From 8bea30ce55c89016feadb069f6b114895da84ee0 Mon Sep 17 00:00:00 2001
From: JamesTurland <james@turland.uk>
Date: Fri, 31 Jul 2026 13:03:52 +0100
Subject: [PATCH] authentik-kubernetes

---
 Kubernetes/Authentik/authentikService.yaml | 21 ++++++
 Kubernetes/Authentik/default-headers.yaml  | 16 +++++
 Kubernetes/Authentik/ingress.yaml          | 26 +++++++
 Kubernetes/Authentik/readme.md             | 84 ++++++++++++++++++++++
 Kubernetes/Authentik/values.yaml           | 21 ++++++
 5 files changed, 168 insertions(+)
 create mode 100644 Kubernetes/Authentik/authentikService.yaml
 create mode 100644 Kubernetes/Authentik/default-headers.yaml
 create mode 100644 Kubernetes/Authentik/ingress.yaml
 create mode 100644 Kubernetes/Authentik/readme.md
 create mode 100644 Kubernetes/Authentik/values.yaml

diff --git a/Kubernetes/Authentik/authentikService.yaml b/Kubernetes/Authentik/authentikService.yaml
new file mode 100644
index 0000000..8acd0ff
--- /dev/null
+++ b/Kubernetes/Authentik/authentikService.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-service
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+spec:
+  # type: LoadBalancer # not needed as we are using ingress
+  selector:
+    app.kubernetes.io/name: authentik
+  ports:
+    - name: http
+      protocol: TCP
+      port: 9000
+      targetPort: 9000
+    - name: https
+      protocol: TCP
+      port: 9443
+      targetPort: 9443
\ No newline at end of file
diff --git a/Kubernetes/Authentik/default-headers.yaml b/Kubernetes/Authentik/default-headers.yaml
new file mode 100644
index 0000000..3ceeb1d
--- /dev/null
+++ b/Kubernetes/Authentik/default-headers.yaml
@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: default-headers
+  namespace: authentik
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    forceSTSHeader: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 15552000
+    customFrameOptionsValue: SAMEORIGIN
+    customRequestHeaders:
+      X-Forwarded-Proto: https
\ No newline at end of file
diff --git a/Kubernetes/Authentik/ingress.yaml b/Kubernetes/Authentik/ingress.yaml
new file mode 100644
index 0000000..02bb285
--- /dev/null
+++ b/Kubernetes/Authentik/ingress.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik
+  namespace: authentik
+  annotations: 
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`www.authentik.jimsgarage.co.uk`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9000
+    - match: Host(`authentik.jimsgarage.co.uk`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9443
+      middlewares:
+        - name: default-headers
+  tls:
+    secretName: jimsgarage-tls
diff --git a/Kubernetes/Authentik/readme.md b/Kubernetes/Authentik/readme.md
new file mode 100644
index 0000000..c4042d3
--- /dev/null
+++ b/Kubernetes/Authentik/readme.md
@@ -0,0 +1,84 @@
+
+# Instructions Used In Video
+
+  
+
+## K3S
+
+  
+
+bootstrap first node:
+
+    curl -sfL https://get.k3s.io | sh -
+
+  
+
+add agents:
+
+    curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -
+
+  
+
+## Helm
+
+    curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
+    
+    chmod 700 get_helm.sh
+    
+    ./get_helm.sh
+
+  
+
+## Metallb
+
+    helm repo add metallb https://metallb.github.io/metallb
+    
+    helm install metallb metallb/metallb
+
+  
+
+### then edit and apply the manifests:
+
+  
+
+    kubectl apply -f ....
+
+  
+
+## Authentik
+
+create passwords:
+
+  
+
+    pwgen -s 50 1
+    
+    openssl rand 60 | base64 -w 0
+
+  
+
+ set values in values.yaml - see example
+
+  
+
+    nano values.yaml
+
+  
+
+deploy authentik:
+
+  
+
+    helm repo add authentik https://charts.goauthentik.io
+    
+    helm repo update
+    
+    helm upgrade --install authentik authentik/authentik -f values.yaml
+
+  
+
+edit for Traefik proxy using files
+
+  
+
+    kubectl apply -f ...
diff --git a/Kubernetes/Authentik/values.yaml b/Kubernetes/Authentik/values.yaml
new file mode 100644
index 0000000..024a300
--- /dev/null
+++ b/Kubernetes/Authentik/values.yaml
@@ -0,0 +1,21 @@
+authentik:
+    secret_key: "29EbOIpe7UWE07C7V2nNTRjQNIWUqow13pL8WHKCPqPWdDKZ8ZyANAzSbRKD63bOIywOkzcDUysQuxLD"
+    # This sends anonymous usage-data, stack traces on errors and
+    # performance data to sentry.io, and is fully opt-in
+    error_reporting:
+        enabled: true
+    postgresql:
+        password: "rz6ze9q2N7YXXYKAQsKvD8AC8gxWImYC1KeVpH6FgADgSXCO0M"
+
+server:
+    ingress:
+        # Specify kubernetes ingress controller class name
+        ingressClassName: traefik
+        enabled: true
+        hosts:
+            - authentik.jimsgarage.co.uk
+
+postgresql:
+    enabled: true
+    auth:
+        password: "rz6ze9q2N7YXXYKAQsKvD8AC8gxWImYC1KeVpH6FgADgSXCO0M"
\ No newline at end of file