Skip to content

Commit d9e3aa6

Browse files
sharma-tapassharma-tapas
committed
trying to integrate authentik
Signed-off-by: Tapas Sharma <tapas@platform9.com>
1 parent 916ab17 commit d9e3aa6

25 files changed

Lines changed: 1280 additions & 9 deletions

‎deploy/04ui.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,34 @@ spec:
3737
---
3838
apiVersion: networking.k8s.io/v1
3939
kind: Ingress
40+
metadata:
41+
name: vjailbreak-oauth2-ingress
42+
namespace: migration-system
43+
annotations:
44+
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
45+
spec:
46+
ingressClassName: nginx
47+
rules:
48+
- http:
49+
paths:
50+
- path: /oauth2
51+
pathType: Prefix
52+
backend:
53+
service:
54+
name: oauth2-proxy
55+
port:
56+
number: 4180
57+
---
58+
apiVersion: networking.k8s.io/v1
59+
kind: Ingress
4060
metadata:
4161
name: vjailbreak-ui-ingress
4262
namespace: migration-system
4363
annotations:
4464
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
65+
nginx.ingress.kubernetes.io/auth-url: "http://$host/oauth2/auth"
66+
nginx.ingress.kubernetes.io/auth-signin: "http://$host/oauth2/start?rd=$escaped_request_uri"
67+
nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Groups"
4568
spec:
4669
ingressClassName: nginx
4770
rules:
@@ -64,6 +87,9 @@ metadata:
6487
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
6588
nginx.ingress.kubernetes.io/rewrite-target: /$1
6689
nginx.ingress.kubernetes.io/use-regex: "true"
90+
nginx.ingress.kubernetes.io/auth-url: "http://$host/oauth2/auth"
91+
nginx.ingress.kubernetes.io/auth-signin: "http://$host/oauth2/start?rd=$escaped_request_uri"
92+
nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Groups"
6793
spec:
6894
ingressClassName: nginx
6995
rules:

‎deploy/authentik/00-secrets.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: authentik-postgres-secret
5+
namespace: authentik
6+
type: Opaque
7+
stringData:
8+
username: "authentik"
9+
password: "authentik-db-pass123"

‎deploy/authentik/01-namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: authentik

‎deploy/authentik/02-postgres.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
apiVersion: v1
2+
kind: PersistentVolumeClaim
3+
metadata:
4+
name: authentik-postgres-pvc
5+
namespace: authentik
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
resources:
10+
requests:
11+
storage: 10Gi
12+
---
13+
apiVersion: apps/v1
14+
kind: Deployment
15+
metadata:
16+
name: authentik-postgres
17+
namespace: authentik
18+
spec:
19+
replicas: 1
20+
selector:
21+
matchLabels:
22+
app: authentik-postgres
23+
template:
24+
metadata:
25+
labels:
26+
app: authentik-postgres
27+
spec:
28+
containers:
29+
- name: postgres
30+
image: postgres:16-alpine
31+
env:
32+
- name: POSTGRES_DB
33+
value: authentik
34+
- name: POSTGRES_USER
35+
valueFrom:
36+
secretKeyRef:
37+
name: authentik-postgres-secret
38+
key: username
39+
- name: POSTGRES_PASSWORD
40+
valueFrom:
41+
secretKeyRef:
42+
name: authentik-postgres-secret
43+
key: password
44+
ports:
45+
- containerPort: 5432
46+
volumeMounts:
47+
- name: postgres-data
48+
mountPath: /var/lib/postgresql/data
49+
volumes:
50+
- name: postgres-data
51+
persistentVolumeClaim:
52+
claimName: authentik-postgres-pvc
53+
---
54+
apiVersion: v1
55+
kind: Service
56+
metadata:
57+
name: authentik-postgres
58+
namespace: authentik
59+
spec:
60+
selector:
61+
app: authentik-postgres
62+
ports:
63+
- port: 5432
64+
targetPort: 5432

‎deploy/authentik/03-redis.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: authentik-redis
5+
namespace: authentik
6+
spec:
7+
replicas: 1
8+
selector:
9+
matchLabels:
10+
app: authentik-redis
11+
template:
12+
metadata:
13+
labels:
14+
app: authentik-redis
15+
spec:
16+
containers:
17+
- name: redis
18+
image: redis:alpine
19+
ports:
20+
- containerPort: 6379
21+
---
22+
apiVersion: v1
23+
kind: Service
24+
metadata:
25+
name: authentik-redis
26+
namespace: authentik
27+
spec:
28+
selector:
29+
app: authentik-redis
30+
ports:
31+
- port: 6379
32+
targetPort: 6379

‎deploy/authentik/04-authentik-server.yaml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: authentik-secret
5+
namespace: authentik
6+
type: Opaque
7+
stringData:
8+
secret-key: "CHANGE_ME_GENERATE_RANDOM_KEY" # Generate with: openssl rand -base64 32
9+
---
10+
apiVersion: apps/v1
11+
kind: Deployment
12+
metadata:
13+
name: authentik-server
14+
namespace: authentik
15+
spec:
16+
replicas: 1
17+
selector:
18+
matchLabels:
19+
app: authentik-server
20+
template:
21+
metadata:
22+
labels:
23+
app: authentik-server
24+
spec:
25+
containers:
26+
- name: authentik
27+
image: ghcr.io/goauthentik/server:2024.8.3
28+
args: ["server"]
29+
env:
30+
- name: AUTHENTIK_SECRET_KEY
31+
valueFrom:
32+
secretKeyRef:
33+
name: authentik-secret
34+
key: secret-key
35+
- name: AUTHENTIK_POSTGRESQL__HOST
36+
value: authentik-postgres
37+
- name: AUTHENTIK_POSTGRESQL__NAME
38+
value: authentik
39+
- name: AUTHENTIK_POSTGRESQL__USER
40+
valueFrom:
41+
secretKeyRef:
42+
name: authentik-postgres-secret
43+
key: username
44+
- name: AUTHENTIK_POSTGRESQL__PASSWORD
45+
valueFrom:
46+
secretKeyRef:
47+
name: authentik-postgres-secret
48+
key: password
49+
- name: AUTHENTIK_REDIS__HOST
50+
value: authentik-redis
51+
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
52+
value: "false"
53+
- name: AUTHENTIK_BOOTSTRAP_PASSWORD
54+
value: "vjb!@#"
55+
- name: AUTHENTIK_BOOTSTRAP_EMAIL
56+
value: "admin@vjailbreak.local"
57+
- name: AUTHENTIK_BOOTSTRAP_TOKEN
58+
value: "vjb!@#"
59+
ports:
60+
- containerPort: 9000
61+
name: http
62+
- containerPort: 9443
63+
name: https
64+
---
65+
apiVersion: apps/v1
66+
kind: Deployment
67+
metadata:
68+
name: authentik-worker
69+
namespace: authentik
70+
spec:
71+
replicas: 1
72+
selector:
73+
matchLabels:
74+
app: authentik-worker
75+
template:
76+
metadata:
77+
labels:
78+
app: authentik-worker
79+
spec:
80+
containers:
81+
- name: authentik
82+
image: ghcr.io/goauthentik/server:2024.8.3
83+
args: ["worker"]
84+
env:
85+
- name: AUTHENTIK_SECRET_KEY
86+
valueFrom:
87+
secretKeyRef:
88+
name: authentik-secret
89+
key: secret-key
90+
- name: AUTHENTIK_POSTGRESQL__HOST
91+
value: authentik-postgres
92+
- name: AUTHENTIK_POSTGRESQL__NAME
93+
value: authentik
94+
- name: AUTHENTIK_POSTGRESQL__USER
95+
valueFrom:
96+
secretKeyRef:
97+
name: authentik-postgres-secret
98+
key: username
99+
- name: AUTHENTIK_POSTGRESQL__PASSWORD
100+
valueFrom:
101+
secretKeyRef:
102+
name: authentik-postgres-secret
103+
key: password
104+
- name: AUTHENTIK_REDIS__HOST
105+
value: authentik-redis
106+
---
107+
apiVersion: v1
108+
kind: Service
109+
metadata:
110+
name: authentik-server
111+
namespace: authentik
112+
spec:
113+
selector:
114+
app: authentik-server
115+
ports:
116+
- name: http
117+
port: 9000
118+
targetPort: 9000
119+
- name: https
120+
port: 9443
121+
targetPort: 9443

‎deploy/authentik/05-ingress.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: authentik-ingress
5+
namespace: authentik
6+
annotations:
7+
nginx.ingress.kubernetes.io/proxy-body-size: "0"
8+
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
9+
# Disable auth for Authentik itself (it provides auth for others)
10+
nginx.ingress.kubernetes.io/auth-url: ""
11+
nginx.ingress.kubernetes.io/auth-signin: ""
12+
spec:
13+
ingressClassName: nginx
14+
rules:
15+
- http:
16+
paths:
17+
- path: /authentik
18+
pathType: Prefix
19+
backend:
20+
service:
21+
name: authentik-server
22+
port:
23+
number: 9000
24+
---
25+
# NodePort service to expose Authentik on port 9000
26+
apiVersion: v1
27+
kind: Service
28+
metadata:
29+
name: authentik-nodeport
30+
namespace: authentik
31+
spec:
32+
type: NodePort
33+
selector:
34+
app: authentik-server
35+
ports:
36+
- port: 9000
37+
targetPort: 9000
38+
nodePort: 30900 # External port on the node
39+
protocol: TCP

‎deploy/authentik/06-roles.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: vjailbreak-admin
5+
rules:
6+
- apiGroups: ["vjailbreak.k8s.pf9.io"]
7+
resources: ["*"]
8+
verbs: ["*"]
9+
- apiGroups: [""]
10+
resources: ["secrets", "configmaps", "pods", "pods/log"]
11+
verbs: ["*"]
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: vjailbreak-operator
17+
rules:
18+
- apiGroups: ["vjailbreak.k8s.pf9.io"]
19+
resources:
20+
- migrations
21+
- migrationplans
22+
- rollingmigrationplans
23+
- esximigrations
24+
- clustermigrations
25+
verbs: ["get", "list", "watch", "create", "update", "patch"]
26+
- apiGroups: ["vjailbreak.k8s.pf9.io"]
27+
resources:
28+
- openstackcreds
29+
- vmwarecreds
30+
- networkmappings
31+
- storagemappings
32+
- migrationtemplates
33+
verbs: ["get", "list", "watch"]
34+
- apiGroups: [""]
35+
resources: ["secrets"]
36+
verbs: ["get", "list", "create", "update"]
37+
- apiGroups: [""]
38+
resources: ["pods", "pods/log"]
39+
verbs: ["get", "list", "watch"]
40+
---
41+
apiVersion: rbac.authorization.k8s.io/v1
42+
kind: ClusterRole
43+
metadata:
44+
name: vjailbreak-viewer
45+
rules:
46+
- apiGroups: ["vjailbreak.k8s.pf9.io"]
47+
resources: ["*"]
48+
verbs: ["get", "list", "watch"]
49+
- apiGroups: [""]
50+
resources: ["pods", "pods/log"]
51+
verbs: ["get", "list", "watch"]

0 commit comments

Comments
 (0)