111 lines
2.6 KiB
YAML
111 lines
2.6 KiB
YAML
global:
|
|
addPrometheusAnnotations: true
|
|
securityContext:
|
|
runAsUser: 1000
|
|
fsGroup: 1000
|
|
podLabels:
|
|
app: authentik
|
|
nodeSelector:
|
|
nodepool: worker
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: DoNotSchedule
|
|
labelSelector:
|
|
matchLabels:
|
|
app: authentik
|
|
env:
|
|
- name: AUTHENTIK_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-secret-key
|
|
key: password
|
|
- name: AUTHENTIK_EMAIL__USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-token
|
|
key: authentik-username
|
|
- name: AUTHENTIK_EMAIL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-token
|
|
key: authentik-password
|
|
- name: AUTHENTIK_EMAIL__FROM
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-token
|
|
key: authentik-username
|
|
- name: AUTHENTIK_EMAIL__USE_TLS
|
|
value: "true"
|
|
- name: AUTHENTIK_POSTGRESQL__SSLMODE
|
|
value: verify-full
|
|
- name: AUTHENTIK_POSTGRESQL__SSLROOTCERT
|
|
value: "/opt/authentik/certs/ca.crt"
|
|
- name: AUTHENTIK_POSTGRESQL__SSLCERT
|
|
value: "/opt/authentik/certs/tls.crt"
|
|
- name: AUTHENTIK_POSTGRESQL__SSLKEY
|
|
value: "/opt/authentik/certs/tls.key"
|
|
- name: AUTHENTIK_REDIS__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: valkey
|
|
key: password
|
|
volumes:
|
|
- name: ssl-bundle
|
|
projected:
|
|
sources:
|
|
- secret:
|
|
name: authentik-client-cert
|
|
items:
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
- key: tls.key
|
|
path: tls.key
|
|
mode: 0600
|
|
- secret:
|
|
name: postgres-server-cert
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
volumeMounts:
|
|
- name: ssl-bundle
|
|
mountPath: /opt/authentik/certs
|
|
readOnly: true
|
|
|
|
authentik:
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: "smtp.protonmail.ch"
|
|
port: 587
|
|
postgresql:
|
|
host: postgres-cluster-rw
|
|
user: authentik
|
|
name: authentik
|
|
redis:
|
|
host: valkey
|
|
|
|
server:
|
|
replicas: 3
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: cloudflare-issuer
|
|
cert-manager.io/acme-challenge-type: dns01
|
|
cert-manager.io/private-key-size: "4096"
|
|
ingressClassName: traefik
|
|
hosts:
|
|
- auth.dogar.dev
|
|
tls:
|
|
- secretName: authentik-tls
|
|
hosts:
|
|
- auth.dogar.dev
|
|
|
|
worker:
|
|
replicas: 3
|
|
|
|
postgresql:
|
|
enabled: false
|
|
redis:
|
|
enabled: false
|