helm-release.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
  name: authentik
  namespace: auth
spec:
  interval: 5m
  chart:
    spec:
      # renovate: registryUrl=https://charts.goauthentik.io/
      chart: authentik
      version: 2024.4.1
      sourceRef:
        kind: HelmRepository
        name: authentik-charts
        namespace: flux-system

  dependsOn:
    - name: cert-manager
      namespace: cert-manager
    - name: authentik-redis
      namespace: auth

  install:
    remediation:
      retries: 4
  upgrade:
    remediation:
      retries: 5
      remediateLastFailure: false

  values:
    global:
      fullnameOverride: authentik
      image:
        repository: ghcr.io/goauthentik/server
        # tag: 2023.6.1 # default follows chart version
        # repository: ghcr.io/goauthentik/dev-server
        # tag: gh-providers-proxy-rework-endpoints-1679090841-c08a9a2
      revisionHistoryLimit: 3
      volumeMounts:
        - name: background-image-1
          mountPath: /media/sound_wave.svg
          readOnly: true
        - name: cluster-domain-cert
          mountPath: /certs/cluster-domain-cert
          readOnly: true
        #- name: spiffe
        # mountPath: /certs/spiffe
        # readOnly: true
      volumes:
        #- name: spiffe
      #   csi:
      #     driver: spiffe.csi.cert-manager.io
      #     readOnly: true
        - name: cluster-domain-cert
          secret:
            secretName: tls.${XYZ_DOMAIN/./-}
            optional: false # default setting; "mysecret" must exist
            items:
              - key: tls.crt
                path: fullchain.pem
              - key: tls.key
                path: privkey.pem
        - name: background-image-1
          projected:
            defaultMode: 0775
            sources:
              - configMap:
                  name: background-image-1
                  items:
                    - key: sound_wave.svg
                      path: sound_wave.svg
      podLabels:
        spiffe.bloopysphere.arpa/enabled: "true"
      # The redis sub-chart does not have arm support
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 60
              preference:
                matchExpressions:
                  - key: kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
                      - i386
                      - i686
                      - x86

    geoip:
      enabled: true
      existingSecret:
        secretName: geoip-secrets
        accountId: maxmindAccountId
        licenseKey: maxmindLicenseKey

    authentik:
      log_level: info
      outposts:
        # container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
        container_image_base: ghcr.io/goauthentik/%(type)s:%(version)s
      secret_key: "${SECRET_AUTHENTIK_SECRET_KEY}"
      postgresql:
        host: "authentik-postgres"
        name: "authentik"
        user: "authentik"
        password: "${SECRET_AUTHENTIK_POSTGRES_PASSWORD}"
        s3_backup:
          access_key: "${AUTHENTIK_S3_ACCESS_KEY}"
          bucket: "authentik-postgresql-backup"
          secret_key: "${AUTHENTIK_S3_SECRET}"
          host: http://s3.minio.storage
      redis:
        host: "authentik-redis-headless.auth.svc.cluster.local"
        password: ${AUTHENTIK_REDIS_PASSWORD}
      email:
        host: "smtp.sendgrid.net"
        port: 587
        use_tls: true
        username: "apikey"
        password: "${SECRET_SENDGRID_API_KEY}"
        from: "no-reply@${XYZ_DOMAIN}"
    # service:
    #   type: ClusterIP
    #   externalTrafficPolicy: Local
    server:
      metrics:
        serviceMonitor:
          create: true
      ingress:
        enabled: true
        ingressClassName: "traefik"
        annotations:
          gatus.io/enabled: "true"
          hajimari.io/enable: "true"
          hajimari.io/icon: "account-lock-outline"
          hajimari.io/instance: "bloop-xyz,bloop-quarky"
          hajimari.io/appName: "Login Settings"
          hajimari.io/url: "https://auth.${XYZ_DOMAIN}"
          cert-manager.io/cluster-issuer: "letsencrypt-production"
          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          coredns.io/hostname: "auth.${XYZ_DOMAIN}"
          traefik.ingress.kubernetes.io/router.middlewares: "networking-chain-no-auth@kubernetescrd"
          # traefik.ingress.kubernetes.io/router.priority: "10"
          external-dns.home.arpa/enabled: "true"
          external-dns.target/enabled: "true"
        # The chart broke this standard ingress schema into it's own version making separate host paths impossible via the chart
        hosts:
          - &host "auth.${XYZ_DOMAIN}"
          - &bloop "auth.${SECRET_DOMAIN}"
        paths:
          - "/"
        pathType: Prefix
        tls:
          - hosts:
              - *host
              - *bloop
            secretName: "tls.authentik"

    postgresql:
      enabled: false
    redis:
      enabled: false
    prometheus:
      rules:
        enabled: true

    worker:
      replicas: 2

    serviceAccount:
      # -- Service account is needed for managed outposts
      create: true
      annotations: {}
      serviceAccountSecret:
        # -- As we use the authentik-remote-cluster chart as subchart, and that chart
        # creates a service account secret by default which we don't need here, disable its creation
        enabled: false
      fullnameOverride: authentik
      nameOverride: authentik