k8s-starter-pack/apps/authentik/values.yaml

# The trial server is enabled only after the source database and files have
# been restored. Its worker and Ingress remain disabled until cutover, which
# prevents background jobs and production traffic reaching this clone.
authentikDeployment:
  enabled: true

authentik:
  global:
    # Server and worker share one ReadWriteOnce Longhorn volume. Recreate stops
    # the old Pods before replacements start, allowing the volume to move nodes
    # instead of leaving a rolling update blocked by a multi-attach error.
    deploymentStrategy:
      type: Recreate

    # CloudNativePG generates this connection Secret. Referencing individual
    # keys avoids duplicating its generated database password in Git or SOPS.
    env:
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: host
      - name: AUTHENTIK_POSTGRESQL__PORT
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: port
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: username
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-postgres-app
            key: password
      # `require` encrypts traffic to PostgreSQL without depending on a public
      # CA; CloudNativePG rotates its private in-cluster certificates itself.
      - name: AUTHENTIK_POSTGRESQL__SSLMODE
        value: require
      # Authentik 2026.8 only honors forwarded HTTPS and client-address headers
      # from explicit trusted proxies. This is the smallest aggregate covering
      # all current node Pod subnets, so ingress-nginx stays trusted if moved.
      - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
        value: 10.244.0.0/21

    # The same Longhorn claim carries three restored source directories. Each
    # subPath is mounted where the upstream container expects it.
    volumes:
      - name: authentik-data
        persistentVolumeClaim:
          claimName: authentik-data
    volumeMounts:
      - name: authentik-data
        mountPath: /data
        subPath: data
      - name: authentik-data
        mountPath: /templates
        subPath: custom-templates
      - name: authentik-data
        mountPath: /certs
        subPath: certs

  authentik:
    # This SOPS-managed Secret contains the source installation's exact secret
    # key, preserving encrypted configuration and existing identity semantics.
    existingSecret:
      secretName: authentik-secrets

  # CloudNativePG supplies PostgreSQL; do not deploy the bundled database.
  postgresql:
    enabled: false

  server:
    # One server is sufficient for this homelab; Kubernetes recreates it if the
    # Pod fails, while PostgreSQL and uploaded files live on persistent storage.
    replicas: 1
    # UID/GID 1000 matches the restored Docker files and satisfies this
    # namespace's restricted Pod Security policy without running as root.
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault
    resources:
      requests:
        cpu: 250m
        memory: 512Mi
      limits:
        cpu: "2"
        memory: 2Gi
    # Route the LAN hostname through the cluster's shared ingress-nginx IP.
    # DNS-01 issuance and HTTPS routing were proven against Let's Encrypt's
    # staging service before switching to this browser-trusted issuer.
    ingress:
      enabled: true
      ingressClassName: nginx
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod
      hosts:
        - auth.ahmza.com
      tls:
        - secretName: authentik-tls
          hosts:
            - auth.ahmza.com

  worker:
    # One worker handles scheduled jobs, source synchronization, email, and
    # management of Kubernetes-native outposts.
    replicas: 1
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault