

* update gui

* update docs

* disable outpost

* update default port type

* use the targetPort to set ports for metrics

* flexible ports everywhere

* change probe port

* update probe

* some quote fixes

* update probes

* update ports

* no message

* give worker more startup time

* more

* probes...

* dont quote ports

* lint

* rofs

* whoops

* quote

* see env

* extract listen ports from main config

* don't load listen_ports envs

* use default port

* try quoting  differently

* hardcode

* try more hardcoded change

* disable probes

* enable 1 probe

* another probe

* remove trailing slash?!

* again

* again

* test template

* give more time to probes

* more!?

* hmm

* see env vars

* I"M STUPID

* run

* last fixies

* see env

* disabel startup probe

* hmm

* enable readiness probe

* wth

* load env ..

* Aaaahh

* fix quotting

* start without worker

* delay worker startup

* enable worker

* try something better

* bash

* try again

* whoops

* dont chain

* oneliner

* one more try

* back to normal startup

* and default startup probe

charts/incubator/authentik/Chart.yaml

@@ -27,7 +27,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/authentik
   - https://github.com/goauthentik/authentik
   - https://goauthentik.io/docs/
-version: 5.0.0
+version: 6.0.0
 annotations:
   truecharts.org/catagories: |
     - authentication

charts/incubator/authentik/docs/installation_notes.md

@@ -0,0 +1,25 @@
+# Installation notes
+
+## Credentials
+
+Default username: `akadmin`
+
+## Outposts
+
+Enable each outpost by simple setting `enabled` to `true`.
+Scale users, just have to check the checkbox
+
+> You have to create an outpost in the GUI first.
+> Applications > Outposts
+
+### Host
+
+`host` should not need to be overridden. Defaults to `http://localhost:9000`
+
+### Host Browser
+
+`host_browser` by default is set to the first ingress host you set
+
+### Token
+
+`token` is only needed if you accidentally deleted it within the UI

charts/incubator/authentik/templates/_config.tpl

@@ -1,16 +1,26 @@
 {{/* Define the configmap */}}
 {{- define "authentik.config" -}}
 
-{{- $authentikConfigName := printf "%s-authentik-config" (include "tc.common.names.fullname" .) }}
+{{- $authServerWorkerConfigName := printf "%s-authentik-config" (include "tc.common.names.fullname" .) }}
+{{- $authServerConfigName := printf "%s-authentik-server-config" (include "tc.common.names.fullname" .) }}
 {{- $geoipConfigName := printf "%s-geoip-config" (include "tc.common.names.fullname" .) }}
 {{- $ldapConfigName := printf "%s-ldap-config" (include "tc.common.names.fullname" .) }}
+{{- $proxyConfigName := printf "%s-proxy-config" (include "tc.common.names.fullname" .) }}
+{{ $host := printf "http://localhost:%v" .Values.service.http.ports.http.targetPort }}
+{{- if .Values.ingress.main.enabled }}
+  {{ $first := (first .Values.ingress.main.hosts) }}
+  {{- if $first }}
+    {{ $host = printf "https://%s" $first.host }}
+  {{- end }}
+{{- end }}
 
 ---
+
 {{/* This configmap are loaded on both main authentik container and worker */}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ $authentikConfigName }}
+  name: {{ $authServerWorkerConfigName }}
   labels:
     {{- include "tc.common.labels" . | nindent 4 }}
 data:
@@ -59,9 +69,26 @@ data:
   {{- with .Values.authentik.ldap.tls_ciphers }}
   AUTHENTIK_LDAP__TLS__CIPHERS: {{ . | quote }}
   {{- end }}
-  {{/* Metrics */}}
+  {{/* Outposts */}}
-  AUTHENTIK_LISTEN__METRICS: {{ .Values.authentik.metrics.internalPort | quote }}
+  AUTHENTIK_OUTPOSTS__DISCOVER: {{ "false" | quote }}
+
 ---
+
+{{/* This configmap are loaded on both main authentik container and worker */}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $authServerConfigName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{/* Listen */}}
+  AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.main.ports.main.targetPort | default 9443 }}
+  AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.http.ports.http.targetPort | default 9000 }}
+  AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.metrics.ports.metrics.targetPort | default 9301 }}
+
+---
+
 {{/* This configmap is loaded on ldap container */}}
 apiVersion: v1
 kind: ConfigMap
@@ -70,11 +97,32 @@ metadata:
   labels:
     {{- include "tc.common.labels" . | nindent 4 }}
 data:
-  AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | quote }}
+  AUTHENTIK_INSECURE: {{ .Values.outposts.ldap.insecure | default "true" | quote }}
-  {{- with .Values.outposts.ldap.host }}
+  AUTHENTIK_HOST: {{ .Values.outposts.ldap.host | default (printf "http://localhost:%v" .Values.service.http.ports.http.targetPort) }}
-  AUTHENTIK_HOST: {{ . }}
+  AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.ldap.host_browser | default $host }}
-  {{- end }}
+  AUTHENTIK_LISTEN__LDAPS: 0.0.0.0:{{ .Values.service.ldapldaps.ports.ldapldaps.targetPort | default 6636 }}
+  AUTHENTIK_LISTEN__LDAP: 0.0.0.0:{{ .Values.service.ldapldap.ports.ldapldap.targetPort | default 3389 }}
+  AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort | default 9302 }}
+
 ---
+
+{{/* This configmap is loaded on ldap container */}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $proxyConfigName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  AUTHENTIK_INSECURE: {{ .Values.outposts.proxy.insecure | default "true" | quote }}
+  AUTHENTIK_HOST: {{ .Values.outposts.proxy.host | default (printf "http://localhost:%v" .Values.service.http.ports.http.targetPort) }}
+  AUTHENTIK_HOST_BROWSER: {{ .Values.outposts.proxy.host_browser | default $host }}
+  AUTHENTIK_LISTEN__HTTPS: 0.0.0.0:{{ .Values.service.proxyhttps.ports.proxyhttps.targetPort | default 9444 }}
+  AUTHENTIK_LISTEN__HTTP: 0.0.0.0:{{ .Values.service.proxyhttp.ports.proxyhttp.targetPort | default 9001 }}
+  AUTHENTIK_LISTEN__METRICS: 0.0.0.0:{{ .Values.service.proxymetrics.ports.proxymetrics.targetPort | default 9303 }}
+
+---
+
 {{/* This configmap is loaded on geoip container */}}
 apiVersion: v1
 kind: ConfigMap
@@ -90,6 +138,6 @@ data:
   {{- with .Values.geoip.host_server }}
   GEOIPUPDATE_HOST: {{ . }}
   {{- end }}
-  GEOIPUPDATE_PRESERVE_FILE_TIMES: '{{ ternary "1" "0" .Values.geoip.preserve_file_times }}'
+  GEOIPUPDATE_PRESERVE_FILE_TIMES: {{ ternary "1" "0" .Values.geoip.preserve_file_times | quote }}
-  GEOIPUPDATE_VERBOSE: '{{ ternary "1" "0" .Values.geoip.verbose }}'
+  GEOIPUPDATE_VERBOSE: {{ ternary "1" "0" .Values.geoip.verbose | quote }}
-{{- end }}
+{{- end -}}

charts/incubator/authentik/templates/_geoip.tpl

@@ -1,7 +1,7 @@
 {{/* Define the geoip container */}}
 {{- define "authentik.geoip" -}}
 image: {{ .Values.geoipImage.repository }}:{{ .Values.geoipImage.tag }}
-imagePullPolicy: '{{ .Values.geoipImage.pullPolicy }}'
+imagePullPolicy: {{ .Values.geoipImage.pullPolicy }}
 securityContext:
   runAsUser: 0
   runAsGroup: 0

charts/incubator/authentik/templates/_ldap.tpl

@@ -1,7 +1,7 @@
 {{/* Define the ldap container */}}
 {{- define "authentik.ldap" -}}
 image: {{ .Values.ldapImage.repository }}:{{ .Values.ldapImage.tag }}
-imagePullPolicy: '{{ .Values.ldapImage.pullPolicy }}'
+imagePullPolicy: {{ .Values.ldapImage.pullPolicy }}
 securityContext:
   runAsUser: {{ .Values.podSecurityContext.runAsUser }}
   runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
@@ -13,40 +13,36 @@ envFrom:
   - configMapRef:
       name: '{{ include "tc.common.names.fullname" . }}-ldap-config'
 ports:
-  - containerPort: 3389
+  - containerPort: {{ .Values.service.ldapldaps.ports.ldapldaps.targetPort }}
-  - containerPort: 6636
+    name: ldapldaps
-{{ if .Values.outposts.ldap.metrics }}
+  - containerPort: {{ .Values.service.ldapldap.ports.ldapldap.targetPort }}
-  - containerPort: 9300
+    name: ldapldap
-    name: ldap-metrics
+{{- if .Values.outposts.ldap.metrics }}
-{{ end }}
+  - containerPort: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
+    name: ldapmetrics
+{{- end }}
 readinessProbe:
-  exec:
+  httpGet:
-    command:
+    path: /outpost.goauthentik.io/ping
-      - "wget"
+    port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
-      - "--spider"
-      - "http://localhost:9300/outpost.goauthentik.io/ping"
   initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
 livenessProbe:
-  exec:
+  httpGet:
-    command:
+    path: /outpost.goauthentik.io/ping
-      - "wget"
+    port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
-      - "--spider"
-      - "http://localhost:9300/outpost.goauthentik.io/ping"
   initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
 startupProbe:
-  exec:
+  httpGet:
-    command:
+    path: /outpost.goauthentik.io/ping
-      - "wget"
+    port: {{ .Values.service.ldapmetrics.ports.ldapmetrics.targetPort }}
-      - "--spider"
-      - "http://localhost:9300/outpost.goauthentik.io/ping"
   initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
 {{- end -}}

charts/incubator/authentik/templates/_proxy.tpl

@@ -0,0 +1,48 @@
+{{/* Define the proxy container */}}
+{{- define "authentik.proxy" -}}
+image: {{ .Values.proxyImage.repository }}:{{ .Values.proxyImage.tag }}
+imagePullPolicy: {{ .Values.proxyImage.pullPolicy }}
+securityContext:
+  runAsUser: {{ .Values.podSecurityContext.runAsUser }}
+  runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+envFrom:
+  - secretRef:
+      name: '{{ include "tc.common.names.fullname" . }}-proxy-secret'
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-proxy-config'
+ports:
+  - containerPort: {{ .Values.service.proxyhttps.ports.proxyhttps.targetPort }}
+    name: proxyhttps
+  - containerPort: {{ .Values.service.proxyhttp.ports.proxyhttp.targetPort }}
+    name: proxyhttp
+{{- if .Values.outposts.proxy.metrics }}
+  - containerPort: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
+    name: proxymetrics
+{{- end }}
+readinessProbe:
+  httpGet:
+    path: /outpost.goauthentik.io/ping
+    port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
+  initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
+  timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
+  failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
+livenessProbe:
+  httpGet:
+    path: /outpost.goauthentik.io/ping
+    port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
+  initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
+  timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
+  failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
+startupProbe:
+  httpGet:
+    path: /outpost.goauthentik.io/ping
+    port: {{ .Values.service.proxymetrics.ports.proxymetrics.targetPort }}
+  initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
+  timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
+  failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
+{{- end -}}

charts/incubator/authentik/templates/_secret.tpl

@@ -4,8 +4,11 @@
 {{- $authentikSecretName := printf "%s-authentik-secret" (include "tc.common.names.fullname" .) }}
 {{- $geoipSecretName := printf "%s-geoip-secret" (include "tc.common.names.fullname" .) }}
 {{- $ldapSecretName := printf "%s-ldap-secret" (include "tc.common.names.fullname" .) }}
+{{- $proxySecretName := printf "%s-proxy-secret" (include "tc.common.names.fullname" .) }}
+{{- $token := randAlphaNum 32 | b64enc }}
 
 ---
+
 {{/* This secrets are loaded on both main authentik container and worker */}}
 apiVersion: v1
 kind: Secret
@@ -18,9 +21,11 @@ data:
   {{/* Secret Key */}}
   {{- with (lookup "v1" "Secret" .Release.Namespace $authentikSecretName) }}
   AUTHENTIK_SECRET_KEY: {{ index .data "AUTHENTIK_SECRET_KEY" }}
+  {{ $token = index .data "AUTHENTIK_BOOTSTRAP_TOKEN" }}
   {{- else }}
   AUTHENTIK_SECRET_KEY: {{ randAlphaNum 32 | b64enc }}
   {{- end }}
+  AUTHENTIK_BOOTSTRAP_TOKEN: {{ $token }}
   {{/* Dependencies */}}
   AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.postgresql.postgresqlPassword | trimAll "\"" | b64enc }}
   AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.redisPassword | trimAll "\"" | b64enc }}
@@ -28,9 +33,6 @@ data:
   {{- with .Values.authentik.credentials.password }}
   AUTHENTIK_BOOTSTRAP_PASSWORD: {{ . | b64enc }}
   {{- end }}
-  {{- with .Values.authentik.credentials.token }}
-  AUTHENTIK_BOOTSTRAP_TOKEN: {{ . | b64enc }}
-  {{- end }}
   {{/* Mail */}}
   {{- with .Values.authentik.mail.host }}
   AUTHENTIK_EMAIL__HOST: {{ . | b64enc }}
@@ -44,20 +46,9 @@ data:
   {{- with .Values.authentik.mail.from }}
   AUTHENTIK_EMAIL__FROM: {{ . | b64enc }}
   {{- end }}
+
 ---
-{{/* This secrets are loaded on ldap container */}}
+
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-  name: {{ $ldapSecretName }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
-data:
-  {{- with .Values.outposts.ldap.token }}
-  AUTHENTIK_TOKEN: {{ . | b64enc }}
-  {{- end }}
----
 {{/* This secrets are loaded on geoip container */}}
 apiVersion: v1
 kind: Secret
@@ -81,4 +72,38 @@ data:
   {{- with .Values.geoip.proxy_user_pass }}
   GEOIPUPDATE_PROXY_USER_PASSWORD: {{ . | b64enc }}
   {{- end }}
+
+---
+
+{{/* This secrets are loaded on ldap container */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $ldapSecretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.outposts.ldap.token }}
+  AUTHENTIK_TOKEN: {{ . | b64enc }}
+  {{- else }}
+  AUTHENTIK_TOKEN: {{ $token }}
+  {{- end }}
+
+---
+
+{{/* This secrets are loaded on ldap container */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $proxySecretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.outposts.proxy.token }}
+  AUTHENTIK_TOKEN: {{ . | b64enc }}
+  {{- else }}
+  AUTHENTIK_TOKEN: {{ $token }}
+  {{- end }}
 {{- end }}

charts/incubator/authentik/templates/_worker.tpl

@@ -1,12 +1,12 @@
 {{/* Define the worker container */}}
 {{- define "authentik.worker" -}}
 image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
-imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+imagePullPolicy: {{ .Values.image.pullPolicy }}
 securityContext:
   runAsUser: {{ .Values.podSecurityContext.runAsUser }}
   runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
-  readOnlyRootFilesystem: false
+  readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
-  runAsNonRoot: true
+  runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
 args: ["worker"]
 envFrom:
   - secretRef:
@@ -28,8 +28,8 @@ readinessProbe:
       - /lifecycle/ak
       - healthcheck
   initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
 livenessProbe:
   exec:
@@ -37,8 +37,8 @@ livenessProbe:
       - /lifecycle/ak
       - healthcheck
   initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
 startupProbe:
   exec:
@@ -46,7 +46,7 @@ startupProbe:
       - /lifecycle/ak
       - healthcheck
   initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
-  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
   timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
+  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
   failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
 {{- end -}}

charts/incubator/authentik/templates/common.yaml

@@ -10,7 +10,7 @@
 {{- if .Values.authentik.metrics.enabled -}}
 {{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}}
 {{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}}
-{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" ( .Values.service.metrics.ports.metrics.targetPort | quote) -}}
+{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" (.Values.service.metrics.ports.metrics.targetPort | default 9301 | quote) -}}
 {{- end -}}
 
 {{- if .Values.workerContainer.enabled -}}
@@ -22,8 +22,18 @@
 {{- end -}}
 
 {{- if .Values.outposts.ldap.enabled -}}
-{{- $_ := set .Values.additionalContainers "ldap" (include "authentik.ldap" . | fromYaml) -}}
+{{- $_ := set .Values.additionalContainers "ldap-outpost" (include "authentik.ldap" . | fromYaml) -}}
 {{/* - if .Values.outposts.ldap.metrics - */}}
+{{/* https://github.com/prometheus/prometheus/issues/3756 */}}
+{{/* TODO: Figure how the pipe works to connect it to prometheus operator */}}
+{{/* We can't define multiple ports/endpoints with annotations */}}
+{{/* - end - */}}
+{{- end -}}
+
+{{- if .Values.outposts.proxy.enabled -}}
+{{- $_ := set .Values.additionalContainers "proxy-outpost" (include "authentik.proxy" . | fromYaml) -}}
+{{/* - if .Values.outposts.proxy.metrics - */}}
+{{/* https://github.com/prometheus/prometheus/issues/3756 */}}
 {{/* TODO: Figure how the pipe works to connect it to prometheus operator */}}
 {{/* We can't define multiple ports/endpoints with annotations */}}
 {{/* - end - */}}

charts/incubator/authentik/values.yaml

@@ -13,19 +13,26 @@ ldapImage:
   tag: 2022.8.2@sha256:53c681184a447add074fda306acd58e69e48a6189dc5046de27769f1dceac835
   pullPolicy: IfNotPresent
 
-extraArgs: ["server"]
+proxyImage:
+  repository: tccr.io/truecharts/authentik-proxy
+  tag: 2022.8.2@sha256:ecc83a3c15e3c093e6c8002f534b16769e2e1e953cd508071c7920a4d8bd7c3d
+  pullPolicy: IfNotPresent
+
+args: ["server"]
 
 podSecurityContext:
   runAsUser: 1000
   runAsGroup: 1000
 
+securityContext:
+  readOnlyRootFilesystem: false
+
 workerContainer:
   enabled: true
 
 authentik:
   credentials:
     password: "supersecret"
-    token: "supersecretapitoken"
   general:
     disable_update_check: false
     disable_startup_analytics: true
@@ -57,9 +64,6 @@ authentik:
     tls_ciphers: "null"
   metrics:
     enabled: true
-    # LDAP Outpost listens on 9300. To avoid conflicts
-    # This sets internal Authentik metrics port to 9301
-    internalPort: 9301
 
 geoip:
   enabled: false
@@ -75,43 +79,51 @@ geoip:
 
 outposts:
   ldap:
+    # -- First you have to create an Outpost in the GUI. Applications > Outposts
     enabled: false
-    insecure: false
+    # -- Host Browser by default is set to the first ingress host you set
-    host: ""
+    # host_browser: ""
-    token: "test"
+    # -- Host should not need to be overridden. Defaults to http://localhost:9000
-    metrics: true
+    # host: ""
+    # -- As we use http://localhost:9000 it's an unsecure connection
+    # insecure: false
+    # -- Token is only needed if you accidentally deleted the token within the UI
+    # token: ""
+    metrics: false
+  proxy:
+    # -- First you have to create an Outpost in the GUI. Applications > Outposts
+    enabled: false
+    # -- Host Browser by default is set to the first ingress host you set
+    # host_browser: ""
+    # -- As we use http://localhost:9000 it's an unsecure connection
+    # insecure: false
+    # -- Host should not need to be overridden. Defaults to http://localhost:9000
+    # host: ""
+    # -- Token is only needed if you accidentally deleted the token within the UI
+    # token: ""
+    metrics: false
 
 envFrom:
   - secretRef:
       name: '{{ include "tc.common.names.fullname" . }}-authentik-secret'
   - configMapRef:
       name: '{{ include "tc.common.names.fullname" . }}-authentik-config'
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-authentik-server-config'
 
 probes:
   liveness:
-    enabled: true
+    type: HTTP
-    custom: true
+    path: /-/health/live/
-    spec:
+    port: "{{ .Values.service.http.ports.http.targetPort }}"
-      exec:
-        command:
-          - /lifecycle/ak
-          - healthcheck
   readiness:
-    enabled: true
+    type: HTTP
-    custom: true
+    path: /-/health/ready/
-    spec:
+    port: "{{ .Values.service.http.ports.http.targetPort }}"
-      exec:
-        command:
-          - /lifecycle/ak
-          - healthcheck
   startup:
-    enabled: true
+    type: HTTP
-    custom: true
+    path: /-/health/ready/
-    spec:
+    port: "{{ .Values.service.http.ports.http.targetPort }}"
-      exec:
-        command:
-          - /lifecycle/ak
-          - healthcheck
 
 service:
   main:
@@ -136,22 +148,66 @@ service:
         protocol: HTTP
         port: 10231
         targetPort: 9301
-  ldap:
+  ldapldaps:
     enabled: true
+    type: ClusterIP
     ports:
-      ldap1:
+      ldapldaps:
-        enabled: true
-        port: 389
-        targetPort: 3389
-      ldap2:
         enabled: true
         port: 636
         targetPort: 6636
-      ldap-metrics:
+  ldapldap:
+    enabled: true
+    type: ClusterIP
+    ports:
+      ldapldap:
+        enabled: true
+        port: 389
+        targetPort: 3389
+  ldapmetrics:
+    enabled: true
+    type: ClusterIP
+    ports:
+      ldapmetrics:
         enabled: true
         port: 10232
         protocol: HTTP
-        targetPort: 9300
+        targetPort: 9302
+  proxyhttps:
+    enabled: true
+    type: ClusterIP
+    ports:
+      proxyhttps:
+        enabled: true
+        port: 10233
+        protocol: HTTPS
+        targetPort: 9444
+  proxyhttp:
+    enabled: true
+    type: ClusterIP
+    ports:
+      proxyhttp:
+        enabled: true
+        port: 10234
+        protocl: HTTP
+        targetPort: 9001
+  proxymetrics:
+    enabled: true
+    type: ClusterIP
+    ports:
+      proxymetrics:
+        enabled: true
+        port: 10235
+        protocol: HTTP
+        targetPort: 9303
+
+ingress:
+  http:
+    autoLink: true
+  proxyhttps:
+    autoLink: true
+  proxyhttp:
+    autoLink: true
 
 persistence:
   media:

cspell.config.yaml

@@ -2,6 +2,7 @@ version: "0.2"
 words:
   - ADLIST
   - airsonic
+  - akadmin
   - aliasgroup
   - allowtransparency
   - APITOKEN
@@ -43,8 +44,11 @@ words:
   - Fireshare
   - FLUSHTABLES
   - fullname
+  - geoip
+  - geoipupdate
   - gibibyte
   - gluster
+  - goauthentik
   - GUNICORN
   - healthcheck
   - healthchecks
@@ -75,6 +79,10 @@ words:
   - kubectl
   - kubernetes
   - lancache
+  - ldapldap
+  - ldapldaps
+  - ldapmetrics
+  - ldaps
   - lebbing
   - letsencrypt
   - lidarr
@@ -86,6 +94,7 @@ words:
   - mailenabled
   - Mailgun
   - mariadbcreds
+  - maxmind
   - mattwebbio
   - mediafiles
   - meshroom
@@ -124,6 +133,9 @@ words:
   - prefs
   - Preload
   - proto
+  - proxyhttp
+  - proxyhttps
+  - proxymetrics
   - puid
   - putregexhere
   - pvcname