fix(authentik-application): init
This commit is contained in:
parent
8c5c6cf3e6
commit
273dea0953
GPG key ID:
7AFDB012974B1BB5
6 changed files with 324 additions and 0 deletions
23
authentik-application/.helmignore
Normal file
23
authentik-application/.helmignore
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
6
authentik-application/Chart.yaml
Normal file
6
authentik-application/Chart.yaml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: v2
|
||||
name: authentik-application
|
||||
description: A Chart to deploy a secret for the authentik blueprint-sidecar
|
||||
type: application
|
||||
|
||||
version: 0.1.0
|
||||
51
authentik-application/README.adoc
Normal file
51
authentik-application/README.adoc
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
= Authentik Application
|
||||
|
||||
setup configmap with blueprint for goauthentik and store values in secrets
|
||||
|
||||
|
||||
Usage with FluxCD:
|
||||
[source,yaml]
|
||||
----
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: app-oauth2
|
||||
spec:
|
||||
interval: 5m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: "wrenix-helm-charts"
|
||||
namespace: "infra"
|
||||
chart: './charts/authentik-application'
|
||||
reconcileStrategy: 'Revision'
|
||||
interval: 1m
|
||||
install:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
disableWait: true
|
||||
upgrade:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
disableWait: true
|
||||
force: true
|
||||
values:
|
||||
secret:
|
||||
name: "oidc-auth"
|
||||
blueprint:
|
||||
provider:
|
||||
name: "GitOps"
|
||||
redirectURL: "https://application.domain/oauth2/callback"
|
||||
signingKey: "authentik Self-signed Certificate"
|
||||
scopes:
|
||||
- "email"
|
||||
application:
|
||||
name: "The Application"
|
||||
slug: "app"
|
||||
group: "Infrastructure"
|
||||
launchURL: "https://application.domain/"
|
||||
openInNewTab: True
|
||||
----
|
||||
62
authentik-application/templates/_helpers.tpl
Normal file
62
authentik-application/templates/_helpers.tpl
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "authentik-application.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "authentik-application.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "authentik-application.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "authentik-application.labels" -}}
|
||||
helm.sh/chart: {{ include "authentik-application.chart" . }}
|
||||
{{ include "authentik-application.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "authentik-application.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "authentik-application.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "authentik-application.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "authentik-application.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
147
authentik-application/templates/secrets.yaml
Normal file
147
authentik-application/templates/secrets.yaml
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
{{- $clientID := .Values.blueprint.provider.clientID }}
|
||||
{{- $clientSecret := .Values.blueprint.provider.clientSecret }}
|
||||
{{- if .Values.secret.enabled }}
|
||||
---
|
||||
{{- $secretName := .Values.secret.name | default (include "authentik-application.fullname" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
labels:
|
||||
{{- include "authentik-application.labels" . | nindent 4 }}
|
||||
{{- with .Values.secret.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
stringData:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace $secretName) | default dict }}
|
||||
{{- $secretData := (get $secretObj "data") | default dict }}
|
||||
|
||||
issuerURL: {{ print .Values.blueprint.authentik.domain "/application/o/" .Values.blueprint.application.slug "/" }}
|
||||
{{- $clientIDCoded := (get $secretData "clientID") | default (randAlphaNum 32 | b64enc) }}
|
||||
{{- $clientID = .Values.blueprint.provider.clientID | default ($clientIDCoded | b64dec) }}
|
||||
clientID: {{ $clientID | quote }}
|
||||
{{- $clientSecretCoded := (get $secretData "clientSecret") | default (randAlphaNum 32 | b64enc) }}
|
||||
{{- $clientSecret = .Values.blueprint.provider.clientSecret | default ($clientSecretCoded | b64dec) }}
|
||||
clientSecret: {{ $clientSecret | quote }}
|
||||
redirectURL: {{ .Values.blueprint.provider.redirectURL }}
|
||||
{{- with .Values.blueprint.provider.tokenDuration }}
|
||||
tokenDuration: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.provider.scopes }}
|
||||
customScopes: {{ . | join "," | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.provider.claimUsername }}
|
||||
claimUsername: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.provider.claimGroups }}
|
||||
claimGroups: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "authentik-application.fullname" . }}-blueprint
|
||||
labels:
|
||||
{{- include "authentik-application.labels" . | nindent 4 }}
|
||||
{{- with .Values.blueprint.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
stringData:
|
||||
blueprint.yaml: |-
|
||||
version: 1
|
||||
metadata:
|
||||
name: {{ include "authentik-application.fullname" . }}
|
||||
entries:
|
||||
|
||||
- model: authentik_providers_oauth2.OAuth2Provider
|
||||
id: {{ .Values.blueprint.provider.name | default (include "authentik-application.fullname" .) }}
|
||||
identifiers:
|
||||
name: {{ .Values.blueprint.provider.name | default (include "authentik-application.fullname" .) }}
|
||||
state: present
|
||||
attrs:
|
||||
authorization_flow: !Find [authentik_flows.flow, [slug, {{ .Values.blueprint.provider.authorizationFlow }}]]
|
||||
client_type: {{ .Values.blueprint.provider.clientType | quote }}
|
||||
client_id: {{ $clientID | quote }}
|
||||
client_secret: {{ $clientSecret | quote }}
|
||||
redirect_uris: {{ .Values.blueprint.provider.redirectURL }}
|
||||
{{- with .Values.blueprint.provider.tokenDuration }}
|
||||
access_token_validity: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.provider.signingKey }}
|
||||
signing_key: !Find [authentik_crypto.CertificateKeyPair, [name, {{ . }}]]
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.provider.scopes }}
|
||||
property_mappings:
|
||||
{{- range . }}
|
||||
- !Find [authentik_providers_oauth2.ScopeMapping, [scope_name, {{ . }}]]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
- model: authentik_core.Application
|
||||
id: {{ .Values.blueprint.application.name | default (include "authentik-application.fullname" .) }}
|
||||
identifiers:
|
||||
slug: {{ .Values.blueprint.application.slug }}
|
||||
state: present
|
||||
attrs:
|
||||
name: {{ .Values.blueprint.application.name | default (include "authentik-application.fullname" .) }}
|
||||
slug: {{ .Values.blueprint.application.slug }}
|
||||
provider: !KeyOf {{ .Values.blueprint.provider.name | default (include "authentik-application.fullname" .) }}
|
||||
policy_engine_mode: {{ .Values.blueprint.application.policyEngineMode }}
|
||||
{{- with .Values.blueprint.application.group }}
|
||||
group: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.application.launchURL }}
|
||||
meta_launch_url: {{ . | quote }}
|
||||
{{- end }}
|
||||
open_in_new_tab: {{ toYaml .Values.blueprint.application.openInNewTab }}
|
||||
{{- with .Values.blueprint.application.icon }}
|
||||
meta_icon: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.application.description }}
|
||||
meta_description: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.blueprint.application.publisher }}
|
||||
meta_publisher: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if (eq (len .Values.blueprint.groups) 0) }}
|
||||
|
||||
- model: authentik_core.group
|
||||
id: "app: {{ .Values.blueprint.application.slug }}"
|
||||
identifiers:
|
||||
name: "app: {{ .Values.blueprint.application.slug }}"
|
||||
state: "present"
|
||||
attrs:
|
||||
name: "app: {{ .Values.blueprint.application.slug }}"
|
||||
|
||||
- model: authentik_policies.PolicyBinding
|
||||
id: "app: {{ .Values.blueprint.application.slug }}"
|
||||
identifiers:
|
||||
group: !KeyOf "app: {{ .Values.blueprint.application.slug }}"
|
||||
attrs:
|
||||
group: !KeyOf "app: {{ .Values.blueprint.application.slug }}"
|
||||
order: 10
|
||||
target: !Find [authentik_core.Application, [slug, {{ .Values.blueprint.application.slug }}]]
|
||||
{{- end }}
|
||||
|
||||
{{- range $group := .Values.blueprint.groups }}
|
||||
|
||||
- model: authentik_core.group
|
||||
id: {{ $group.slug | quote }}
|
||||
identifiers:
|
||||
name: {{ $group.slug | quote }}
|
||||
state: {{ $group.state | default "present" | quote }}
|
||||
attrs:
|
||||
name: {{ $group.slug | quote }}
|
||||
|
||||
- model: authentik_policies.PolicyBinding
|
||||
id: {{ $group.slug | quote }}
|
||||
identifiers:
|
||||
group: !KeyOf {{ $group.slug | quote }}
|
||||
attrs:
|
||||
group: !KeyOf {{ $group.slug | quote}}
|
||||
order: 10
|
||||
target: !Find [authentik_core.Application, [slug, {{ $.Values.blueprint.application.slug }}]]
|
||||
{{- end }}
|
||||
|
||||
35
authentik-application/values.yaml
Normal file
35
authentik-application/values.yaml
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
secret:
|
||||
enabled: true
|
||||
name: ""
|
||||
labels: {}
|
||||
|
||||
blueprint:
|
||||
authentik:
|
||||
domain: "https://auth.wrenix.eu"
|
||||
labels:
|
||||
goauthentik_blueprint: "1"
|
||||
provider:
|
||||
name: ""
|
||||
authorizationFlow: "default-provider-authorization-implicit-consent"
|
||||
clientType: "confidential"
|
||||
# -- client id - generated if secret enabled
|
||||
clientID:
|
||||
# -- client secret - generated if secret enabled
|
||||
clientSecret:
|
||||
redirectURL: ""
|
||||
# -- Need for non-curve / RSA
|
||||
signingKey: ""
|
||||
# -- Scope
|
||||
scopes:
|
||||
application:
|
||||
name: ""
|
||||
slug: "app-name"
|
||||
policyEngineMode: "any"
|
||||
group: ""
|
||||
launchURL: ""
|
||||
openInNewTab: false
|
||||
icon: ""
|
||||
description: ""
|
||||
publisher: ""
|
||||
# - additional groups
|
||||
groups: []
|
||||
Loading…
Add table
Reference in a new issue