trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/website/docs/outposts/integrations/kubernetes.md
Jens L ffe6f65af5
outposts/kubernetes: ingress class (#4002) 
* add support for ingressClassName

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add option to disable ssl verification for k8s controller

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* update website

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2022-11-14 14:24:11 +01:00

2.7 KiB
Raw Blame History

title
Kubernetes

The kubernetes integration with automatically deploy outposts on any Kubernetes Cluster.

This integration has the advantage over manual deployments of automatic updates (whenever authentik is updated, it updates the outposts), and authentik can (in a future version) automatically rotate the token that the outpost uses to communicate with the core authentik server.

This integration creates the following objects:

  • Deployment for the outpost container
  • Service
  • Secret to store the token
  • Prometheus ServiceMonitor (if the Prometheus Operator is installed in the target cluster)
  • Ingress (only Proxy outposts)
  • Traefik Middleware (only Proxy outposts with forward auth enabled)

The following outpost settings are used:

  • object_naming_template: Configures how the container is called

  • container_image: Optionally overwrites the standard container image (see Configuration to configure the global default)

  • kubernetes_replicas: Replica count for the deployment of the outpost

  • kubernetes_namespace: Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)

  • kubernetes_ingress_annotations: Any additional annotations to add to the ingress object, for example cert-manager

  • kubernetes_ingress_secret_name: Name of the secret that is used for TLS connections

  • kubernetes_ingress_class_name: Optionally set the ingress class used for the generated ingress, requires authentik 2022.11.0

  • kubernetes_service_type: Service kind created, can be set to LoadBalancer for LDAP outposts for example

  • kubernetes_disabled_components: Disable any components of the kubernetes integration, can be any of

    • 'secret'
    • 'deployment'
    • 'service'
    • 'prometheus servicemonitor'
    • 'ingress'
    • 'traefik middleware'

  • kubernetes_image_pull_secrets: If the above docker image is in a private repository, use these secrets to pull.

    NOTE: The secret must be created manually in the namespace first.

Permissions

The permissions required for this integration are documented in the helm chart, see Cluster-level and Namespace-level.

Remote clusters

To add a remote cluster, you can simply install this helm chart in the target cluster and namespace: https://artifacthub.io/packages/helm/goauthentik/authentik-remote-cluster

After installation, the helm chart outputs an example kubeconfig file, that you can enter in authentik to connect to the cluster.