# The authentik-gate ingress class: an Ingress of this class becomes an
# Authentik proxy gate (provider, application, outpost, group binding) plus the
# Traefik Ingress, ExternalName Service and CiliumNetworkPolicies in front of
# its backend. Traefik ignores the class (it only serves classes naming
# traefik.io/ingress-controller). Controller: ci/images/authentik-gate-sync.
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: authentik-gate
spec:
  controller: renner.uno/authentik-gate
---
# API token of the authentik-gate-sync service account. Generated once; the
# blueprint (gate-sync.yaml key in blueprints-configmap.yaml) sets it as the
# token's key via AUTHENTIK_GATE_SYNC_TOKEN, the controller reads the same Secret.
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: authentik-gate-sync-token
  namespace: authentik
spec:
  length: 64
  digits: 16
  symbols: 0
  allowRepeat: true
  noUpper: false
  secretKeys:
    - token
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: authentik-gate-sync-token
  namespace: authentik
spec:
  refreshPolicy: CreatedOnce
  target:
    name: authentik-gate-sync-token
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: authentik-gate-sync-token
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: authentik-gate-sync
  namespace: authentik
  labels:
    app.kubernetes.io/name: authentik-gate-sync
---
# Cluster-wide: gated Ingresses live in any namespace, and so do the route
# Ingress, ExternalName Service and backend CNP generated next to them.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: authentik-gate-sync
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # The source Ingress's load-balancer status mirrors its generated route.
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["cilium.io"]
    resources: ["ciliumnetworkpolicies"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: authentik-gate-sync
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: authentik-gate-sync
subjects:
  - kind: ServiceAccount
    name: authentik-gate-sync
    namespace: authentik
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-gate-sync
  namespace: authentik
  labels:
    app.kubernetes.io/name: authentik-gate-sync
spec:
  replicas: 1
  # One writer against the Authentik API at a time.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: authentik-gate-sync
  template:
    metadata:
      labels:
        app.kubernetes.io/name: authentik-gate-sync
    spec:
      serviceAccountName: authentik-gate-sync
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: controller
          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          env:
            - name: AK_URL
              value: http://authentik-server.authentik.svc.cluster.local
            - name: AUTHENTIK_HOST_BROWSER
              value: https://auth.renner.uno/
            - name: SERVICE_CONNECTION
              value: Local Kubernetes Cluster
            - name: DEFAULT_AUTHORIZATION_FLOW
              value: default-provider-authorization-implicit-consent
            - name: INTERVAL_SECONDS
              value: "60"
          volumeMounts:
            - name: token
              mountPath: /var/run/secrets/authentik-gate-sync
              readOnly: true
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 64Mi
      volumes:
        - name: token
          secret:
            secretName: authentik-gate-sync-token