148 lines
4.4 KiB
YAML
148 lines
4.4 KiB
YAML
# The authentik-gate ingress class: an Ingress of this class becomes an
|
|
# Authentik proxy gate (provider, application, outpost, group binding) plus the
|
|
# Traefik Ingress, ExternalName Service and CiliumNetworkPolicies in front of
|
|
# its backend. Traefik ignores the class (it only serves classes naming
|
|
# traefik.io/ingress-controller). Controller: ci/images/authentik-gate-sync.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: IngressClass
|
|
metadata:
|
|
name: authentik-gate
|
|
spec:
|
|
controller: renner.uno/authentik-gate
|
|
---
|
|
# API token of the authentik-gate-sync service account. Generated once; the
|
|
# blueprint (gate-sync.yaml key in blueprints-configmap.yaml) sets it as the
|
|
# token's key via AUTHENTIK_GATE_SYNC_TOKEN, the controller reads the same Secret.
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
metadata:
|
|
name: authentik-gate-sync-token
|
|
namespace: authentik
|
|
spec:
|
|
length: 64
|
|
digits: 16
|
|
symbols: 0
|
|
allowRepeat: true
|
|
noUpper: false
|
|
secretKeys:
|
|
- token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-gate-sync-token
|
|
namespace: authentik
|
|
spec:
|
|
refreshPolicy: CreatedOnce
|
|
target:
|
|
name: authentik-gate-sync-token
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
name: authentik-gate-sync-token
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: authentik-gate-sync
|
|
namespace: authentik
|
|
labels:
|
|
app.kubernetes.io/name: authentik-gate-sync
|
|
---
|
|
# Cluster-wide: gated Ingresses live in any namespace, and so do the route
|
|
# Ingress, ExternalName Service and backend CNP generated next to them.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: authentik-gate-sync
|
|
rules:
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# The source Ingress's load-balancer status mirrors its generated route.
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses/status"]
|
|
verbs: ["get", "patch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: ["cilium.io"]
|
|
resources: ["ciliumnetworkpolicies"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: authentik-gate-sync
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: authentik-gate-sync
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: authentik-gate-sync
|
|
namespace: authentik
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: authentik-gate-sync
|
|
namespace: authentik
|
|
labels:
|
|
app.kubernetes.io/name: authentik-gate-sync
|
|
spec:
|
|
replicas: 1
|
|
# One writer against the Authentik API at a time.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: authentik-gate-sync
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: authentik-gate-sync
|
|
spec:
|
|
serviceAccountName: authentik-gate-sync
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
runAsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: controller
|
|
image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-19-0544 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
env:
|
|
- name: AK_URL
|
|
value: http://authentik-server.authentik.svc.cluster.local
|
|
- name: AUTHENTIK_HOST_BROWSER
|
|
value: https://auth.renner.uno/
|
|
- name: SERVICE_CONNECTION
|
|
value: Local Kubernetes Cluster
|
|
- name: DEFAULT_AUTHORIZATION_FLOW
|
|
value: default-provider-authorization-implicit-consent
|
|
- name: INTERVAL_SECONDS
|
|
value: "60"
|
|
volumeMounts:
|
|
- name: token
|
|
mountPath: /var/run/secrets/authentik-gate-sync
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 64Mi
|
|
volumes:
|
|
- name: token
|
|
secret:
|
|
secretName: authentik-gate-sync-token
|