Initial authentik gitops app

2026-04-20 01:03:25 +01:00
commit c85556e327
27 changed files with 1129 additions and 0 deletions
@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: shared-postgres-authentik-db
+  namespace: data
+spec:
+  name: authentik
+  owner: authentik
+  cluster:
+    name: shared-postgres
@@ -0,0 +1,31 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik
+  namespace: security
+  annotations:
+    gethomepage.dev/app: authentik-server
+    gethomepage.dev/enabled: "false"
+    gethomepage.dev/group: Security
+    gethomepage.dev/href: https://auth.olb42.com/
+    gethomepage.dev/icon: authentik
+    gethomepage.dev/name: Authentik
+    gethomepage.dev/namespace: security
+    gethomepage.dev/widget.key: "{{HOMEPAGE_VAR_AUTHENTIK_KEY}}"
+    gethomepage.dev/widget.type: authentik
+    gethomepage.dev/widget.url: http://authentik.security:9000
+    gethomepage.dev/widget.version: "2"
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`auth.olb42.com`)
+      middlewares:
+        - name: lan-only
+          namespace: infra
+      services:
+        - name: authentik
+          port: 9000
+  tls:
+    secretName: olb42-wildcard-tls
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: security
+
+resources:
+  - ../../base
+  - database.yaml
+  - ingressroute.yaml
+  - storage/persistentvolumeclaim.yaml
+
+generators:
+  - secret-generator.yaml
@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: authentik-secret-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - ./secret.secret.yaml
@@ -0,0 +1,24 @@
+apiVersion: ENC[AES256_GCM,data:nhU=,iv:+igd9RTOMy7mwVDjx05WQIdytoCrWLjcnP2Wq8xBS1s=,tag:61hSvgd/g88pjdhPW6OQsg==,type:str]
+kind: ENC[AES256_GCM,data:T9Wrg72s,iv:1+cSHl0Dwwc1ddnw4dQI26r8/aEfMAPpsmz6BxxetrQ=,tag:y8HSeCa9gl7i+rW1Qpzc0Q==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:VNJIfO/EtW0Pd3xVKG2R1VM=,iv:53UVCYVV07Qdlbq7j9qghT/DHqv+98muUFpapoD7VBs=,tag:hKBPwm7dudPUlRCgp4D9/g==,type:str]
+    namespace: ENC[AES256_GCM,data:/STezL4E9q4=,iv:mImCvy0lheb1px4+VEm7Z2c6qgQFerRnciPUy+arG2o=,tag:ZJxPwZ7pO6j+8xgHSDK/Og==,type:str]
+type: ENC[AES256_GCM,data:ypwwk80m,iv:gbfQojFcmmGCtALVkCcICc4Z4dDXQK8clTGIMkOMOkY=,tag:Y0AskWriaazAlDkNN6Ufuw==,type:str]
+stringData:
+    db_password: ENC[AES256_GCM,data:vx+4cvOPHycDmgp3fhTqsRC6ZjdviJy3svt5Kuhtzg48l8DNlxQpTvLgtdGYZmGS,iv:k84Nwxnuyc3D9ceXuMPhSTwzRrCucyUpJ/b7lrUTBlI=,tag:JOMAcJN9frgVkpeV8pm39A==,type:str]
+    secret_key: ENC[AES256_GCM,data:ZhH2xkHf/wLXiooCBP+9ZctsGSOMW1de4xz8IGPS0z1GSTReM9h7sSHhw1vJl7iHsr8ne4ehXQYvLd/QcvLVShS2WVDSt1wXcKejnHgRTBk=,iv:xFSp0TRzBl0c4hx6UPv2CdFx9fMQ/oAes8JpWf1Zj7U=,tag:j8jrfilCe2gfyQr1kls4WQ==,type:str]
+sops:
+    age:
+        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdWlWdTRWOWhTNnFocWlI
+            QTlLNmJtUkZLSUNOdi9yQmNVQkVkQi94WFc4Cno2NjJCeURlc3FZd0hTK0IzUXJq
+            STZtU0pBZ25SaFJqMFZNaE41a1p0SkEKLS0tIFg2VlphajFlSjdtSFM1NTVZdjZm
+            SmVrN2pFQ0MzVS9aUUtrVnFUaUd6TzAKksOI8fvGkE8/Qmk8yT7jvvakFWSLDYKa
+            7/pcTR0msB9P8zowsfe4pL+BJIObctXpyTRPCyyJg7/vOHqhuUv9Wg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-19T23:31:55Z"
+    mac: ENC[AES256_GCM,data:sRk5KdZXohSwRWs6jP/jUA1OMBgnxKQu82Wp2w/4q1K0XXe1KRSDyiIIklgdK6JAW5U0291EzKLg8KgTks3YsibteA4L7eFbwFDTXOn7OJwjhKlzTZXqxEjmGHmsKLa7v8Y8nKuJqn2CUrfUuLzyvUaQN2tXfigq/DPC0HyROQs=,iv:zzWBrUcOumbaDArX9xRPzz3J98fA9wAgC1cKafejWT8=,tag:DL9o2cA5Uslq6WWGzlt8QA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
@@ -0,0 +1,32 @@
+# Optional static PV example for NFS-backed storage.
+# This file is not referenced from kustomization.yaml by default because the
+# default storage flow uses dynamic provisioning via the Longhorn PVC.
+#
+# To use this file:
+#   1. Add storage/persistentvolume-nfs.yaml to resources in this overlay.
+#   2. Update persistentvolumeclaim.yaml to set:
+#        storageClassName: nfs-shared
+#        volumeName: app-data
+#        accessModes: [ReadWriteMany]
+#   3. Replace the placeholder NFS server and export path below.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: app-data
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: app-data
+    namespace: security
+  storageClassName: nfs-shared
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: nfs.example.internal
+    path: /exports/app-data
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authentik-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi