125 lines
3.8 KiB
YAML
125 lines
3.8 KiB
YAML
# The trial server is enabled only after the source database and files have
|
|
# been restored. Its worker and Ingress remain disabled until cutover, which
|
|
# prevents background jobs and production traffic reaching this clone.
|
|
authentikDeployment:
|
|
enabled: true
|
|
|
|
authentik:
|
|
global:
|
|
# CloudNativePG generates this connection Secret. Referencing individual
|
|
# keys avoids duplicating its generated database password in Git or SOPS.
|
|
env:
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-app
|
|
key: host
|
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-app
|
|
key: port
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-app
|
|
key: dbname
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-app
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-postgres-app
|
|
key: password
|
|
# `require` encrypts traffic to PostgreSQL without depending on a public
|
|
# CA; CloudNativePG rotates its private in-cluster certificates itself.
|
|
- name: AUTHENTIK_POSTGRESQL__SSLMODE
|
|
value: require
|
|
|
|
# The same Longhorn claim carries three restored source directories. Each
|
|
# subPath is mounted where the upstream container expects it.
|
|
volumes:
|
|
- name: authentik-data
|
|
persistentVolumeClaim:
|
|
claimName: authentik-data
|
|
volumeMounts:
|
|
- name: authentik-data
|
|
mountPath: /data
|
|
subPath: data
|
|
- name: authentik-data
|
|
mountPath: /templates
|
|
subPath: custom-templates
|
|
- name: authentik-data
|
|
mountPath: /certs
|
|
subPath: certs
|
|
|
|
authentik:
|
|
# This SOPS-managed Secret contains the source installation's exact secret
|
|
# key, preserving encrypted configuration and existing identity semantics.
|
|
existingSecret:
|
|
secretName: authentik-secrets
|
|
|
|
# CloudNativePG supplies PostgreSQL; do not deploy the bundled database.
|
|
postgresql:
|
|
enabled: false
|
|
|
|
server:
|
|
# One server is sufficient for this homelab; Kubernetes recreates it if the
|
|
# Pod fails, while PostgreSQL and uploaded files live on persistent storage.
|
|
replicas: 1
|
|
# UID/GID 1000 matches the restored Docker files and satisfies this
|
|
# namespace's restricted Pod Security policy without running as root.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
# Route the LAN hostname through the cluster's shared ingress-nginx IP.
|
|
# DNS-01 issuance and HTTPS routing were proven against Let's Encrypt's
|
|
# staging service before switching to this browser-trusted issuer.
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- auth.ahmza.com
|
|
tls:
|
|
- secretName: authentik-tls
|
|
hosts:
|
|
- auth.ahmza.com
|
|
|
|
worker:
|
|
# One worker handles scheduled jobs, source synchronization, email, and
|
|
# management of Kubernetes-native outposts.
|
|
replicas: 1
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|