From e8c19fbfc704df30a95ceb28ae71e009aac1859a Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 9 May 2026 14:24:21 +0200 Subject: [PATCH] authentik: pin Caddy/Radius outposts to authentik namespace Caddy and Local Radius outposts came over from the Proxmox deployment with `kubernetes_namespace: default` in their config. The chart-rendered Role only grants permissions in `authentik`, so the K8s controller's first GET against `secrets/ak-outpost-{name}` in `default` returned 403. LDAP Outpost worked because its config never had the field set (falls back to the running pod's namespace). Pin both to `authentik` via the existing blueprint so the controller spawns them next to authentik-server. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../apps/authentik/blueprints-configmap.yaml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index c9934055..9ee16e51 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -32,12 +32,37 @@ data: attrs: service_connection: !KeyOf k8s-conn + # `Caddy` and `Local Radius` carried `kubernetes_namespace: default` + # in their config from the Proxmox-era data, which the chart Role + # has no permissions for. Pin both at `authentik` so the worker + # spawns them next to authentik-server; the Role already grants + # the deploy/svc/ingress/secret/configmap perms in this namespace. + # The `LDAP Outpost` config never had `kubernetes_namespace` set, + # so it defaults to the running pod's namespace and is fine — but + # we still pin its service_connection here for symmetry. - model: authentik_outposts.outpost identifiers: name: Caddy state: present attrs: service_connection: !KeyOf k8s-conn + config: + log_level: info + authentik_host: "https://auth.renner.uno/" + authentik_host_insecure: false + authentik_host_browser: "" + refresh_interval: "minutes=5" + container_image: null + object_naming_template: "ak-outpost-%(name)s" + kubernetes_namespace: authentik + kubernetes_replicas: 1 + kubernetes_service_type: ClusterIP + kubernetes_disabled_components: [] + kubernetes_image_pull_secrets: [] + kubernetes_ingress_annotations: {} + kubernetes_ingress_class_name: null + kubernetes_ingress_secret_name: "authentik-outpost-tls" + kubernetes_json_patches: null - model: authentik_outposts.outpost identifiers: @@ -52,6 +77,26 @@ data: state: present attrs: service_connection: !KeyOf k8s-conn + config: + log_level: info + authentik_host: "https://auth.renner.uno/" + authentik_host_insecure: false + authentik_host_browser: "" + refresh_interval: "minutes=5" + container_image: null + object_naming_template: "ak-outpost-%(name)s" + kubernetes_namespace: authentik + kubernetes_replicas: 1 + kubernetes_service_type: ClusterIP + kubernetes_disabled_components: [] + kubernetes_image_pull_secrets: [] + kubernetes_ingress_annotations: {} + kubernetes_ingress_class_name: null + kubernetes_ingress_secret_name: "authentik-outpost-tls" + kubernetes_ingress_path_type: null + kubernetes_httproute_annotations: {} + kubernetes_httproute_parent_refs: [] + kubernetes_json_patches: null - model: authentik_outposts.dockerserviceconnection identifiers: