Thore CimbalandClaude Sonnet 5
2c5f77686d
Closes issue #37. The Bitnami postgresql subchart's auto-generated NetworkPolicy restricted the port (5432) but not the source - any pod in any namespace could reach it, since additive NetworkPolicy rules can't restrict an existing permissive one, only the chart itself controls it (hence not touched during the original #10 rollout). Disabled via postgresql.primary.networkPolicy.enabled: false and replaced with a scoped policy allowing only authentik-server and authentik-worker (same namespace) on 5432, matching the pattern already used for the matrix namespace's postgres access. No metrics exporter is enabled for this instance, so no monitoring-namespace rule is needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
106 lines
2.5 KiB
YAML
106 lines
2.5 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: authentik
|
|
version: "2026.2.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: goauthentik
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
valuesFrom:
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: secret_key
|
|
targetPath: authentik.secret_key
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: authentik.postgresql.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: pg-password
|
|
targetPath: postgresql.auth.password
|
|
- kind: Secret
|
|
name: authentik-credentials
|
|
valuesKey: smtp-password
|
|
targetPath: authentik.email.password
|
|
values:
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
# Read by the matrix-oidc-provider blueprint via !Env, so the OAuth2
|
|
# Provider's client_secret can be captured as code without ever
|
|
# inlining the live credential into a plain (non-SOPS) ConfigMap.
|
|
env:
|
|
- name: AUTHENTIK_MAS_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: authentik-credentials
|
|
key: mas-oidc-client-secret
|
|
|
|
authentik:
|
|
log_level: info
|
|
error_reporting:
|
|
enabled: false
|
|
email:
|
|
host: smtp.ionos.de
|
|
port: 587
|
|
username: gamemaster@axion1337.chat
|
|
use_tls: true
|
|
from: "Authentik <gamemaster@axion1337.chat>"
|
|
|
|
blueprints:
|
|
configMaps:
|
|
- authentik-blueprints
|
|
|
|
server:
|
|
ingress:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
username: authentik
|
|
database: authentik
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 8Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
# Chart's own generated policy allows ANY pod in ANY namespace on 5432
|
|
# (see issue #37) - disabled in favor of our own scoped policy in
|
|
# apps/authentik/networkpolicy.yaml.
|
|
networkPolicy:
|
|
enabled: false
|