feat: self-hosted Authentik IdP PoC (platform cluster, cloudflared tunnel) - #42
Draft
jonathandieu wants to merge 3 commits into
Draft
feat: self-hosted Authentik IdP PoC (platform cluster, cloudflared tunnel)#42jonathandieu wants to merge 3 commits into
jonathandieu wants to merge 3 commits into
Conversation
Authentik (server + worker + bundled Postgres) exposed via a Cloudflare Tunnel (cloudflared, token-based, HA). Secrets (authentik-secrets, tunnel token) come from 1Password via ExternalSecrets against the onepassword ClusterSecretStore. WIP: still needs a Redis (chart bundles none), Bitnami Postgres image validation, and platform-scoped appset wiring, to be finished against the live cluster.
Move the Authentik IdP and cloudflared tunnel charts to charts/platform/ and add them to the platform ApplicationSet, which is scoped to purpose=platform, so they run only on the platform cluster (not every cluster like the infra appset).
Helm template diffOnly in /tmp/head: authentik.yaml
Only in /tmp/head: cloudflared.yaml
diff -u --recursive --label base --label head base head
--- base
+++ head
@@ -219,7 +219,7 @@
app.kubernetes.io/managed-by: Helm
type: Opaque
data:
- SECRET_KEY_BASE: NG1yQ0F1OGFKYW1hS2ZSMVhrTWo5YWROWW9OMmRFOG83eFNBSHVRVXV4cjJlY0VWSzVKVm9LbHZvZWo4Y0QxVENqRUpZcFM2V1Raa2k1akZRWkg1eHlJdTVq
+ SECRET_KEY_BASE: SXJtWTNjUHdoZllreHNWYUxQRWZIZHMyQXdjbzNuWlpvYUFrN0tUTjFRU0hoMFkzRld4SWxhUVRXcGxUUUkzRmJSc0JYSjd6MjdPckZFUmJVTHRGTU1CM1lP
TOTP_VAULT_KEY: ZHN4dmJuM2p4RGQxNmF6MlFwc1g1QjhPK2xseGpRMlNKRTJpNUJ6eDM4ST0=
DATABASE_URL: cG9zdGdyZXM6Ly9wb3N0Z3Jlczpwb3N0Z3Jlc0BwbGF1c2libGUtcG9zdGdyZXNxbDo1NDMyL3BsYXVzaWJsZV9kYg==
CLICKHOUSE_DATABASE_URL: aHR0cDovL2NsaWNraG91c2U6cGFzc3dvcmRAcGxhdXNpYmxlLWNsaWNraG91c2U6ODEyMy9wbGF1c2libGVfZXZlbnRzX2Ri |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proof-of-concept for a self-hosted Authentik IdP on the platform cluster, exposed via a
Cloudflare Tunnel (no public LB). Foundation for SSO across
*.dieu.dev; the firstconsumer is
whereis.dieu.dev(#16).Changes
charts/platform/authentik/— Authentik server + worker + bundled Postgres + a smallephemeral Redis (the chart bundles no Redis). Secrets (
AUTHENTIK_SECRET_KEY, DBpassword, bootstrap admin) come from 1Password via an ExternalSecret, nothing in git.
charts/platform/cloudflared/— token-based HA Cloudflare Tunnel; token from 1Password.argocd/apps/platform/appset.yaml— added both to the platform appset, which is scopedto
purpose: platform, so they deploy only to the platform cluster.Architecture
Authentik runs on the platform (management) cluster. cloudflared exposes
auth.dieu.devvia an outbound tunnel (no inbound LB). Apps on any cluster authenticate over OIDC
(browser redirects + JWKS over public HTTPS), so the cluster boundary is a non-issue.
Verified
helm lint+helm templateclean on both charts; the platform appset passes a serverdry-run against the live ApplicationSet CRD.
Prerequisites before this can deploy (not in this PR)
s-2vcpu-8gb->s-4vcpu-16gb).authentik-secretsfields + the tunnelcredential), and fill theonePasswordItemUUIDs in the two values files.auth.dieu.dev -> http://authentik-server.authentik:80.Known open item
Validate the bundled Bitnami Postgres image actually pulls (Bitnami deprecated their free
Docker Hub catalog in 2025). If it 404s on deploy, repoint to
bitnamilegacy/postgresqlor a plain
postgresimage. Needs the live cluster to confirm.Draft until deployed end-to-end.
Related: #16, terraform#16.