homelab/kubernetes/apps/authentik/helmrelease.yaml

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: authentik
  namespace: authentik
spec:
  interval: 24h
  url: https://charts.goauthentik.io
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: authentik
  namespace: authentik
spec:
  interval: 30m
  chart:
    spec:
      chart: authentik
      # Pinned to match the samba-bridge fork's app image (server.Dockerfile
      # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a
      # floating range drifts the chart ahead of the pinned app image.
      version: "2026.5.3"
      sourceRef:
        kind: HelmRepository
        name: authentik
        namespace: authentik
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  values:
    global:
      # Reloader restarts BOTH the authentik server and worker Deployments when
      # authentik-secrets changes (e.g. after a SECRET_KEY rotation); global
      # podAnnotations propagate to every component pod. See
      # kubernetes/infrastructure/openbao/rotation/authentik.yaml.
      podAnnotations:
        secret.reloader.stakater.com/reload: authentik-secrets
      # Custom Authentik server image with the samba-bridge baked in.
      # The bridge synthesises sambaNTPassword (and the rest of the
      # Samba schema) on every User.set_password() call for any user
      # in the configured Synology Users group, so the LDAP outpost
      # then emits NT-hash-bearing user entries that DSM's smbd
      # accepts for NTLMv2 SMB authentication. See
      # https://gitea.renner.uno/k.renner/authentik-samba-bridge .
      image:
        repository: gitea.renner.uno/k.renner/authentik-samba-bridge-server
        # Pinned to a specific build for two reasons:
        # 1. K8s does not pull on every reschedule when tag=latest, so
        #    a floating tag means we don't actually pick up rebuilds
        #    without a manual rollout-restart (which is forbidden per
        #    "no pod invasion" rule).
        # 2. Pinning means the deployed binary is traceable to a
        #    specific repo commit. Bump the tag whenever a new build
        #    is published from gitea.renner.uno/k.renner/authentik-samba-bridge .
        tag: "2026.5.3-f02b945"
      envFrom:
        # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET
        # consumed by the bridge module at Django app startup. Missing
        # SAMBA_BRIDGE_DOMAIN_SID fails the pod fast. See
        # samba-bridge-secret.sops.yaml.
        - secretRef:
            name: authentik-samba-bridge-config
      env:
        - name: AUTHENTIK_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: authentik-secrets
              key: secret-key
        - name: AUTHENTIK_POSTGRESQL__PASSWORD
          valueFrom:
            secretKeyRef:
              name: ak-pg-app
              key: password
        - name: AUTHENTIK_EMAIL__PASSWORD
          valueFrom:
            secretKeyRef:
              name: authentik-secrets
              key: smtp-password
        # Stable TLS material for the LDAP outpost. Both server (UI/API)
        # and worker (blueprint applier) read these via `!Env` in the
        # ldap-outpost-cert blueprint entry, which materialises an
        # authentik_crypto.certificatekeypair the LDAP providers attach
        # via attrs.certificate. Issued by cert-manager — see
        # ldap-outpost-cert.yaml. Both pods get it because the chart's
        # global.env propagates to server AND worker; if only the worker
        # had it, blueprint apply would crash on startup with KeyError.
        - name: LDAP_OUTPOST_TLS_CRT
          valueFrom:
            secretKeyRef:
              name: ldap-outpost-tls
              key: tls.crt
        - name: LDAP_OUTPOST_TLS_KEY
          valueFrom:
            secretKeyRef:
              name: ldap-outpost-tls
              key: tls.key

    authentik:
      log_level: info
      error_reporting:
        enabled: true
      postgresql:
        host: "ak-pg-rw.authentik.svc.cluster.local"
        name: "authentik"
        user: "authentik"
      email:
        host: "smtp.protonmail.ch"
        port: 587
        username: "olymp@renner.uno"
        password: ""
        use_tls: true
        from: "olymp@renner.uno"

    server:
      resources:
        requests:
          cpu: 200m
          memory: 1Gi
        limits:
          memory: 2Gi
      autoscaling:
        enabled: true
        minReplicas: 2
        maxReplicas: 4
        targetCPUUtilizationPercentage: 70
      metrics:
        enabled: true
        serviceMonitor:
          enabled: true
          labels:
            release: kube-prometheus-stack
      ingress:
        enabled: true
        ingressClassName: traefik
        labels:
          # Registered publicly (Cloudflare wildcard -> NetBird proxy); the
          # UDM external-dns instance skips it, LAN uses the hairpin NAT.
          dns.renner.uno/public: "true"
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-cluster
        hosts:
          - auth.renner.uno
        tls:
          - secretName: authentik-tls
            hosts:
              - auth.renner.uno

    worker:
      resources:
        requests:
          cpu: 200m
          memory: 1Gi
        limits:
          memory: 2Gi
      autoscaling:
        enabled: true
        minReplicas: 2
        maxReplicas: 4
        targetCPUUtilizationPercentage: 70

    postgresql:
      enabled: false

    redis:
      enabled: false

    # Mount the homelab blueprints (K8s outpost integration, passkey
    # step-up authorization) — every key of the ConfigMap is applied by
    # the worker on boot and on each apply cycle. See
    # blueprints-configmap.yaml.
    blueprints:
      configMaps:
        - authentik-blueprints-k8s-outposts