authentik-kubernetes

Kubernetes/Authentik/authentikService.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-service
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+spec:
+  # type: LoadBalancer # not needed as we are using ingress
+  selector:
+    app.kubernetes.io/name: authentik
+  ports:
+    - name: http
+      protocol: TCP
+      port: 9000
+      targetPort: 9000
+    - name: https
+      protocol: TCP
+      port: 9443
+      targetPort: 9443

Kubernetes/Authentik/default-headers.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: default-headers
+  namespace: authentik
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    forceSTSHeader: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 15552000
+    customFrameOptionsValue: SAMEORIGIN
+    customRequestHeaders:
+      X-Forwarded-Proto: https

Kubernetes/Authentik/ingress.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik
+  namespace: authentik
+  annotations: 
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`www.authentik.jimsgarage.co.uk`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9000
+    - match: Host(`authentik.jimsgarage.co.uk`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9443
+      middlewares:
+        - name: default-headers
+  tls:
+    secretName: jimsgarage-tls

Kubernetes/Authentik/readme.md

@@ -0,0 +1,84 @@
+
+# Instructions Used In Video
+
+  
+
+## K3S
+
+  
+
+bootstrap first node:
+
+    curl -sfL https://get.k3s.io | sh -
+
+  
+
+add agents:
+
+    curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -
+
+  
+
+## Helm
+
+    curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
+    
+    chmod 700 get_helm.sh
+    
+    ./get_helm.sh
+
+  
+
+## Metallb
+
+    helm repo add metallb https://metallb.github.io/metallb
+    
+    helm install metallb metallb/metallb
+
+  
+
+### then edit and apply the manifests:
+
+  
+
+    kubectl apply -f ....
+
+  
+
+## Authentik
+
+create passwords:
+
+  
+
+    pwgen -s 50 1
+    
+    openssl rand 60 | base64 -w 0
+
+  
+
+ set values in values.yaml - see example
+
+  
+
+    nano values.yaml
+
+  
+
+deploy authentik:
+
+  
+
+    helm repo add authentik https://charts.goauthentik.io
+    
+    helm repo update
+    
+    helm upgrade --install authentik authentik/authentik -f values.yaml
+
+  
+
+edit for Traefik proxy using files
+
+  
+
+    kubectl apply -f ...

Kubernetes/Authentik/values.yaml

@@ -0,0 +1,21 @@
+authentik:
+    secret_key: "29EbOIpe7UWE07C7V2nNTRjQNIWUqow13pL8WHKCPqPWdDKZ8ZyANAzSbRKD63bOIywOkzcDUysQuxLD"
+    # This sends anonymous usage-data, stack traces on errors and
+    # performance data to sentry.io, and is fully opt-in
+    error_reporting:
+        enabled: true
+    postgresql:
+        password: "rz6ze9q2N7YXXYKAQsKvD8AC8gxWImYC1KeVpH6FgADgSXCO0M"
+
+server:
+    ingress:
+        # Specify kubernetes ingress controller class name
+        ingressClassName: traefik
+        enabled: true
+        hosts:
+            - authentik.jimsgarage.co.uk
+
+postgresql:
+    enabled: true
+    auth:
+        password: "rz6ze9q2N7YXXYKAQsKvD8AC8gxWImYC1KeVpH6FgADgSXCO0M"