feat(identity): install authentik

[martinohmann]

Updates #168

[github-actions]

--- kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/authentik

+++ kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/authentik

@@ -0,0 +1,14 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: authentik
+  namespace: flux-system
+spec:
+  interval: 1h
+  timeout: 3m
+  url: https://charts.goauthentik.io
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/identity

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/identity

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    kustomize.toolkit.fluxcd.io/prune: disabled
+  name: identity
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/authentik

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/authentik

@@ -0,0 +1,36 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: authentik
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: authentik
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: cloudnative-pg-cluster
+  interval: 30m
+  path: ./kubernetes/apps/identity/authentik/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: identity
+  timeout: 5m
+  wait: false
+
--- kubernetes/apps/database/pgadmin/app Kustomization: flux-system/pgadmin HelmRelease: database/pgadmin

+++ kubernetes/apps/database/pgadmin/app Kustomization: flux-system/pgadmin HelmRelease: database/pgadmin

@@ -13,13 +13,13 @@

     spec:
       chart: pgadmin4
       sourceRef:
         kind: HelmRepository
         name: runix
         namespace: flux-system
-      version: 1.20.0
+      version: 1.19.0
   install:
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2
   uninstall:
--- kubernetes/apps/identity/authentik/app Kustomization: flux-system/authentik HelmRelease: identity/authentik

+++ kubernetes/apps/identity/authentik/app Kustomization: flux-system/authentik HelmRelease: identity/authentik

@@ -0,0 +1,138 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: authentik
+    kustomize.toolkit.fluxcd.io/name: authentik
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: authentik
+  namespace: identity
+spec:
+  chart:
+    spec:
+      chart: authentik
+      sourceRef:
+        kind: HelmRepository
+        name: authentik
+        namespace: flux-system
+      version: 2023.10.5
+  interval: 30m
+  values:
+    authentik:
+      email:
+        from: Authentik <${SECRET_SMTP_DEFAULT_SENDER_ADDRESS}>
+        host: ${SECRET_SMTP_HOST}
+        password: ${SECRET_SMTP_PASSWORD}
+        port: ${SECRET_SMTP_PORT}
+        use_tls: true
+        username: ${SECRET_SMTP_USERNAME}
+      error_reporting:
+        enabled: false
+      log_level: debug
+    controller:
+      annotations:
+        secret.reloader.stakater.com/reload: authentik-secret
+    ingress:
+      annotations:
+        hajimari.io/group: identity
+        hajimari.io/icon: simple-icons:authelia
+      enabled: true
+      hosts:
+      - host: identity.18b.haus
+        paths:
+        - path: /
+          pathType: Prefix
+      ingressClassName: internal
+      tls:
+      - hosts:
+        - identity.18b.haus
+    initContainers:
+      init-db:
+        envFrom:
+        - secretRef:
+            name: authentik-secret
+        image: ghcr.io/onedr0p/postgres-init:16.1
+    prometheus:
+      rules:
+        create: true
+      serviceMonitor:
+        create: true
+    redis:
+      auth:
+        enabled: true
+      commonConfiguration: |-
+        # Enable AOF https://redis.io/topics/persistence#append-only-file
+        appendonly yes
+        # Disable RDB persistence, AOF persistence already enabled.
+        save ""
+        maxmemory 94371840
+        maxmemory-policy allkeys-lru
+      enabled: true
+      master:
+        persistence:
+          enabled: true
+          size: 200Mi
+          storageClass: longhorn
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            cpu: 15m
+            memory: 50Mi
+      metrics:
+        enabled: true
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            cpu: 10m
+            memory: 10Mi
+        serviceMonitor:
+          enabled: true
+    replicas: 2
+    resources:
+      server:
+        limits:
+          memory: 800Mi
+        requests:
+          cpu: 50m
+          memory: 200Mi
+      worker:
+        limits:
+          memory: 800Mi
+        requests:
+          cpu: 50m
+          memory: 200Mi
+    worker:
+      replicas: 2
+  valuesFrom:
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.secret_key
+    valuesKey: SECRET_KEY
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.redis.password
+    valuesKey: REDIS_PASSWORD
+  - kind: Secret
+    name: authentik-secret
+    targetPath: redis.auth.password
+    valuesKey: REDIS_PASSWORD
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.postgresql.host
+    valuesKey: INIT_POSTGRES_HOST
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.postgresql.user
+    valuesKey: INIT_POSTGRES_USER
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.postgresql.password
+    valuesKey: INIT_POSTGRES_PASS
+  - kind: Secret
+    name: authentik-secret
+    targetPath: authentik.postgresql.name
+    valuesKey: INIT_POSTGRES_DBNAME
+

[github-actions]

--- HelmRelease: database/pgadmin Deployment: database/pgadmin

+++ HelmRelease: database/pgadmin Deployment: database/pgadmin

@@ -21,13 +21,13 @@

         app.kubernetes.io/name: pgadmin
         app.kubernetes.io/instance: pgadmin
     spec:
       automountServiceAccountToken: false
       containers:
       - name: pgadmin4
-        image: docker.io/dpage/pgadmin4:8.1
+        image: docker.io/dpage/pgadmin4:7.8
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
           containerPort: 80
           protocol: TCP
         livenessProbe:
--- HelmRelease: identity/authentik ServiceAccount: identity/authentik-redis

+++ HelmRelease: identity/authentik ServiceAccount: identity/authentik-redis

@@ -0,0 +1,12 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+automountServiceAccountToken: true
+metadata:
+  name: authentik-redis
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: identity/authentik ServiceAccount: identity/authentik

+++ HelmRelease: identity/authentik ServiceAccount: identity/authentik

@@ -0,0 +1,11 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authentik
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-configuration

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-configuration

@@ -0,0 +1,34 @@

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-redis-configuration
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+data:
+  redis.conf: |-
+    # User-supplied common configuration:
+    # Enable AOF https://redis.io/topics/persistence#append-only-file
+    appendonly yes
+    # Disable RDB persistence, AOF persistence already enabled.
+    save ""
+    maxmemory 94371840
+    maxmemory-policy allkeys-lru
+    # End of common configuration
+  master.conf: |-
+    dir /data
+    # User-supplied master configuration:
+    rename-command FLUSHDB ""
+    rename-command FLUSHALL ""
+    # End of master configuration
+  replica.conf: |-
+    dir /data
+    slave-read-only yes
+    # User-supplied replica configuration:
+    rename-command FLUSHDB ""
+    rename-command FLUSHALL ""
+    # End of replica configuration
+
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-health

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-health

@@ -0,0 +1,88 @@

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-redis-health
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+data:
+  ping_readiness_local.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_liveness_local.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_readiness_master.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_liveness_master.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_readiness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+  ping_liveness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+
--- HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-scripts

+++ HelmRelease: identity/authentik ConfigMap: identity/authentik-redis-scripts

@@ -0,0 +1,28 @@

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-redis-scripts
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+data:
+  start-master.sh: |
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
+    fi
+    if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
+    fi
+    ARGS=("--port" "${REDIS_PORT}")
+    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
+    ARGS+=("--masterauth" "${REDIS_PASSWORD}")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
+    exec redis-server "${ARGS[@]}"
+
--- HelmRelease: identity/authentik ClusterRole: identity/authentik-identity

+++ HelmRelease: identity/authentik ClusterRole: identity/authentik-identity

@@ -0,0 +1,17 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: authentik-identity
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - list
+
--- HelmRelease: identity/authentik ClusterRoleBinding: identity/authentik-identity

+++ HelmRelease: identity/authentik ClusterRoleBinding: identity/authentik-identity

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: authentik-identity
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authentik-identity
+subjects:
+- kind: ServiceAccount
+  name: authentik
+  namespace: identity
+
--- HelmRelease: identity/authentik Role: identity/authentik

+++ HelmRelease: identity/authentik Role: identity/authentik

@@ -0,0 +1,73 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: authentik
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  - services
+  - configmaps
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - patch
+- apiGroups:
+  - extensions
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - patch
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - patch
+- apiGroups:
+  - traefik.containo.us
+  - traefik.io
+  resources:
+  - middlewares
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - patch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - get
+  - create
+  - delete
+  - list
+  - patch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - list
+
--- HelmRelease: identity/authentik RoleBinding: identity/authentik

+++ HelmRelease: identity/authentik RoleBinding: identity/authentik

@@ -0,0 +1,19 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: authentik
+subjects:
+- kind: ServiceAccount
+  name: authentik
+  namespace: identity
+
--- HelmRelease: identity/authentik Service: identity/authentik-redis-headless

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-headless

@@ -0,0 +1,21 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-redis-headless
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+  - name: tcp-redis
+    port: 6379
+    targetPort: redis
+  selector:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+
--- HelmRelease: identity/authentik Service: identity/authentik-redis-master

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-master

@@ -0,0 +1,23 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-redis-master
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: master
+spec:
+  type: ClusterIP
+  ports:
+  - name: tcp-redis
+    port: 6379
+    targetPort: redis
+    nodePort: null
+  selector:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/component: master
+
--- HelmRelease: identity/authentik Service: identity/authentik-redis-metrics

+++ HelmRelease: identity/authentik Service: identity/authentik-redis-metrics

@@ -0,0 +1,22 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-redis-metrics
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+spec:
+  type: ClusterIP
+  ports:
+  - name: http-metrics
+    port: 9121
+    protocol: TCP
+    targetPort: metrics
+  selector:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+
--- HelmRelease: identity/authentik Service: identity/authentik

+++ HelmRelease: identity/authentik Service: identity/authentik

@@ -0,0 +1,25 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - port: 9300
+    name: http-metrics
+    protocol: TCP
+    targetPort: http-metrics
+  - port: 80
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/component: server
+
--- HelmRelease: identity/authentik Deployment: identity/authentik-server

+++ HelmRelease: identity/authentik Deployment: identity/authentik-server

@@ -0,0 +1,82 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: server
+spec:
+  replicas: 2
+  strategy: {}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/component: server
+      annotations:
+        goauthentik.io/config-checksum: 9cabad0976654282af86dae774c6333307054d92b6481746a0301516a7855b3c
+    spec:
+      enableServiceLinks: true
+      initContainers:
+      - envFrom:
+        - secretRef:
+            name: authentik-secret
+        image: ghcr.io/onedr0p/postgres-init:16.1
+        name: init-db
+      securityContext: {}
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2023.10.5
+        imagePullPolicy: IfNotPresent
+        args:
+        - server
+        env: null
+        envFrom:
+        - secretRef:
+            name: authentik
+        volumeMounts: null
+        ports:
+        - name: http
+          containerPort: 9000
+          protocol: TCP
+        - name: http-metrics
+          containerPort: 9300
+          protocol: TCP
+        - name: https
+          containerPort: 9443
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /-/health/live/
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        startupProbe:
+          failureThreshold: 60
+          httpGet:
+            path: /-/health/live/
+            port: http
+          periodSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /-/health/ready/
+            port: http
+          periodSeconds: 10
+        resources:
+          limits:
+            memory: 800Mi
+          requests:
+            cpu: 50m
+            memory: 200Mi
+        securityContext: {}
+      volumes: null
+
--- HelmRelease: identity/authentik Deployment: identity/authentik-worker

+++ HelmRelease: identity/authentik Deployment: identity/authentik-worker

@@ -0,0 +1,56 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: worker
+spec:
+  replicas: 2
+  strategy: {}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: worker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/component: worker
+      annotations:
+        goauthentik.io/config-checksum: 9cabad0976654282af86dae774c6333307054d92b6481746a0301516a7855b3c
+    spec:
+      serviceAccountName: authentik
+      enableServiceLinks: true
+      initContainers:
+      - envFrom:
+        - secretRef:
+            name: authentik-secret
+        image: ghcr.io/onedr0p/postgres-init:16.1
+        name: init-db
+      securityContext: {}
+      containers:
+      - name: authentik
+        image: ghcr.io/goauthentik/server:2023.10.5
+        imagePullPolicy: IfNotPresent
+        args:
+        - worker
+        env: null
+        envFrom:
+        - secretRef:
+            name: authentik
+        volumeMounts: null
+        resources:
+          limits:
+            memory: 800Mi
+          requests:
+            cpu: 50m
+            memory: 200Mi
+        securityContext: {}
+      volumes: null
+
--- HelmRelease: identity/authentik StatefulSet: identity/authentik-redis-master

+++ HelmRelease: identity/authentik StatefulSet: identity/authentik-redis-master

@@ -0,0 +1,192 @@

+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: authentik-redis-master
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: master
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: master
+  serviceName: authentik-redis-headless
+  updateStrategy:
+    rollingUpdate: {}
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: redis
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/component: master
+      annotations:
+        checksum/configmap: c5d1034ac92872131d11824f1b436bb44c44b23286be8030c92443bed3e3f26c
+        checksum/health: eecb0ef9a71add7db06289900c160225ae7675ac2bf33ea2eb22b426687b06d0
+        checksum/scripts: d500dadc3f18ca72333d84fad4805d124cf8f9750886442d6f9b7503e3ff53de
+        checksum/secret: af542bda65effccf43d07298aa5d1299f302e8479bf5b3e2d2c1813b13f44bfb
+        prometheus.io/port: '9121'
+        prometheus.io/scrape: 'true'
+    spec:
+      securityContext:
+        fsGroup: 1001
+      serviceAccountName: authentik-redis
+      affinity:
+        podAffinity: null
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: redis
+                  app.kubernetes.io/instance: authentik
+                  app.kubernetes.io/component: master
+              namespaces:
+              - identity
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+        nodeAffinity: null
+      terminationGracePeriodSeconds: 30
+      containers:
+      - name: redis
+        image: docker.io/bitnami/redis:6.2.10-debian-11-r13
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 1001
+        command:
+        - /bin/bash
+        args:
+        - -c
+        - /opt/bitnami/scripts/start-scripts/start-master.sh
+        env:
+        - name: BITNAMI_DEBUG
+          value: 'false'
+        - name: REDIS_REPLICATION_MODE
+          value: master
+        - name: ALLOW_EMPTY_PASSWORD
+          value: 'no'
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: authentik-redis
+              key: redis-password
+        - name: REDIS_TLS_ENABLED
+          value: 'no'
+        - name: REDIS_PORT
+          value: '6379'
+        ports:
+        - name: redis
+          containerPort: 6379
+        livenessProbe:
+          initialDelaySeconds: 20
+          periodSeconds: 5
+          timeoutSeconds: 6
+          successThreshold: 1
+          failureThreshold: 5
+          exec:
+            command:
+            - sh
+            - -c
+            - /health/ping_liveness_local.sh 5
+        readinessProbe:
+          initialDelaySeconds: 20
+          periodSeconds: 5
+          timeoutSeconds: 2
+          successThreshold: 1
+          failureThreshold: 5
+          exec:
+            command:
+            - sh
+            - -c
+            - /health/ping_readiness_local.sh 1
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            cpu: 15m
+            memory: 50Mi
+        volumeMounts:
+        - name: start-scripts
+          mountPath: /opt/bitnami/scripts/start-scripts
+        - name: health
+          mountPath: /health
+        - name: redis-data
+          mountPath: /data
+          subPath: null
+        - name: config
+          mountPath: /opt/bitnami/redis/mounted-etc
+        - name: redis-tmp-conf
+          mountPath: /opt/bitnami/redis/etc/
+        - name: tmp
+          mountPath: /tmp
+      - name: metrics
+        image: docker.io/bitnami/redis-exporter:1.33.0-debian-10-r21
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 1001
+        command:
+        - /bin/bash
+        - -c
+        - |
+          if [[ -f '/secrets/redis-password' ]]; then
+          export REDIS_PASSWORD=$(cat /secrets/redis-password)
+          fi
+          redis_exporter
+        env:
+        - name: REDIS_ALIAS
+          value: authentik-redis
+        - name: REDIS_USER
+          value: default
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: authentik-redis
+              key: redis-password
+        ports:
+        - name: metrics
+          containerPort: 9121
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            cpu: 10m
+            memory: 10Mi
+        volumeMounts: null
+      volumes:
+      - name: start-scripts
+        configMap:
+          name: authentik-redis-scripts
+          defaultMode: 493
+      - name: health
+        configMap:
+          name: authentik-redis-health
+          defaultMode: 493
+      - name: config
+        configMap:
+          name: authentik-redis-configuration
+      - name: redis-tmp-conf
+        emptyDir: {}
+      - name: tmp
+        emptyDir: {}
+  volumeClaimTemplates:
+  - metadata:
+      name: redis-data
+      labels:
+        app.kubernetes.io/name: redis
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/component: master
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 200Mi
+      storageClassName: longhorn
+
--- HelmRelease: identity/authentik Ingress: identity/authentik

+++ HelmRelease: identity/authentik Ingress: identity/authentik

@@ -0,0 +1,29 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    hajimari.io/group: identity
+    hajimari.io/icon: simple-icons:authelia
+spec:
+  ingressClassName: internal
+  tls:
+  - hosts:
+    - identity.18b.haus
+  rules:
+  - host: identity.18b.haus
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: authentik
+            port:
+              name: http
+
--- HelmRelease: identity/authentik PrometheusRule: identity/authentik

+++ HelmRelease: identity/authentik PrometheusRule: identity/authentik

@@ -0,0 +1,159 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+spec:
+  groups:
+  - name: authentik Aggregate request counters
+    rules:
+    - record: job:django_http_requests_before_middlewares_total:sum_rate30s
+      expr: sum(rate(django_http_requests_before_middlewares_total[30s])) by (job)
+    - record: job:django_http_requests_unknown_latency_total:sum_rate30s
+      expr: sum(rate(django_http_requests_unknown_latency_total[30s])) by (job)
+    - record: job:django_http_ajax_requests_total:sum_rate30s
+      expr: sum(rate(django_http_ajax_requests_total[30s])) by (job)
+    - record: job:django_http_responses_before_middlewares_total:sum_rate30s
+      expr: sum(rate(django_http_responses_before_middlewares_total[30s])) by (job)
+    - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
+      expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s]))
+        by (job)
+    - record: job:django_http_requests_body_total_bytes:sum_rate30s
+      expr: sum(rate(django_http_requests_body_total_bytes[30s])) by (job)
+    - record: job:django_http_responses_streaming_total:sum_rate30s
+      expr: sum(rate(django_http_responses_streaming_total[30s])) by (job)
+    - record: job:django_http_responses_body_total_bytes:sum_rate30s
+      expr: sum(rate(django_http_responses_body_total_bytes[30s])) by (job)
+    - record: job:django_http_requests_total:sum_rate30s
+      expr: sum(rate(django_http_requests_total_by_method[30s])) by (job)
+    - record: job:django_http_requests_total_by_method:sum_rate30s
+      expr: sum(rate(django_http_requests_total_by_method[30s])) by (job,method)
+    - record: job:django_http_requests_total_by_transport:sum_rate30s
+      expr: sum(rate(django_http_requests_total_by_transport[30s])) by (job,transport)
+    - record: job:django_http_requests_total_by_view:sum_rate30s
+      expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by
+        (job,view)
+    - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
+      expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by
+        (job,view,transport,method)
+    - record: job:django_http_responses_total_by_templatename:sum_rate30s
+      expr: sum(rate(django_http_responses_total_by_templatename[30s])) by (job,templatename)
+    - record: job:django_http_responses_total_by_status:sum_rate30s
+      expr: sum(rate(django_http_responses_total_by_status[30s])) by (job,status)
+    - record: job:django_http_responses_total_by_status_name_method:sum_rate30s
+      expr: sum(rate(django_http_responses_total_by_status_name_method[30s])) by (job,status,name,method)
+    - record: job:django_http_responses_total_by_charset:sum_rate30s
+      expr: sum(rate(django_http_responses_total_by_charset[30s])) by (job,charset)
+    - record: job:django_http_exceptions_total_by_type:sum_rate30s
+      expr: sum(rate(django_http_exceptions_total_by_type[30s])) by (job,type)
+    - record: job:django_http_exceptions_total_by_view:sum_rate30s
+      expr: sum(rate(django_http_exceptions_total_by_view[30s])) by (job,view)
+  - name: authentik Aggregate latency histograms
+    rules:
+    - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+      expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '50'
+    - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+      expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '95'
+    - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+      expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '99'
+    - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+      expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '99.9'
+    - record: job:django_http_requests_latency_seconds:quantile_rate30s
+      expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '50'
+    - record: job:django_http_requests_latency_seconds:quantile_rate30s
+      expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '95'
+    - record: job:django_http_requests_latency_seconds:quantile_rate30s
+      expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '99'
+    - record: job:django_http_requests_latency_seconds:quantile_rate30s
+      expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s]))
+        by (job, le))
+      labels:
+        quantile: '99.9'
+  - name: authentik Aggregate model operations
+    rules:
+    - record: job:django_model_inserts_total:sum_rate1m
+      expr: sum(rate(django_model_inserts_total[1m])) by (job, model)
+    - record: job:django_model_updates_total:sum_rate1m
+      expr: sum(rate(django_model_updates_total[1m])) by (job, model)
+    - record: job:django_model_deletes_total:sum_rate1m
+      expr: sum(rate(django_model_deletes_total[1m])) by (job, model)
+  - name: authentik Aggregate database operations
+    rules:
+    - record: job:django_db_new_connections_total:sum_rate30s
+      expr: sum(rate(django_db_new_connections_total[30s])) by (alias, vendor)
+    - record: job:django_db_new_connection_errors_total:sum_rate30s
+      expr: sum(rate(django_db_new_connection_errors_total[30s])) by (alias, vendor)
+    - record: job:django_db_execute_total:sum_rate30s
+      expr: sum(rate(django_db_execute_total[30s])) by (alias, vendor)
+    - record: job:django_db_execute_many_total:sum_rate30s
+      expr: sum(rate(django_db_execute_many_total[30s])) by (alias, vendor)
+    - record: job:django_db_errors_total:sum_rate30s
+      expr: sum(rate(django_db_errors_total[30s])) by (alias, vendor, type)
+  - name: authentik Aggregate migrations
+    rules:
+    - record: job:django_migrations_applied_total:max
+      expr: max(django_migrations_applied_total) by (job, connection)
+    - record: job:django_migrations_unapplied_total:max
+      expr: max(django_migrations_unapplied_total) by (job, connection)
+  - name: authentik Alerts
+    rules:
+    - alert: NoWorkersConnected
+      labels:
+        severity: critical
+      expr: max without (pid) (authentik_admin_workers) < 1
+      for: 10m
+      annotations:
+        summary: No workers connected
+        message: authentik instance {{ $labels.instance }}'s worker are either not
+          running or not connected.
+    - alert: PendingMigrations
+      labels:
+        severity: critical
+      expr: max without (pid) (django_migrations_unapplied_total) > 0
+      for: 10m
+      annotations:
+        summary: Pending database migrations
+        message: authentik instance {{ $labels.instance }} has pending database migrations
+    - alert: FailedSystemTasks
+      labels:
+        severity: critical
+      expr: sum(increase(authentik_system_tasks{status="error"}[2h])) > 0
+      for: 2h
+      annotations:
+        summary: Failed system tasks
+        message: System task {{ $labels.task_name }} has failed
+    - alert: DisconnectedOutposts
+      labels:
+        severity: critical
+      expr: sum by (outpost) (max without (pid) (authentik_outposts_connected{uid!~"specific.*"}))  <
+        1
+      for: 30m
+      annotations:
+        summary: Disconnected outpost
+        message: Outpost {{ $labels.outpost }} has at least 1 disconnected instance
+
--- HelmRelease: identity/authentik ServiceMonitor: identity/authentik-redis

+++ HelmRelease: identity/authentik ServiceMonitor: identity/authentik-redis

@@ -0,0 +1,23 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik-redis
+  namespace: identity
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+spec:
+  endpoints:
+  - port: http-metrics
+    interval: 30s
+  namespaceSelector:
+    matchNames:
+    - identity
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: metrics
+
--- HelmRelease: identity/authentik ServiceMonitor: identity/authentik

+++ HelmRelease: identity/authentik ServiceMonitor: identity/authentik

@@ -0,0 +1,19 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/managed-by: Helm
+spec:
+  endpoints:
+  - port: http-metrics
+    scrapeTimeout: 3s
+    interval: 30s
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik
+