Commit new Chart releases for TrueCharts
Signed-off-by: TrueCharts-Bot <bot@truecharts.org>
This commit is contained in:
TrueCharts-Bot
parent
9f7400af25
commit
b47bdd1c45
|
|
@ -0,0 +1,30 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
# helm-docs templates
|
||||
*.gotmpl
|
||||
# docs folder
|
||||
/docs
|
||||
# icon
|
||||
icon.png
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
---
|
||||
title: Changelog
|
||||
---
|
||||
|
||||
|
||||
*for the complete changelog, please refer to the website*
|
||||
|
||||
**Important:**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-19.2.10](https://github.com/truecharts/charts/compare/authentik-19.2.9...authentik-19.2.10) (2024-02-03)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update container image common to v17.2.30[@19ad5ec](https://github.com/19ad5ec) by renovate ([#17804](https://github.com/truecharts/charts/issues/17804))
|
||||
|
||||
|
||||
## [authentik-19.2.9](https://github.com/truecharts/charts/compare/authentik-19.2.5...authentik-19.2.9) (2024-01-29)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update authentik to v2023.10.7[@c483b0a](https://github.com/c483b0a) by renovate (patch) ([#17752](https://github.com/truecharts/charts/issues/17752))
|
||||
|
||||
|
||||
## [authentik-19.2.5](https://github.com/truecharts/charts/compare/authentik-19.2.4...authentik-19.2.5) (2024-01-27)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update helm general non-major by renovate ([#17525](https://github.com/truecharts/charts/issues/17525))
|
||||
|
||||
|
||||
## [authentik-19.2.4](https://github.com/truecharts/charts/compare/authentik-19.2.3...authentik-19.2.4) (2024-01-26)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update container image common to v17.2.29[@d7c41a3](https://github.com/d7c41a3) by renovate ([#17545](https://github.com/truecharts/charts/issues/17545))
|
||||
|
||||
|
||||
## [authentik-19.2.3](https://github.com/truecharts/charts/compare/authentik-19.2.2...authentik-19.2.3) (2024-01-21)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update container image common to v17.2.28[@918b4c5](https://github.com/918b4c5) by renovate ([#17478](https://github.com/truecharts/charts/issues/17478))
|
||||
|
||||
|
||||
## [authentik-19.2.2](https://github.com/truecharts/charts/compare/authentik-19.2.1...authentik-19.2.2) (2024-01-21)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update container image common to v17.2.26[@24c98f7](https://github.com/24c98f7) by renovate ([#17409](https://github.com/truecharts/charts/issues/17409))
|
||||
|
||||
|
||||
## [authentik-19.2.1](https://github.com/truecharts/charts/compare/authentik-19.2.0...authentik-19.2.1) (2024-01-21)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update metadata in chart.yaml ([#17457](https://github.com/truecharts/charts/issues/17457))
|
||||
|
||||
|
||||
## [authentik-19.2.0](https://github.com/truecharts/charts/compare/authentik-19.1.13...authentik-19.2.0) (2024-01-14)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update container image ghcr.io/maxmind/geoipupdate to v6.1.0[@cdd36d3](https://github.com/cdd36d3) by renovate ([#17203](https://github.com/truecharts/charts/issues/17203))
|
||||
|
||||
|
||||
## [authentik-19.1.13](https://github.com/truecharts/charts/compare/authentik-19.1.9...authentik-19.1.13) (2024-01-13)
|
||||
|
||||
### Chore
|
||||
|
||||
|
||||
|
||||
- update authentik to v2023.10.6[@1a17c68](https://github.com/1a17c68) by renovate (patch) ([#17101](https://github.com/truecharts/charts/issues/17101))
|
||||
|
||||
|
||||
## [authentik-19.1.9](https://github.com/truecharts/charts/compare/authentik-19.1.8...authentik-19.1.9) (2024-01-09)
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
annotations:
|
||||
max_scale_version: 24.04.0
|
||||
min_scale_version: 23.10.0
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/category: authentication
|
||||
truecharts.org/max_helm_version: "3.14"
|
||||
truecharts.org/min_helm_version: "3.12"
|
||||
truecharts.org/train: stable
|
||||
apiVersion: v2
|
||||
appVersion: 2024.2.1
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 17.5.0
|
||||
repository: oci://tccr.io/truecharts
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
- name: redis
|
||||
version: 11.2.1
|
||||
repository: oci://tccr.io/truecharts
|
||||
condition: redis.enabled
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
deprecated: false
|
||||
description: Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
home: https://truecharts.org/charts/stable/authentik
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png
|
||||
keywords:
|
||||
- authentik
|
||||
kubeVersion: '>=1.24.0-0'
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@truecharts.org
|
||||
url: https://truecharts.org
|
||||
name: authentik
|
||||
sources:
|
||||
- https://goauthentik.io/docs/
|
||||
- https://github.com/goauthentik/authentik
|
||||
- https://github.com/truecharts/charts/tree/master/charts/stable/authentik
|
||||
- https://ghcr.io/maxmind/geoipupdate
|
||||
- https://ghcr.io/goauthentik/radius
|
||||
- https://ghcr.io/goauthentik/proxy
|
||||
- https://ghcr.io/goauthentik/ldap
|
||||
- https://ghcr.io/goauthentik/server
|
||||
type: application
|
||||
version: 23.1.4
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
title: README
|
||||
---
|
||||
|
||||
## General Info
|
||||
|
||||
TrueCharts can be installed as both _normal_ Helm Charts or as Apps on TrueNAS SCALE.
|
||||
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||
|
||||
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/authentik)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
_All Rights Reserved - The TrueCharts Project_
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
|
||||
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/authentik](https://truecharts.org/charts/stable/authentik)
|
||||
|
||||
---
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,502 @@
|
|||
image:
|
||||
repository: ghcr.io/goauthentik/server
|
||||
tag: 2024.2.1@sha256:a98fec8761eda0c794ff10d6bf1abdef87e65fe248da55dcb2b937b7b9e24d05
|
||||
pullPolicy: IfNotPresent
|
||||
geoipImage:
|
||||
repository: ghcr.io/maxmind/geoipupdate
|
||||
tag: v6.1.0@sha256:cdd36d36c2e1d353a990a48e5a36d42ee75089d5d9064d80d36d90c147fd2606
|
||||
pullPolicy: IfNotPresent
|
||||
ldapImage:
|
||||
repository: ghcr.io/goauthentik/ldap
|
||||
tag: 2024.2.1@sha256:f0a41b5b1b490405cc351e4c9734caf5cc7b82dbe50e2730ce464be31927fbe2
|
||||
pullPolicy: IfNotPresent
|
||||
radiusImage:
|
||||
repository: ghcr.io/goauthentik/radius
|
||||
tag: 2024.2.1@sha256:6deda767cac2ce9acd9acfb86382f32f9bb23349eab07636f17937fa86a0dee1
|
||||
pullPolicy: IfNotPresent
|
||||
proxyImage:
|
||||
repository: ghcr.io/goauthentik/proxy
|
||||
tag: 2024.2.1@sha256:36b16e5c570edd95280781ad47fe7daef9dff7a52db3d544f78e2321b710f7a7
|
||||
pullPolicy: IfNotPresent
|
||||
authentik:
|
||||
credentials:
|
||||
# Only works on initial install
|
||||
email: my-mail@example.com
|
||||
password: my-password
|
||||
# Optional, only set if you want to use it
|
||||
bootstrapToken: ""
|
||||
general:
|
||||
disableUpdateCheck: false
|
||||
disableStartupAnalytics: true
|
||||
allowUserChangeName: true
|
||||
allowUserChangeEmail: true
|
||||
allowUserChangeUsername: true
|
||||
overwriteDefaultBlueprints: false
|
||||
gdprCompliance: true
|
||||
tokenLength: 128
|
||||
impersonation: true
|
||||
avatars:
|
||||
- gravatar
|
||||
- initials
|
||||
footerLinks:
|
||||
- name: Authentik
|
||||
href: https://goauthentik.io
|
||||
email:
|
||||
host: ""
|
||||
port: 587
|
||||
username:
|
||||
password:
|
||||
useTLS: true
|
||||
useSSL: false
|
||||
timeout: 10
|
||||
from: ""
|
||||
ldap:
|
||||
tlsCiphers: "null"
|
||||
taskTimeoutHours: 2
|
||||
logging:
|
||||
# info, debug, warning, error, trace
|
||||
logLevel: info
|
||||
errorReporting:
|
||||
enabled: false
|
||||
sendPII: false
|
||||
environment: customer
|
||||
sentryDSN: ""
|
||||
geoip:
|
||||
enabled: false
|
||||
# Ignored if enabled is true
|
||||
# If enabled is false, and this is true, the
|
||||
# built-in GeoIP database will be wiped
|
||||
wipeBuiltInDb: false
|
||||
editionID: GeoLite2-City
|
||||
frequency: 8
|
||||
accountID: ""
|
||||
licenseKey: ""
|
||||
outposts:
|
||||
proxy:
|
||||
enabled: false
|
||||
token: ""
|
||||
radius:
|
||||
enabled: false
|
||||
token: ""
|
||||
ldap:
|
||||
enabled: false
|
||||
token: ""
|
||||
# ===== DO NOT EDIT BELOW THIS LINE =====
|
||||
workload:
|
||||
# ===== Server =====
|
||||
main:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
main:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: image
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
# readOnlyRootFilesystem: false
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: server
|
||||
- secretRef:
|
||||
name: server-worker
|
||||
- configMapRef:
|
||||
name: server-worker
|
||||
args:
|
||||
- server
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
# ===== Worker =====
|
||||
worker:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
worker:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: image
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
# readOnlyRootFilesystem: false
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: server-worker
|
||||
- configMapRef:
|
||||
name: server-worker
|
||||
args:
|
||||
- worker
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
# ===== PROXY =====
|
||||
proxy:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
proxy:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: proxyImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: proxy
|
||||
- secretRef:
|
||||
name: proxy
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
# ===== RADIUS =====
|
||||
radius:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
radius:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: radiusImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: radius
|
||||
- secretRef:
|
||||
name: radius
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
# ===== LDAP =====
|
||||
ldap:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
ldap:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: ldapImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: ldap
|
||||
- secretRef:
|
||||
name: ldap
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
# ===== GeoIP Updater =====
|
||||
geoip:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
geoip:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: geoipImage
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
disableS6Caps: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: geoip
|
||||
- secretRef:
|
||||
name: geoip
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
service:
|
||||
# Server HTTPS
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
protocol: https
|
||||
port: 10229
|
||||
# Server HTTP
|
||||
http:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
http:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10230
|
||||
# Proxy
|
||||
proxy:
|
||||
enabled: true
|
||||
targetSelector: proxy
|
||||
ports:
|
||||
http:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10227
|
||||
targetSelector: proxy
|
||||
https:
|
||||
enabled: true
|
||||
protocol: https
|
||||
port: 10228
|
||||
targetSelector: proxy
|
||||
# Radius
|
||||
radius:
|
||||
enabled: true
|
||||
targetSelector: radius
|
||||
ports:
|
||||
radius:
|
||||
enabled: true
|
||||
protocol: udp
|
||||
targetSelector: radius
|
||||
port: 1812
|
||||
# LDAP
|
||||
ldap:
|
||||
enabled: true
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldap:
|
||||
enabled: true
|
||||
port: 389
|
||||
targetSelector: ldap
|
||||
# LDAPS
|
||||
ldaps:
|
||||
enabled: true
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldaps:
|
||||
enabled: true
|
||||
port: 636
|
||||
targetSelector: ldap
|
||||
# Server Metrics
|
||||
servermetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
servermetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10231
|
||||
# Radius Metrics
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: radius
|
||||
ports:
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10232
|
||||
targetSelector: radius
|
||||
# LDAP Metrics
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10233
|
||||
targetSelector: ldap
|
||||
# Proxy Metrics
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: proxy
|
||||
ports:
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10234
|
||||
targetSelector: proxy
|
||||
persistence:
|
||||
media:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /media
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /media
|
||||
templates:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /templates
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /templates
|
||||
blueprints:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
worker:
|
||||
worker:
|
||||
# This will automatically change to `/blueprints`
|
||||
# if `overwriteDefaultBlueprints` is set to `true
|
||||
# Otherwise it will respect the value specified here
|
||||
mountPath: /blueprints/custom
|
||||
certs:
|
||||
enabled: true
|
||||
mountPath: /certs
|
||||
targetSelector:
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /certs
|
||||
geoip:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /geoip
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /geoip
|
||||
geoip:
|
||||
geoip:
|
||||
mountPath: /usr/share/GeoIP
|
||||
cnpg:
|
||||
main:
|
||||
enabled: true
|
||||
user: authentik
|
||||
database: authentik
|
||||
redis:
|
||||
enabled: true
|
||||
portal:
|
||||
open:
|
||||
enabled: true
|
||||
metrics:
|
||||
# FIXME: Metrics do not work yet
|
||||
servermetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.servermetrics.ports.servermetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.radiusmetrics.ports.radiusmetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.ldapmetrics.ports.ldapmetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.proxymetrics.ports.proxymetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
updated: true
|
||||
|
||||
ingress:
|
||||
main:
|
||||
required: true
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
|
|
@ -0,0 +1,128 @@
|
|||
{{/* Define the configmaps */}}
|
||||
{{- define "authentik.configmaps" -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
{{- $serverHost := printf "https://%v:%v" $fullname .Values.service.main.ports.main.port -}}
|
||||
{{- $host := .Values.chartContext.appUrl }}
|
||||
server:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.main.ports.main.port | quote }}
|
||||
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.http.ports.http.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.servermetrics.ports.servermetrics.port | quote }}
|
||||
|
||||
server-worker:
|
||||
enabled: true
|
||||
data:
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_POSTGRESQL__NAME: {{ .Values.cnpg.main.database }}
|
||||
AUTHENTIK_POSTGRESQL__USER: {{ .Values.cnpg.main.user }}
|
||||
AUTHENTIK_POSTGRESQL__HOST: {{ .Values.cnpg.main.creds.host }}
|
||||
AUTHENTIK_POSTGRESQL__PORT: "5432"
|
||||
AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }}
|
||||
AUTHENTIK_REDIS__PORT: "6379"
|
||||
|
||||
{{/* Outposts */}}
|
||||
AUTHENTIK_OUTPOSTS__DISCOVER: "false"
|
||||
|
||||
{{/* GeoIP */}}
|
||||
{{- $geoipPath := (printf "/geoip/%v.mmdb" .Values.authentik.geoip.editionID) -}}
|
||||
{{- if not .Values.authentik.geoip.enabled -}}
|
||||
{{- $geoipPath = "/tmp/non-existent-file" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb }}
|
||||
AUTHENTIK_GEOIP: {{ $geoipPath }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Mail */}}
|
||||
AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.email.useTLS | quote }}
|
||||
AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.email.useSSL | quote }}
|
||||
{{- with .Values.authentik.email.port }}
|
||||
AUTHENTIK_EMAIL__PORT: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.timeout }}
|
||||
AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* LDAP */}}
|
||||
AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS: {{ .Values.authentik.ldap.taskTimeoutHours | quote }}
|
||||
AUTHENTIK_LDAP__TLS__CIPHERS: {{ .Values.authentik.ldap.tlsCiphers | quote }}
|
||||
|
||||
{{/* Logging */}}
|
||||
AUTHENTIK_LOG_LEVEL: {{ .Values.authentik.logging.logLevel }}
|
||||
|
||||
{{/* Error Reporting */}}
|
||||
AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.errorReporting.enabled | quote }}
|
||||
AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.errorReporting.sendPII | quote }}
|
||||
{{- with .Values.authentik.errorReporting.environment }}
|
||||
AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.errorReporting.sentryDSN }}
|
||||
AUTHENTIK_ERROR_REPORTING__SENTRY_DSN: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.general.avatars }}
|
||||
AUTHENTIK_AVATARS: {{ join "," . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.general.footerLinks }}
|
||||
AUTHENTIK_FOOTER_LINKS: {{ toJson . | squote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* General */}}
|
||||
AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disableUpdateCheck | quote }}
|
||||
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disableStartupAnalytics | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allowUserChangeName | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allowUserChangeEmail | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allowUserChangeUsername | quote }}
|
||||
AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdprCompliance | quote }}
|
||||
AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.tokenLength | quote }}
|
||||
AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||
proxy:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.http.port | quote }}
|
||||
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.https.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.proxymetrics.ports.proxymetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||
radius:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__RADIUS: {{ printf "0.0.0.0:%v" .Values.service.radius.ports.radius.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.radiusmetrics.ports.radiusmetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||
ldap:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__LDAP: {{ printf "0.0.0.0:%v" .Values.service.ldap.ports.ldap.port | quote }}
|
||||
AUTHENTIK_LISTEN__LDAPS: {{ printf "0.0.0.0:%v" .Values.service.ldaps.ports.ldaps.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.ldapmetrics.ports.ldapmetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled }}
|
||||
geoip:
|
||||
enabled: true
|
||||
data:
|
||||
GEOIPUPDATE_EDITION_IDS: {{ .Values.authentik.geoip.editionID }}
|
||||
GEOIPUPDATE_FREQUENCY: {{ .Values.authentik.geoip.frequency | quote }}
|
||||
GEOIPUPDATE_DB_DIR: {{ .Values.persistence.geoip.targetSelector.geoip.geoip.mountPath | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
{{/* Define the secrets */}}
|
||||
{{- define "authentik.secrets" -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
{{- $fetchname := printf "%v-server-worker" $fullname -}}
|
||||
|
||||
{{- $secretKey := randAlphaNum 32 -}}
|
||||
{{- with (lookup "v1" "Secret" .Release.Namespace $fetchname) -}}
|
||||
{{- $secretKey = index .data "AUTHENTIK_SECRET_KEY" | b64dec -}}
|
||||
{{- end }}
|
||||
|
||||
server-worker:
|
||||
enabled: true
|
||||
data:
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||
AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||
|
||||
{{/* Secret Key */}}
|
||||
AUTHENTIK_SECRET_KEY: {{ $secretKey }}
|
||||
|
||||
{{/* Initial credentials */}}
|
||||
AUTHENTIK_BOOTSTRAP_EMAIL: {{ .Values.authentik.credentials.email | quote }}
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: {{ .Values.authentik.credentials.password | quote }}
|
||||
{{- with .Values.authentik.credentials.bootstrapToken }}
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: {{ . }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Mail */}}
|
||||
{{- with .Values.authentik.email.host }}
|
||||
AUTHENTIK_EMAIL__HOST: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.username }}
|
||||
AUTHENTIK_EMAIL__USERNAME: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.password }}
|
||||
AUTHENTIK_EMAIL__PASSWORD: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.from }}
|
||||
AUTHENTIK_EMAIL__FROM: {{ . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled }}
|
||||
geoip:
|
||||
enabled: true
|
||||
data:
|
||||
GEOIPUPDATE_VERBOSE: "0"
|
||||
GEOIPUPDATE_PRESERVE_FILE_TIMES: "1"
|
||||
GEOIPUPDATE_ACCOUNT_ID: {{ .Values.authentik.geoip.accountID | quote }}
|
||||
GEOIPUPDATE_LICENSE_KEY: {{ .Values.authentik.geoip.licenseKey | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||
proxy:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.proxy.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||
radius:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.radius.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||
ldap:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.ldap.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{- define "authentik.validation" -}}
|
||||
{{- range $outpost, $values := .Values.authentik.outposts -}}
|
||||
{{- if (kindIs "dict" $values) -}}
|
||||
{{- if and $values.enabled (not $values.token) -}}
|
||||
{{- fail (printf "Authentik - Outpost [%v] is enabled, but [token] was not provided" ($outpost | upper)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled -}}
|
||||
{{- if not .Values.authentik.geoip.accountID -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [accountID] was not provided" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not .Values.authentik.geoip.licenseKey -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [licenseKey] was not provided" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if contains " " .Values.authentik.geoip.editionID -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [editionID] cannot contain spaces" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{{- define "authentik.wait.server" -}}
|
||||
{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}}
|
||||
{{- $serverUrl := printf "https://%v:%v/-/health/ready/" $fullname .Values.service.main.ports.main.port }}
|
||||
enabled: true
|
||||
type: init
|
||||
imageSelector: alpineImage
|
||||
command: /bin/sh
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||
until wget --no-check-certificate --spider --quiet "{{ $serverUrl }}";
|
||||
do
|
||||
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||
sleep 3
|
||||
done
|
||||
|
||||
echo "Authentik [{{ $serverUrl }}] is ready..."
|
||||
echo "Starting Outpost..."
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . }}
|
||||
|
||||
{{- include "authentik.validation" $ -}}
|
||||
|
||||
{{/* Render secrets for authentik and friends */}}
|
||||
{{- $secrets := include "authentik.secrets" . | fromYaml -}}
|
||||
{{- if $secrets -}}
|
||||
{{ $secrets := (mustMergeOverwrite .Values.secret $secrets) }}
|
||||
{{- $_ := set .Values "secret" $secrets -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render configmaps for authentik and friends */}}
|
||||
{{- $configmaps := include "authentik.configmaps" . | fromYaml -}}
|
||||
{{- if $configmaps -}}
|
||||
{{ $configmaps := (mustMergeOverwrite .Values.configmap $configmaps) }}
|
||||
{{- $_ := set .Values "configmap" $configmaps -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.general.overwriteDefaultBlueprints -}}
|
||||
{{- $_ := set .Values.persistence.blueprints.targetSelector.worker.worker "mountPath" "/blueprints" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled -}}
|
||||
{{- $_ := set .Values.workload.geoip "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.geoip "enabled" false -}}
|
||||
{{- $_ := set .Values.persistence.geoip "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb -}}
|
||||
{{- $_ := set .Values.persistence.geoip "enabled" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled -}}
|
||||
{{- $_ := set .Values.workload.proxy "enabled" true -}}
|
||||
{{- if not .Values.workload.proxy.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.proxy.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.proxy.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.proxy "enabled" true -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.proxy "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxy "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled -}}
|
||||
{{- $_ := set .Values.workload.radius "enabled" true -}}
|
||||
{{- if not .Values.workload.radius.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.radius.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.radius.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.radius "enabled" true -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.radius "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radius "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled -}}
|
||||
{{- $_ := set .Values.workload.ldap "enabled" true -}}
|
||||
{{- if not .Values.workload.ldap.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.ldap.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.ldap.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.ldap "enabled" true -}}
|
||||
{{- $_ := set .Values.service.ldaps "enabled" true -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.ldap "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldap "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldaps "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* FIXME: See values.yaml */}}
|
||||
{{- $_ := set .Values.service.servermetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||
|
||||
{{- $_ := set .Values.metrics.servermetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.v1.common.loader.apply" . }}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue