first commit

share/authentik-ldap/datas.tf

@@ -0,0 +1,22 @@
+locals {
+  common-labels = {
+    "vynil.solidite.fr/owner-name" = var.instance
+    "vynil.solidite.fr/owner-namespace" = var.namespace
+    "vynil.solidite.fr/owner-category" = var.category
+    "vynil.solidite.fr/owner-component" = var.component
+    "app.kubernetes.io/managed-by" = "vynil"
+    "app.kubernetes.io/name" = var.component
+    "app.kubernetes.io/instance" = var.instance
+  }
+}
+
+data "kubernetes_secret_v1" "authentik" {
+  metadata {
+    name      = "authentik"
+    namespace = var.namespace
+  }
+}
+
+data "kustomization_overlay" "data" {
+  resources = []
+}

share/authentik-ldap/index.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: vinyl.solidite.fr/v1beta1
+kind: Component
+category: share
+metadata:
+  name: authentik-ldap
+  description: null
+options:
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+dependencies:
+- dist: null
+  category: share
+  component: authentik
+providers:
+  kubernetes: true
+  authentik: true
+  kubectl: true
+  postgresql: null
+  restapi: null
+  http: true

share/authentik-ldap/outpost-ldap.tf

@@ -0,0 +1,108 @@
+locals {
+  request_headers = {
+    "Content-Type"  = "application/json"
+    Authorization   = "Bearer ${local.authentik-token}"
+  }
+  authentik-token = data.kubernetes_secret_v1.authentik.data["AUTHENTIK_BOOTSTRAP_TOKEN"]
+  ldap-outpost-json = jsondecode(data.http.get_ldap_outpost.response_body).results
+  ldap-outpost-prividers = length(local.ldap-outpost-json)>0?(contains(local.ldap-outpost-json[0].providers, authentik_provider_ldap.provider_ldap.id)?local.ldap-outpost-json[0].providers:concat(local.ldap-outpost-json[0].providers, [authentik_provider_ldap.provider_ldap.id])):[authentik_provider_ldap.provider_ldap.id]
+}
+//TODO: trouver un moyen d'attendre que le service soit ready
+data "http" "get_ldap_outpost" {
+  depends_on = [authentik_provider_ldap.provider_ldap]
+  url    = "http://authentik.${var.namespace}.svc/api/v3/outposts/instances/?name__iexact=ldap"
+  method = "GET"
+  request_headers = local.request_headers
+  lifecycle {
+    postcondition {
+      condition     = contains([200], self.status_code)
+      error_message = "Status code invalid"
+    }
+  }
+}
+
+resource "authentik_stage_password" "ldap-password-stage" {
+  depends_on = [data.kubernetes_secret_v1.authentik]
+  name     = "ldap-authentication-password"
+  backends = [
+    "authentik.core.auth.InbuiltBackend",
+    "authentik.core.auth.TokenBackend",
+    "authentik.sources.ldap.auth.LDAPBackend"
+  ]
+}
+
+resource "authentik_stage_identification" "ldap-identification-stage" {
+  name           = "ldap-identification-stage"
+  user_fields    = ["username","email"]
+  password_stage = authentik_stage_password.ldap-password-stage.id
+}
+
+resource "authentik_stage_user_login" "ldap-authentication-login" {
+  depends_on = [data.kubernetes_secret_v1.authentik]
+  name = "ldap-authentication-login"
+}
+
+resource "authentik_flow" "ldap-authentication-flow" {
+  depends_on = [data.kubernetes_secret_v1.authentik]
+  name        = "ldap-authentication-flow"
+  title       = "ldap authentication flow"
+  slug        = "ldap-authentication-flow"
+  designation = "authentication"
+}
+
+resource "authentik_flow_stage_binding" "ldap-authentication-flow-10" {
+  target = authentik_flow.ldap-authentication-flow.uuid
+  stage  = authentik_stage_identification.ldap-identification-stage.id
+  order  = 10
+}
+
+resource "authentik_flow_stage_binding" "ldap-authentication-flow-30" {
+  target = authentik_flow.ldap-authentication-flow.uuid
+  stage  = authentik_stage_user_login.ldap-authentication-login.id
+  order  = 30
+}
+
+data "authentik_user" "akadmin" {
+  depends_on = [kustomization_resource.post,authentik_flow_stage_binding.ldap-authentication-flow-30]
+  username = "akadmin"
+}
+
+resource "authentik_group" "group" {
+  name         = "vynil-ldap-admins"
+  users        = [data.authentik_user.akadmin.id]
+  is_superuser = true
+}
+
+resource "authentik_service_connection_kubernetes" "local" {
+  depends_on = [data.kubernetes_secret_v1.authentik]
+  name  = "local-ldap"
+  local = true
+}
+
+resource "authentik_provider_ldap" "provider_ldap" {
+  name         = "authentik-ldap-provider"
+  base_dn      = "dc=${var.namespace},dc=namespace"
+  bind_flow    = authentik_flow.ldap-authentication-flow.uuid
+}
+
+resource "authentik_outpost" "outpost-ldap" {
+  name = "ldap"
+  type = "ldap"
+  service_connection = authentik_service_connection_kubernetes.local.id
+  config = jsonencode({
+    "log_level": "info",
+    "authentik_host": "http://authentik",
+    "docker_map_ports": true,
+    "kubernetes_replicas": 1,
+    "kubernetes_namespace": var.namespace,
+    "authentik_host_browser": "",
+    "object_naming_template": "ak-outpost-%(name)s",
+    "authentik_host_insecure": false,
+    "kubernetes_service_type": "ClusterIP",
+    "kubernetes_image_pull_secrets": [],
+    "kubernetes_disabled_components": [],
+    "kubernetes_ingress_annotations": {},
+    "kubernetes_ingress_secret_name": "authentik-outpost-tls"
+  })
+  protocol_providers = local.ldap-outpost-prividers
+}