Stavros KoisandGitHub
e4b2e09d4e
* feat(authentik): some rework * disable built in outposts as we aim to spin our own * piping the proxy outpost * use bootstrap token for outposts * remove comments * add some docs about the token * set defaults for outposts with ability to override * add some docs * empty space * add spaces for readability * different ports for metrics * add comments for metrics * remove service from gui * rename prots * rearrange * update ports to solve conflicts * reenable outpost * turn off outposts * rearrange * try previous image * nop * major bump * add ingresses * set default $host * quote true * test with outposts enabled * update docs * try only ldap outpost * update docs * expose services of outpost to gui and values * update gui * update docs * disable outpost * update default port type * use the targetPort to set ports for metrics * flexible ports everywhere * change probe port * update probe * some quote fixes * update probes * update ports * no message * give worker more startup time * more * probes... * dont quote ports * lint * rofs * whoops * quote * see env * extract listen ports from main config * don't load listen_ports envs * use default port * try quoting differently * hardcode * try more hardcoded change * disable probes * enable 1 probe * another probe * remove trailing slash?! * again * again * test template * give more time to probes * more!? * hmm * see env vars * I"M STUPID * run * last fixies * see env * disabel startup probe * hmm * enable readiness probe * wth * load env .. * Aaaahh * fix quotting * start without worker * delay worker startup * enable worker * try something better * bash * try again * whoops * dont chain * oneliner * one more try * back to normal startup * and default startup probe
238 lines
5.3 KiB
YAML
238 lines
5.3 KiB
YAML
image:
|
|
repository: tccr.io/truecharts/authentik
|
|
tag: 2022.8.2@sha256:ff1f86ee6a26866e2806321fa98f45d4bce01d89e622f505085edc8831518f89
|
|
pullPolicy: IfNotPresent
|
|
|
|
geoipImage:
|
|
repository: tccr.io/truecharts/geoipupdate
|
|
tag: v4.9@sha256:ce42b4252c8cd4a9e39275fd7c3312e5df7bda0d7034df565af4362d7e0d26ce
|
|
pullPolicy: IfNotPresent
|
|
|
|
ldapImage:
|
|
repository: tccr.io/truecharts/authentik-ldap
|
|
tag: 2022.8.2@sha256:53c681184a447add074fda306acd58e69e48a6189dc5046de27769f1dceac835
|
|
pullPolicy: IfNotPresent
|
|
|
|
proxyImage:
|
|
repository: tccr.io/truecharts/authentik-proxy
|
|
tag: 2022.8.2@sha256:ecc83a3c15e3c093e6c8002f534b16769e2e1e953cd508071c7920a4d8bd7c3d
|
|
pullPolicy: IfNotPresent
|
|
|
|
args: ["server"]
|
|
|
|
podSecurityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
|
|
securityContext:
|
|
readOnlyRootFilesystem: false
|
|
|
|
workerContainer:
|
|
enabled: true
|
|
|
|
authentik:
|
|
credentials:
|
|
password: "supersecret"
|
|
general:
|
|
disable_update_check: false
|
|
disable_startup_analytics: true
|
|
allow_user_name_change: true
|
|
allow_user_mail_change: true
|
|
allow_user_username_change: true
|
|
gdpr_compliance: true
|
|
impersonation: true
|
|
avatars: "gravatar"
|
|
token_length: 128
|
|
# Use single quotes for footer_links
|
|
footer_links: '[{"name": "Link Name", "href": "https://mylink.com"}]'
|
|
mail:
|
|
host: ""
|
|
port: 25
|
|
tls: false
|
|
ssl: false
|
|
timeout: 10
|
|
user: ""
|
|
pass: ""
|
|
from: ""
|
|
error_reporting:
|
|
enabled: false
|
|
send_pii: false
|
|
environment: "customer"
|
|
logging:
|
|
log_level: "info"
|
|
ldap:
|
|
tls_ciphers: "null"
|
|
metrics:
|
|
enabled: true
|
|
|
|
geoip:
|
|
enabled: false
|
|
account_id: ""
|
|
license_key: ""
|
|
proxy: ""
|
|
proxy_user_pass: ""
|
|
edition_ids: "GeoLite2-City"
|
|
frequency: 8
|
|
host_server: "updates.maxmind.com"
|
|
preserve_file_times: false
|
|
verbose: false
|
|
|
|
outposts:
|
|
ldap:
|
|
# -- First you have to create an Outpost in the GUI. Applications > Outposts
|
|
enabled: false
|
|
# -- Host Browser by default is set to the first ingress host you set
|
|
# host_browser: ""
|
|
# -- Host should not need to be overridden. Defaults to http://localhost:9000
|
|
# host: ""
|
|
# -- As we use http://localhost:9000 it's an unsecure connection
|
|
# insecure: false
|
|
# -- Token is only needed if you accidentally deleted the token within the UI
|
|
# token: ""
|
|
metrics: false
|
|
proxy:
|
|
# -- First you have to create an Outpost in the GUI. Applications > Outposts
|
|
enabled: false
|
|
# -- Host Browser by default is set to the first ingress host you set
|
|
# host_browser: ""
|
|
# -- As we use http://localhost:9000 it's an unsecure connection
|
|
# insecure: false
|
|
# -- Host should not need to be overridden. Defaults to http://localhost:9000
|
|
# host: ""
|
|
# -- Token is only needed if you accidentally deleted the token within the UI
|
|
# token: ""
|
|
metrics: false
|
|
|
|
envFrom:
|
|
- secretRef:
|
|
name: '{{ include "tc.common.names.fullname" . }}-authentik-secret'
|
|
- configMapRef:
|
|
name: '{{ include "tc.common.names.fullname" . }}-authentik-config'
|
|
- configMapRef:
|
|
name: '{{ include "tc.common.names.fullname" . }}-authentik-server-config'
|
|
|
|
probes:
|
|
liveness:
|
|
type: HTTP
|
|
path: /-/health/live/
|
|
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
|
readiness:
|
|
type: HTTP
|
|
path: /-/health/ready/
|
|
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
|
startup:
|
|
type: HTTP
|
|
path: /-/health/ready/
|
|
port: "{{ .Values.service.http.ports.http.targetPort }}"
|
|
|
|
service:
|
|
main:
|
|
ports:
|
|
main:
|
|
protocol: HTTPS
|
|
port: 10229
|
|
targetPort: 9443
|
|
http:
|
|
enabled: true
|
|
ports:
|
|
http:
|
|
enabled: true
|
|
protocol: HTTP
|
|
port: 10230
|
|
targetPort: 9000
|
|
metrics:
|
|
enabled: true
|
|
ports:
|
|
metrics:
|
|
enabled: true
|
|
protocol: HTTP
|
|
port: 10231
|
|
targetPort: 9301
|
|
ldapldaps:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
ldapldaps:
|
|
enabled: true
|
|
port: 636
|
|
targetPort: 6636
|
|
ldapldap:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
ldapldap:
|
|
enabled: true
|
|
port: 389
|
|
targetPort: 3389
|
|
ldapmetrics:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
ldapmetrics:
|
|
enabled: true
|
|
port: 10232
|
|
protocol: HTTP
|
|
targetPort: 9302
|
|
proxyhttps:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
proxyhttps:
|
|
enabled: true
|
|
port: 10233
|
|
protocol: HTTPS
|
|
targetPort: 9444
|
|
proxyhttp:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
proxyhttp:
|
|
enabled: true
|
|
port: 10234
|
|
protocl: HTTP
|
|
targetPort: 9001
|
|
proxymetrics:
|
|
enabled: true
|
|
type: ClusterIP
|
|
ports:
|
|
proxymetrics:
|
|
enabled: true
|
|
port: 10235
|
|
protocol: HTTP
|
|
targetPort: 9303
|
|
|
|
ingress:
|
|
http:
|
|
autoLink: true
|
|
proxyhttps:
|
|
autoLink: true
|
|
proxyhttp:
|
|
autoLink: true
|
|
|
|
persistence:
|
|
media:
|
|
enabled: true
|
|
mountPath: "/media"
|
|
templates:
|
|
enabled: true
|
|
mountPath: "/templates"
|
|
certs:
|
|
enabled: true
|
|
mountPath: "/certs"
|
|
geoip:
|
|
enabled: true
|
|
mountPath: "/geoip"
|
|
|
|
postgresql:
|
|
enabled: true
|
|
existingSecret: "dbcreds"
|
|
postgresqlUsername: authentik
|
|
postgresqlDatabase: authentik
|
|
|
|
redis:
|
|
enabled: true
|
|
existingSecret: "rediscreds"
|
|
|
|
portal:
|
|
enabled: true
|