chore(authentik): switch cache backend to dragonfly

[martinohmann]

Closes #670

[github-actions]

kustomization changes in kubernetes/main

--- kubernetes/main/apps/identity/authentik/app Kustomization: flux-system/authentik HelmRelease: identity/authentik

+++ kubernetes/main/apps/identity/authentik/app Kustomization: flux-system/authentik HelmRelease: identity/authentik

@@ -25,47 +25,21 @@

         host: smtp-relay.default.svc.cluster.local
         port: 25
       error_reporting:
         enabled: false
       footer_links: '[]'
       log_level: debug
+      redis:
+        db: 2
+        host: dragonfly.database.svc.cluster.local
+        port: 6379
     prometheus:
       rules:
         enabled: true
     redis:
-      auth:
-        enabled: true
-      commonConfiguration: |-
-        # Enable AOF https://redis.io/topics/persistence#append-only-file
-        appendonly yes
-        # Disable RDB persistence, AOF persistence already enabled.
-        save ""
-        maxmemory 94371840
-        maxmemory-policy allkeys-lru
-      enabled: true
-      master:
-        persistence:
-          enabled: true
-          size: 1Gi
-          storageClass: longhorn
-        resources:
-          limits:
-            memory: 60Mi
-          requests:
-            cpu: 15m
-            memory: 20Mi
-      metrics:
-        enabled: true
-        resources:
-          limits:
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 10Mi
-        serviceMonitor:
-          enabled: true
+      enabled: false
     server:
       annotations:
         secret.reloader.stakater.com/reload: authentik-secret
       ingress:
         annotations:
           gethomepage.dev/enabled: 'true'
@@ -117,16 +91,12 @@

   - kind: Secret
     name: authentik-secret
     targetPath: authentik.redis.password
     valuesKey: REDIS_PASSWORD
   - kind: Secret
     name: authentik-secret
-    targetPath: redis.auth.password
-    valuesKey: REDIS_PASSWORD
-  - kind: Secret
-    name: authentik-secret
     targetPath: authentik.postgresql.host
     valuesKey: INIT_POSTGRES_HOST
   - kind: Secret
     name: authentik-secret
     targetPath: authentik.postgresql.user
     valuesKey: INIT_POSTGRES_USER

[github-actions]

helmrelease changes in kubernetes/main

--- HelmRelease: identity/authentik ServiceAccount: identity/authentik-redis

+++ HelmRelease: identity/authentik ServiceAccount: identity/authentik-redis

@@ -1,12 +0,0 @@

----
-apiVersion: v1
-kind: ServiceAccount
-automountServiceAccountToken: true
-metadata:
-  name: authentik-redis
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-configuration

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-configuration

@@ -1,33 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-redis-configuration
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-data:
-  redis.conf: |-
-    # User-supplied common configuration:
-    # Enable AOF https://redis.io/topics/persistence#append-only-file
-    appendonly yes
-    # Disable RDB persistence, AOF persistence already enabled.
-    save ""
-    maxmemory 94371840
-    maxmemory-policy allkeys-lru
-    # End of common configuration
-  master.conf: |-
-    dir /data
-    # User-supplied master configuration:
-    rename-command FLUSHDB ""
-    rename-command FLUSHALL ""
-    # End of master configuration
-  replica.conf: |-
-    dir /data
-    # User-supplied replica configuration:
-    rename-command FLUSHDB ""
-    rename-command FLUSHALL ""
-    # End of replica configuration
-
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-health

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-health

@@ -1,106 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-redis-health
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-data:
-  ping_readiness_local.sh: |-
-    #!/bin/bash
-
-    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
-    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
-    response=$(
-      timeout -s 15 $1 \
-      redis-cli \
-        -h localhost \
-        -p $REDIS_PORT \
-        ping
-    )
-    if [ "$?" -eq "124" ]; then
-      echo "Timed out"
-      exit 1
-    fi
-    if [ "$response" != "PONG" ]; then
-      echo "$response"
-      exit 1
-    fi
-  ping_liveness_local.sh: |-
-    #!/bin/bash
-
-    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
-    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
-    response=$(
-      timeout -s 15 $1 \
-      redis-cli \
-        -h localhost \
-        -p $REDIS_PORT \
-        ping
-    )
-    if [ "$?" -eq "124" ]; then
-      echo "Timed out"
-      exit 1
-    fi
-    responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
-    if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
-      echo "$response"
-      exit 1
-    fi
-  ping_readiness_master.sh: |-
-    #!/bin/bash
-
-    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
-    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
-    response=$(
-      timeout -s 15 $1 \
-      redis-cli \
-        -h $REDIS_MASTER_HOST \
-        -p $REDIS_MASTER_PORT_NUMBER \
-        ping
-    )
-    if [ "$?" -eq "124" ]; then
-      echo "Timed out"
-      exit 1
-    fi
-    if [ "$response" != "PONG" ]; then
-      echo "$response"
-      exit 1
-    fi
-  ping_liveness_master.sh: |-
-    #!/bin/bash
-
-    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
-    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
-    response=$(
-      timeout -s 15 $1 \
-      redis-cli \
-        -h $REDIS_MASTER_HOST \
-        -p $REDIS_MASTER_PORT_NUMBER \
-        ping
-    )
-    if [ "$?" -eq "124" ]; then
-      echo "Timed out"
-      exit 1
-    fi
-    responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
-    if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
-      echo "$response"
-      exit 1
-    fi
-  ping_readiness_local_and_master.sh: |-
-    script_dir="$(dirname "$0")"
-    exit_status=0
-    "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
-    "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
-    exit $exit_status
-  ping_liveness_local_and_master.sh: |-
-    script_dir="$(dirname "$0")"
-    exit_status=0
-    "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
-    "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
-    exit $exit_status
-
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-scripts

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-scripts

@@ -1,28 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-redis-scripts
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-data:
-  start-master.sh: |
-    #!/bin/bash
-
-    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
-    if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then
-        cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
-    fi
-    if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then
-        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
-    fi
-    ARGS=("--port" "${REDIS_PORT}")
-    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
-    ARGS+=("--masterauth" "${REDIS_PASSWORD}")
-    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
-    ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
-    exec redis-server "${ARGS[@]}"
-
--- HelmRelease: identity/authentik Service: identity/authentik-redis-headless

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-headless

@@ -1,21 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-redis-headless
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-  - name: tcp-redis
-    port: 6379
-    targetPort: redis
-  selector:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/name: redis
-
--- HelmRelease: identity/authentik Service: identity/authentik-redis-master

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-master

@@ -1,25 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-redis-master
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: master
-spec:
-  type: ClusterIP
-  internalTrafficPolicy: Cluster
-  sessionAffinity: None
-  ports:
-  - name: tcp-redis
-    port: 6379
-    targetPort: redis
-    nodePort: null
-  selector:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: master
-
--- HelmRelease: identity/authentik Service: identity/authentik-redis-metrics

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-metrics

@@ -1,22 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-redis-metrics
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: metrics
-spec:
-  type: ClusterIP
-  ports:
-  - name: http-metrics
-    port: 9121
-    protocol: TCP
-    targetPort: metrics
-  selector:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/name: redis
-
--- HelmRelease: identity/authentik Deployment: identity/authentik-server

+++ HelmRelease: identity/authentik Deployment: identity/authentik-server

@@ -24,13 +24,13 @@

         app.kubernetes.io/name: authentik
         app.kubernetes.io/instance: authentik
         app.kubernetes.io/component: server
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: authentik
       annotations:
-        checksum/secret: 868a38e10ac980a2d4ed9e91e6409fb15c6891ecf099bc1aa3ea32633acdb7af
+        checksum/secret: 88ac6e8e03d2661a916fdb1d28f6dbec3921d83cda4e525d3fe7018c7e69b93c
     spec:
       terminationGracePeriodSeconds: 30
       initContainers:
       - envFrom:
         - secretRef:
             name: authentik-secret
--- HelmRelease: identity/authentik Deployment: identity/authentik-worker

+++ HelmRelease: identity/authentik Deployment: identity/authentik-worker

@@ -24,13 +24,13 @@

         app.kubernetes.io/name: authentik
         app.kubernetes.io/instance: authentik
         app.kubernetes.io/component: worker
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: authentik
       annotations:
-        checksum/secret: 868a38e10ac980a2d4ed9e91e6409fb15c6891ecf099bc1aa3ea32633acdb7af
+        checksum/secret: 88ac6e8e03d2661a916fdb1d28f6dbec3921d83cda4e525d3fe7018c7e69b93c
     spec:
       serviceAccountName: authentik
       terminationGracePeriodSeconds: 30
       containers:
       - name: worker
         image: ghcr.io/goauthentik/server:2024.4.2
--- HelmRelease: identity/authentik StatefulSet: identity/authentik-redis-master

+++ HelmRelease: identity/authentik StatefulSet: identity/authentik-redis-master

@@ -1,225 +0,0 @@

----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: authentik-redis-master
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: master
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: authentik
-      app.kubernetes.io/name: redis
-      app.kubernetes.io/component: master
-  serviceName: authentik-redis-headless
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: authentik
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: redis
-        app.kubernetes.io/component: master
-      annotations:
-        checksum/configmap: c9fd214201f2986af7149b259d78bd3304f9cbe2fa205de90d966c7ae5ecab82
-        checksum/health: aff24913d801436ea469d8d374b2ddb3ec4c43ee7ab24663d5f8ff1a1b6991a9
-        checksum/scripts: 560c33ff34d845009b51830c332aa05fa211444d1877d3526d3599be7543aaa5
-        checksum/secret: f82c9fbdba8afdb7e9fe906fafe4a4673e86c124ea40d3960f49e19a5af15efa
-        prometheus.io/port: '9121'
-        prometheus.io/scrape: 'true'
-    spec:
-      securityContext:
-        fsGroup: 1001
-      serviceAccountName: authentik-redis
-      automountServiceAccountToken: true
-      affinity:
-        podAffinity: null
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchLabels:
-                  app.kubernetes.io/instance: authentik
-                  app.kubernetes.io/name: redis
-                  app.kubernetes.io/component: master
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-        nodeAffinity: null
-      enableServiceLinks: true
-      terminationGracePeriodSeconds: 30
-      containers:
-      - name: redis
-        image: registry-1.docker.io/bitnami/redis:7.2.3-debian-11-r2
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          runAsGroup: 0
-          runAsNonRoot: true
-          runAsUser: 1001
-          seccompProfile:
-            type: RuntimeDefault
-        command:
-        - /bin/bash
-        args:
-        - -c
-        - /opt/bitnami/scripts/start-scripts/start-master.sh
-        env:
-        - name: BITNAMI_DEBUG
-          value: 'false'
-        - name: REDIS_REPLICATION_MODE
-          value: master
-        - name: ALLOW_EMPTY_PASSWORD
-          value: 'no'
-        - name: REDIS_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: authentik-redis
-              key: redis-password
-        - name: REDIS_TLS_ENABLED
-          value: 'no'
-        - name: REDIS_PORT
-          value: '6379'
-        ports:
-        - name: redis
-          containerPort: 6379
-        livenessProbe:
-          initialDelaySeconds: 20
-          periodSeconds: 5
-          timeoutSeconds: 6
-          successThreshold: 1
-          failureThreshold: 5
-          exec:
-            command:
-            - sh
-            - -c
-            - /health/ping_liveness_local.sh 5
-        readinessProbe:
-          initialDelaySeconds: 20
-          periodSeconds: 5
-          timeoutSeconds: 2
-          successThreshold: 1
-          failureThreshold: 5
-          exec:
-            command:
-            - sh
-            - -c
-            - /health/ping_readiness_local.sh 1
-        resources:
-          limits:
-            memory: 60Mi
-          requests:
-            cpu: 15m
-            memory: 20Mi
-        volumeMounts:
-        - name: start-scripts
-          mountPath: /opt/bitnami/scripts/start-scripts
-        - name: health
-          mountPath: /health
-        - name: redis-data
-          mountPath: /data
-        - name: config
-          mountPath: /opt/bitnami/redis/mounted-etc
-        - name: redis-tmp-conf
-          mountPath: /opt/bitnami/redis/etc/
-        - name: tmp
-          mountPath: /tmp
-      - name: metrics
-        image: registry-1.docker.io/bitnami/redis-exporter:1.55.0-debian-11-r3
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          runAsGroup: 0
-          runAsNonRoot: true
-          runAsUser: 1001
-          seccompProfile:
-            type: RuntimeDefault
-        command:
-        - /bin/bash
-        - -c
-        - |
-          if [[ -f '/secrets/redis-password' ]]; then
-          export REDIS_PASSWORD=$(cat /secrets/redis-password)
-          fi
-          redis_exporter
-        env:
-        - name: REDIS_ALIAS
-          value: authentik-redis
-        - name: REDIS_USER
-          value: default
-        - name: REDIS_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: authentik-redis
-              key: redis-password
-        ports:
-        - name: metrics
-          containerPort: 9121
-        livenessProbe:
-          failureThreshold: 5
-          initialDelaySeconds: 10
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 5
-          tcpSocket:
-            port: metrics
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 5
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-          httpGet:
-            path: /
-            port: metrics
-        resources:
-          limits:
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 10Mi
-        volumeMounts: null
-      volumes:
-      - name: start-scripts
-        configMap:
-          name: authentik-redis-scripts
-          defaultMode: 493
-      - name: health
-        configMap:
-          name: authentik-redis-health
-          defaultMode: 493
-      - name: config
-        configMap:
-          name: authentik-redis-configuration
-      - name: redis-tmp-conf
-        emptyDir: {}
-      - name: tmp
-        emptyDir: {}
-  volumeClaimTemplates:
-  - apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: redis-data
-      labels:
-        app.kubernetes.io/instance: authentik
-        app.kubernetes.io/name: redis
-        app.kubernetes.io/component: master
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 1Gi
-      storageClassName: longhorn
-
--- HelmRelease: identity/authentik ServiceMonitor: identity/authentik-redis

+++ HelmRelease: identity/authentik ServiceMonitor: identity/authentik-redis

@@ -1,23 +0,0 @@

----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik-redis
-  namespace: identity
-  labels:
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-spec:
-  endpoints:
-  - port: http-metrics
-    interval: 30s
-  namespaceSelector:
-    matchNames:
-    - identity
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: authentik
-      app.kubernetes.io/name: redis
-      app.kubernetes.io/component: metrics
-