release.yaml (8376B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: authentik 5 namespace: authentik 6 spec: 7 releaseName: authentik 8 chart: 9 spec: 10 chart: authentik 11 version: "2026.2.2" 12 sourceRef: 13 kind: HelmRepository 14 name: authentik 15 interval: 60m 16 timeout: 25m 17 install: 18 timeout: 25m 19 remediation: 20 retries: 3 21 values: 22 #global: 23 #image: 24 #pullPolicy: Always 25 # https://github.com/goauthentik/authentik/issues/12464 26 #repository: ghcr.io/goauthentik/dev-server 27 #tag: gh-version-2024.12-arm64 28 authentik: 29 secret_key: ENC[AES256_GCM,data:Qq1S+Kk6yb//WVc1sTmoIu1DO4ejWlVpg4mqYCA8+kNuc/KloUUQP33tXRGYQIlePE6ykyeqctje9h1CHND9QQ==,iv:KjCWOBFelR08Bm4n8f7FsicFNBw7gzZ1MQ9yLwh6j0s=,tag:93XCTQjxJu28uhpSayM1EQ==,type:str] 30 # This sends anonymous usage-data, stack traces on errors and 31 # performance data to sentry.io, and is fully opt-in 32 error_reporting: 33 enabled: true 34 postgresql: 35 host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local 36 name: authentik 37 user: authentik 38 password: ENC[AES256_GCM,data:7qmIA2GYyHyR8/aFK75qvDb1Ndd+OfHwGfAQP/XLCEm8/6ocrVQhotkfS3XX5JIStZXRsvohZD5VZ9j1ShYILA==,iv:bwNic3q8ZW1oMhmL80Dg7KdZ59bdu/tQvIRiwvZZ2m0=,tag:TAFMjzlJnyKS/drf69EMOA==,type:str] 39 email: 40 # -- SMTP Server emails are sent from, fully optional 41 host: mail.nordgedanken.dev 42 port: 465 43 # -- SMTP credentials, when left empty, no authentication will be done 44 username: support@nordgedanken.dev 45 # -- SMTP credentials, when left empty, no authentication will be done 46 password: ENC[AES256_GCM,data:ShLG8GLcWjiA,iv:Pb2jXjIqlELaCFshqscNGsXUCp056sZbfCvc3jEOJwc=,tag:kg4PWpf5nOtzI+2R9ahV2Q==,type:str] 47 # -- Enable either use_tls or use_ssl, they can't be enabled at the same time. 48 use_tls: true 49 # -- Enable either use_tls or use_ssl, they can't be enabled at the same time. 50 use_ssl: false 51 # -- Connection timeout 52 timeout: 30 53 # -- Email from address, can either be in the format "foo@bar.baz" or "authentik <foo@bar.baz>" 54 from: ops@nordgedanken.dev 55 worker: 56 replicas: 2 57 resources: 58 limits: {} 59 requests: 60 cpu: 107m 61 memory: 578Mi 62 deploymentStrategy: 63 type: RollingUpdate 64 rollingUpdate: 65 maxSurge: 25% 66 maxUnavailable: 25% 67 # Mount the ldap certificate to /certs 68 volumes: 69 - name: ldap-cert 70 secret: 71 secretName: ENC[AES256_GCM,data:gkdJ6ufGzmE8UIrtR/Y=,iv:ajE/NG7B17OqHu5PVtI+STkiJQA2ZTv14yfWe9TZlNw=,tag:Pyz5nG4skc/vgMl5gg+83g==,type:str] 72 # Mount the ldap certificate to /certs 73 volumeMounts: 74 - name: ldap-cert 75 mountPath: /certs/ldap 76 server: 77 # Mount the ldap certificate to /certs 78 volumes: 79 - name: ldap-cert 80 secret: 81 secretName: ENC[AES256_GCM,data:UU2WJB3n7WzQRX5OEIk=,iv:YjPGIgu7UWhMEdAH/LJSHdDkin4tMMY2ZzBOguT9VQU=,tag:ryzrMsKoaViRmpx7URHhVw==,type:str] 82 # Mount the ldap certificate to /certs 83 volumeMounts: 84 - name: ldap-cert 85 mountPath: /certs/ldap 86 replicas: 2 87 deploymentStrategy: 88 type: RollingUpdate 89 rollingUpdate: 90 maxSurge: 25% 91 maxUnavailable: 25% 92 resources: 93 limits: {} 94 requests: 95 cpu: 181m 96 memory: 628Mi 97 env: 98 - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS 99 value: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fe80::/10,::1/128,10.244.0.0/16,fc00:0::/96,fd00::/7 100 ingress: 101 annotations: 102 cert-manager.io/cluster-issuer: letsencrypt-dns 103 external-dns.alpha.kubernetes.io/hostname: auth.midnightthoughts.space 104 enabled: false 105 hosts: 106 - auth.midnightthoughts.space 107 - ldap.midnightthoughts.space 108 paths: 109 - / 110 pathType: Prefix 111 tls: 112 - hosts: 113 - auth.midnightthoughts.space 114 - ldap.midnightthoughts.space 115 secretName: auth-midnightthoughts-tls-secret 116 postgresql: 117 enabled: false 118 redis: 119 enabled: true 120 sops: 121 kms: [] 122 gcp_kms: [] 123 azure_kv: [] 124 hc_vault: [] 125 age: 126 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 127 enc: | 128 -----BEGIN AGE ENCRYPTED FILE----- 129 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aEZVdzVpbWFYYkxlR1lJ 130 TElyM0tSeDMrQjNXbWIyV0dYcDNJUjFydjF3CmNPb2IzSnRSeFVIaFUzS2dtaktk 131 VXpvV0pGZ2tOdHhBM0hJQjRhWjJaVEUKLS0tIFFNdG5sazIxSkNZUUthT2Mxelo2 132 L2xFMnFYVWpPOFJqbXg1Um56dXZaVlUKlBPL7s2wl2+dJoGiC9b1oXBRvewd9LAe 133 LpuQF38AscU+pkNoi2WBFw2MsvEYF+EtPJczESIwiMetehRj2n4KxQ== 134 -----END AGE ENCRYPTED FILE----- 135 lastmodified: "2025-02-19T14:22:13Z" 136 mac: ENC[AES256_GCM,data:cVtB9Yn3DtLT7DHh6r4y+Kooap4o3Vllx/nnNc8Zd2S2nQ5gmVSG/RBv88pNwCnybsUyK/Yd+1I1jwTzxIz9ZI1gosL23fLhJ9LK/Yzk3d56Z7krqXGp5IIw7I/lZyzyGlSp8R50KpGhZ8BObUU2C7mU7D+/W7ctnMj1mJLP+xg=,iv:4bdFaUt6lBYog6kpsZiixm6kYkzKRj8hwA335th9GVo=,tag:HorsmiQJ9ttuYC5rkzevCA==,type:str] 137 pgp: [] 138 encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 139 version: 3.9.1 140 --- 141 apiVersion: gateway.networking.k8s.io/v1 142 kind: HTTPRoute 143 metadata: 144 name: authentik 145 namespace: authentik 146 spec: 147 parentRefs: 148 - name: envoy-gateway 149 namespace: envoy-gateway 150 hostnames: 151 - auth.midnightthoughts.space 152 - ldap.midnightthoughts.space 153 rules: 154 - backendRefs: 155 - name: authentik-server 156 port: 80 157 timeouts: 158 request: 240s 159 backendRequest: 0s 160 sops: 161 kms: [] 162 gcp_kms: [] 163 azure_kv: [] 164 hc_vault: [] 165 age: 166 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 167 enc: | 168 -----BEGIN AGE ENCRYPTED FILE----- 169 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aEZVdzVpbWFYYkxlR1lJ 170 TElyM0tSeDMrQjNXbWIyV0dYcDNJUjFydjF3CmNPb2IzSnRSeFVIaFUzS2dtaktk 171 VXpvV0pGZ2tOdHhBM0hJQjRhWjJaVEUKLS0tIFFNdG5sazIxSkNZUUthT2Mxelo2 172 L2xFMnFYVWpPOFJqbXg1Um56dXZaVlUKlBPL7s2wl2+dJoGiC9b1oXBRvewd9LAe 173 LpuQF38AscU+pkNoi2WBFw2MsvEYF+EtPJczESIwiMetehRj2n4KxQ== 174 -----END AGE ENCRYPTED FILE----- 175 lastmodified: "2025-02-19T14:22:13Z" 176 mac: ENC[AES256_GCM,data:cVtB9Yn3DtLT7DHh6r4y+Kooap4o3Vllx/nnNc8Zd2S2nQ5gmVSG/RBv88pNwCnybsUyK/Yd+1I1jwTzxIz9ZI1gosL23fLhJ9LK/Yzk3d56Z7krqXGp5IIw7I/lZyzyGlSp8R50KpGhZ8BObUU2C7mU7D+/W7ctnMj1mJLP+xg=,iv:4bdFaUt6lBYog6kpsZiixm6kYkzKRj8hwA335th9GVo=,tag:HorsmiQJ9ttuYC5rkzevCA==,type:str] 177 pgp: [] 178 encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 179 version: 3.9.1