Stavros KoisandGitHub
b4af071a92
* feat(authentik): move to k8s integration instead of manual * bumpo * update questiosn
225 lines
4.3 KiB
YAML
225 lines
4.3 KiB
YAML
image:
|
|
repository: tccr.io/truecharts/authentik
|
|
tag: 2022.8.2@sha256:ff1f86ee6a26866e2806321fa98f45d4bce01d89e622f505085edc8831518f89
|
|
pullPolicy: IfNotPresent
|
|
|
|
geoipImage:
|
|
repository: tccr.io/truecharts/geoipupdate
|
|
tag: v4.9@sha256:ce42b4252c8cd4a9e39275fd7c3312e5df7bda0d7034df565af4362d7e0d26ce
|
|
pullPolicy: IfNotPresent
|
|
|
|
extraArgs: ["server"]
|
|
|
|
podSecurityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
|
|
workerContainer:
|
|
enabled: true
|
|
|
|
authentik:
|
|
credentials:
|
|
password: "supersecret"
|
|
token: "supersecretapitoken"
|
|
outposts:
|
|
container_image_base: tccr.io/truecharts/authentik-%(type)s:%(version)s
|
|
discover: true
|
|
general:
|
|
disable_update_check: false
|
|
disable_startup_analytics: true
|
|
allow_user_name_change: true
|
|
allow_user_mail_change: true
|
|
allow_user_username_change: true
|
|
gdpr_compliance: true
|
|
impersonation: true
|
|
avatars: "gravatar"
|
|
token_length: 128
|
|
# Use single quotes for footer_links
|
|
footer_links: '[{"name": "Link Name", "href": "https://mylink.com"}]'
|
|
mail:
|
|
host: ""
|
|
port: 25
|
|
tls: false
|
|
ssl: false
|
|
timeout: 10
|
|
user: ""
|
|
pass: ""
|
|
from: ""
|
|
error_reporting:
|
|
enabled: false
|
|
send_pii: false
|
|
environment: "customer"
|
|
logging:
|
|
log_level: "info"
|
|
ldap:
|
|
tls_ciphers: "null"
|
|
metrics:
|
|
enabled: true
|
|
# LDAP Outpost listens on 9300. To avoid conflicts
|
|
# This sets internal Authentik metrics port to 9301
|
|
internalPort: 9301
|
|
|
|
geoip:
|
|
enabled: false
|
|
account_id: ""
|
|
license_key: ""
|
|
proxy: ""
|
|
proxy_user_pass: ""
|
|
edition_ids: "GeoLite2-City"
|
|
frequency: 8
|
|
host_server: "updates.maxmind.com"
|
|
preserve_file_times: false
|
|
verbose: false
|
|
|
|
serviceAccount:
|
|
main:
|
|
enabled: true
|
|
|
|
rbac:
|
|
main:
|
|
enabled: true
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
- services
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- extensions
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- extensions
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- traefik.containo.us
|
|
resources:
|
|
- middlewares
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- monitoring.coreos.com
|
|
resources:
|
|
- servicemonitors
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- list
|
|
|
|
envFrom:
|
|
- secretRef:
|
|
name: '{{ include "tc.common.names.fullname" . }}-authentik-secret'
|
|
- configMapRef:
|
|
name: '{{ include "tc.common.names.fullname" . }}-authentik-config'
|
|
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
custom: true
|
|
spec:
|
|
exec:
|
|
command:
|
|
- /lifecycle/ak
|
|
- healthcheck
|
|
readiness:
|
|
enabled: true
|
|
custom: true
|
|
spec:
|
|
exec:
|
|
command:
|
|
- /lifecycle/ak
|
|
- healthcheck
|
|
startup:
|
|
enabled: true
|
|
custom: true
|
|
spec:
|
|
exec:
|
|
command:
|
|
- /lifecycle/ak
|
|
- healthcheck
|
|
|
|
service:
|
|
main:
|
|
ports:
|
|
main:
|
|
protocol: HTTPS
|
|
port: 10229
|
|
targetPort: 9443
|
|
http:
|
|
enabled: true
|
|
ports:
|
|
http:
|
|
enabled: true
|
|
protocol: HTTP
|
|
port: 10230
|
|
targetPort: 9000
|
|
metrics:
|
|
enabled: true
|
|
ports:
|
|
metrics:
|
|
enabled: true
|
|
protocol: HTTP
|
|
port: 10231
|
|
targetPort: 9301
|
|
|
|
persistence:
|
|
media:
|
|
enabled: true
|
|
mountPath: "/media"
|
|
templates:
|
|
enabled: true
|
|
mountPath: "/templates"
|
|
certs:
|
|
enabled: true
|
|
mountPath: "/certs"
|
|
geoip:
|
|
enabled: true
|
|
mountPath: "/geoip"
|
|
|
|
postgresql:
|
|
enabled: true
|
|
existingSecret: "dbcreds"
|
|
postgresqlUsername: authentik
|
|
postgresqlDatabase: authentik
|
|
|
|
redis:
|
|
enabled: true
|
|
existingSecret: "rediscreds"
|
|
|
|
portal:
|
|
enabled: true
|