first commit

share/authentik/apps_v1_Deployment_authentik-server.yaml

@@ -0,0 +1,71 @@
+# Source: authentik/templates/server-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: "server"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: "server"
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/component: "server"
+        app.kubernetes.io/version: "2023.6.1"
+      annotations:
+        goauthentik.io/config-checksum: 39339b4fd4c8511ca989fe40932e07b38befc9e3642eab092900cdde5cdf8f37
+    spec:
+      enableServiceLinks: true
+      securityContext:
+        {}
+      containers:
+        - name: authentik
+          image: "ghcr.io/goauthentik/server:2023.6.1"
+          imagePullPolicy: "IfNotPresent"
+          args: ["server"]
+          env:
+          envFrom:
+            - secretRef:
+                name: authentik
+          volumeMounts:
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+            - name: http-metrics
+              containerPort: 9300
+              protocol: TCP
+            - name: https
+              containerPort: 9443
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /-/health/live/
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          startupProbe:
+            failureThreshold: 60
+            httpGet:
+              path: /-/health/live/
+              port: http
+            periodSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /-/health/ready/
+              port: http
+            periodSeconds: 10
+          securityContext:
+            {}
+      volumes:

share/authentik/apps_v1_Deployment_authentik-worker.yaml

@@ -0,0 +1,45 @@
+# Source: authentik/templates/worker-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: "worker"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/component: "worker"
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/instance: authentik
+        app.kubernetes.io/component: "worker"
+        app.kubernetes.io/version: "2023.6.1"
+      annotations:
+        goauthentik.io/config-checksum: 39339b4fd4c8511ca989fe40932e07b38befc9e3642eab092900cdde5cdf8f37
+    spec:
+      serviceAccountName: authentik
+      enableServiceLinks: true
+      securityContext:
+        {}
+      containers:
+        - name: authentik
+          image: "ghcr.io/goauthentik/server:2023.6.1"
+          imagePullPolicy: "IfNotPresent"
+          args: ["worker"]
+          env:
+          envFrom:
+            - secretRef:
+                name: authentik
+          volumeMounts:
+          securityContext:
+            {}
+      volumes:

share/authentik/autoscaling_v2_HorizontalPodAutoscaler_authentik-server.yaml

@@ -0,0 +1,26 @@
+# Source: authentik/templates/server-hpa.yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: authentik-server
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: "server"
+spec:
+  minReplicas: 1
+  maxReplicas: 5
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 50
+        type: Utilization
+    type: Resource
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: authentik-server

share/authentik/autoscaling_v2_HorizontalPodAutoscaler_authentik-worker.yaml

@@ -0,0 +1,26 @@
+# Source: authentik/templates/worker-hpa.yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: authentik-worker
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: "worker"
+spec:
+  minReplicas: 1
+  maxReplicas: 5
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 80
+        type: Utilization
+    type: Resource
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: authentik-worker

share/authentik/datas.tf

@@ -0,0 +1,153 @@
+locals {
+  common-labels = {
+    "vynil.solidite.fr/owner-name" = var.instance
+    "vynil.solidite.fr/owner-namespace" = var.namespace
+    "vynil.solidite.fr/owner-category" = var.category
+    "vynil.solidite.fr/owner-component" = var.component
+    "app.kubernetes.io/managed-by" = "vynil"
+    "app.kubernetes.io/name" = var.component
+    "app.kubernetes.io/instance" = var.instance
+  }
+}
+
+data "kubernetes_secret_v1" "authentik" {
+  metadata {
+    name      = "authentik"
+    namespace = var.namespace
+  }
+}
+
+data "kustomization_overlay" "data" {
+  namespace = var.namespace
+  common_labels = local.common-labels
+  resources = [for file in fileset(path.module, "*.yaml"): file if file != "index.yaml"]
+  images {
+    name = "ghcr.io/goauthentik/server"
+    new_name = "${var.image.registry}/${var.image.repository}"
+    new_tag  = "${var.image.tag}"
+  }
+  config_map_generator {
+    name = var.component
+    behavior = "create"
+    literals = [
+      "AUTHENTIK_EMAIL__PORT=${var.email.port}",
+      "AUTHENTIK_EMAIL__TIMEOUT=${var.email.timeout}",
+      "AUTHENTIK_EMAIL__USE_TLS=${var.email.use_tls}",
+      "AUTHENTIK_EMAIL__USE_SSL=${var.email.use_ssl}",
+      "AUTHENTIK_ERROR_REPORTING__ENABLED=${var.error_reporting.enabled}",
+      "AUTHENTIK_ERROR_REPORTING__ENVIRONMENT=${var.error_reporting.environment}",
+      "AUTHENTIK_ERROR_REPORTING__SEND_PII=${var.error_reporting.send_pii}",
+      "AUTHENTIK_GEOIP=${var.geoip}",
+      "AUTHENTIK_LOG_LEVEL=${var.loglevel}",
+      "AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=${var.image.registry}/${var.image.project}/%(type)s:%(version)s",
+      "AUTHENTIK_POSTGRESQL__HOST=${var.instance}-${var.component}.${var.namespace}.svc",
+      "AUTHENTIK_POSTGRESQL__NAME=${var.component}",
+      "AUTHENTIK_POSTGRESQL__PORT=5432",
+      "AUTHENTIK_POSTGRESQL__USER=${var.component}",
+      "AUTHENTIK_REDIS__HOST=${var.name}-${var.component}-redis",
+      "AUTHENTIK_BOOTSTRAP_EMAIL=${var.admin.email}@${var.domain-name}",
+    ]
+  }
+  patches {
+    target {
+      kind = "Deployment"
+      name = "authentik-server"
+    }
+    patch = <<-EOF
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: authentik-server
+      spec:
+        template:
+          spec:
+            containers:
+              - name: authentik
+                image: "${var.image.registry}/${var.image.repository}:${var.image.tag}"
+                imagePullPolicy: "${var.image.pullPolicy}"
+                env:
+                - name: AUTHENTIK_POSTGRESQL__PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${var.component}.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+                      key: password
+                envFrom:
+                - secretRef:
+                    name: ${var.component}
+                - configMapRef:
+                    name: ${var.component}
+    EOF
+  }
+  patches {
+    target {
+      kind = "Deployment"
+      name = "authentik-worker"
+    }
+    patch = <<-EOF
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: authentik-worker
+      spec:
+        template:
+          spec:
+            containers:
+              - name: authentik
+                image: "${var.image.registry}/${var.image.repository}:${var.image.tag}"
+                imagePullPolicy: "${var.image.pullPolicy}"
+                env:
+                - name: AUTHENTIK_POSTGRESQL__PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${var.component}.${var.name}-${var.component}.credentials.postgresql.acid.zalan.do
+                      key: password
+                envFrom:
+                - secretRef:
+                    name: ${var.component}
+                - configMapRef:
+                    name: ${var.component}
+    EOF
+  }
+  patches {
+    target {
+      kind = "ClusterRole"
+      name = "authentik-vynil-auth"
+    }
+    patch = <<-EOF
+    - op: replace
+      path: /metadata/name
+      value: authentik-${var.namespace}
+    EOF
+  }
+  patches {
+    target {
+      kind = "ClusterRoleBinding"
+      name = "authentik-vynil-auth"
+    }
+    patch = <<-EOF
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: ClusterRoleBinding
+      metadata:
+        name: authentik-vynil-auth
+      roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: ClusterRole
+        name: authentik-${var.namespace}
+      subjects:
+        - kind: ServiceAccount
+          name: authentik
+          namespace: ${var.namespace}
+    EOF
+  }
+  patches {
+    target {
+      kind = "ClusterRoleBinding"
+      name = "authentik-vynil-auth"
+    }
+    patch = <<-EOF
+    - op: replace
+      path: /metadata/name
+      value: authentik-${var.namespace}
+    EOF
+  }
+}

share/authentik/index.yaml

@@ -0,0 +1,207 @@
+---
+apiVersion: vinyl.solidite.fr/v1beta1
+kind: Component
+category: share
+metadata:
+  name: authentik
+  description: authentik is an open-source Identity Provider focused on flexibility and versatility
+options:
+  email:
+    default:
+      port: 587
+      timeout: 30
+      use_ssl: false
+      use_tls: false
+    examples:
+    - port: 587
+      timeout: 30
+      use_ssl: false
+      use_tls: false
+    properties:
+      port:
+        default: 587
+        type: integer
+      timeout:
+        default: 30
+        type: integer
+      use_ssl:
+        default: false
+        type: boolean
+      use_tls:
+        default: false
+        type: boolean
+    type: object
+  geoip:
+    default: /geoip/GeoLite2-City.mmdb
+    examples:
+    - /geoip/GeoLite2-City.mmdb
+    type: string
+  admin:
+    default:
+      email: auth-admin
+    examples:
+    - email: auth-admin
+    properties:
+      email:
+        default: auth-admin
+        type: string
+    type: object
+  image:
+    default:
+      project: goauthentik
+      pullPolicy: IfNotPresent
+      registry: ghcr.io
+      repository: goauthentik/server
+      tag: 2023.5.4
+    examples:
+    - project: goauthentik
+      pullPolicy: IfNotPresent
+      registry: ghcr.io
+      repository: goauthentik/server
+      tag: 2023.5.4
+    properties:
+      project:
+        default: goauthentik
+        type: string
+      pullPolicy:
+        default: IfNotPresent
+        type: string
+      registry:
+        default: ghcr.io
+        type: string
+      repository:
+        default: goauthentik/server
+        type: string
+      tag:
+        default: 2023.5.4
+        type: string
+    type: object
+  error_reporting:
+    default:
+      enabled: false
+      environment: k8s
+      send_pii: false
+    examples:
+    - enabled: false
+      environment: k8s
+      send_pii: false
+    properties:
+      enabled:
+        default: false
+        type: boolean
+      environment:
+        default: k8s
+        type: string
+      send_pii:
+        default: false
+        type: boolean
+    type: object
+  sub-domain:
+    default: auth
+    examples:
+    - auth
+    type: string
+  redis:
+    default:
+      exporter:
+        enabled: true
+        image: quay.io/opstree/redis-exporter:v1.44.0
+      image: quay.io/opstree/redis:v7.0.5
+      storage: 8Gi
+    examples:
+    - exporter:
+        enabled: true
+        image: quay.io/opstree/redis-exporter:v1.44.0
+      image: quay.io/opstree/redis:v7.0.5
+      storage: 8Gi
+    properties:
+      exporter:
+        default:
+          enabled: true
+          image: quay.io/opstree/redis-exporter:v1.44.0
+        properties:
+          enabled:
+            default: true
+            type: boolean
+          image:
+            default: quay.io/opstree/redis-exporter:v1.44.0
+            type: string
+        type: object
+      image:
+        default: quay.io/opstree/redis:v7.0.5
+        type: string
+      storage:
+        default: 8Gi
+        type: string
+    type: object
+  postgres:
+    default:
+      replicas: 1
+      storage: 8Gi
+      version: '14'
+    examples:
+    - replicas: 1
+      storage: 8Gi
+      version: '14'
+    properties:
+      replicas:
+        default: 1
+        type: integer
+      storage:
+        default: 8Gi
+        type: string
+      version:
+        default: '14'
+        type: string
+    type: object
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+  loglevel:
+    default: info
+    examples:
+    - info
+    type: string
+dependencies:
+- dist: null
+  category: core
+  component: cert-manager
+- dist: null
+  category: core
+  component: secret-generator
+- dist: null
+  category: crd
+  component: prometheus
+- dist: null
+  category: crd
+  component: traefik
+- dist: null
+  category: dbo
+  component: postgresql
+- dist: null
+  category: dbo
+  component: redis
+providers:
+  kubernetes: null
+  authentik: true
+  kubectl: true
+  postgresql: null
+  restapi: null
+  http: null

share/authentik/ingress.tf

@@ -0,0 +1,75 @@
+locals {
+    dns-names = ["${var.sub-domain}.${var.domain-name}"]
+    middlewares = ["${var.instance}-https"]
+    service = {
+      "name"  = "${var.instance}"
+      "port" = {
+        "number" = 80
+      }
+    }
+    rules = [ for v in local.dns-names : {
+      "host" = "${v}"
+      "http" = {
+        "paths" = [{
+          "backend"  = {
+            "service" = local.service
+          }
+          "path"     = "/"
+          "pathType" = "Prefix"
+        }]
+      }
+    }]
+}
+
+resource "kubectl_manifest" "prj_certificate" {
+  yaml_body  = <<-EOF
+    apiVersion: "cert-manager.io/v1"
+    kind: "Certificate"
+    metadata:
+      name: "${var.instance}"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+        secretName: "${var.instance}-cert"
+        dnsNames: ${jsonencode(local.dns-names)}
+        issuerRef:
+          name: "${var.issuer}"
+          kind: "ClusterIssuer"
+          group: "cert-manager.io"
+  EOF
+}
+
+resource "kubectl_manifest" "prj_https_redirect" {
+  yaml_body  = <<-EOF
+    apiVersion: "traefik.containo.us/v1alpha1"
+    kind: "Middleware"
+    metadata:
+      name: "${var.instance}-https"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+      redirectScheme:
+        scheme: "https"
+        permanent: true
+  EOF
+}
+
+resource "kubectl_manifest" "prj_ingress" {
+  force_conflicts = true
+  yaml_body  = <<-EOF
+    apiVersion: "networking.k8s.io/v1"
+    kind: "Ingress"
+    metadata:
+      name: "${var.instance}"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+      annotations:
+        "traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
+    spec:
+      ingressClassName: "${var.ingress-class}"
+      rules: ${jsonencode(local.rules)}
+      tls:
+      - hosts: ${jsonencode(local.dns-names)}
+        secretName: "${var.instance}-cert"
+  EOF
+}

share/authentik/monitoring.coreos.com_v1_PrometheusRule_authentik.yaml

@@ -0,0 +1,162 @@
+# Source: authentik/templates/prom-rules.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: authentik
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  groups:
+    - name: authentik Aggregate request counters
+      rules:
+        - record: job:django_http_requests_before_middlewares_total:sum_rate30s
+          expr: sum(rate(django_http_requests_before_middlewares_total[30s])) by (job)
+        - record: job:django_http_requests_unknown_latency_total:sum_rate30s
+          expr: sum(rate(django_http_requests_unknown_latency_total[30s])) by (job)
+        - record: job:django_http_ajax_requests_total:sum_rate30s
+          expr: sum(rate(django_http_ajax_requests_total[30s])) by (job)
+        - record: job:django_http_responses_before_middlewares_total:sum_rate30s
+          expr: sum(rate(django_http_responses_before_middlewares_total[30s])) by (job)
+        - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
+          expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s])) by (job)
+        - record: job:django_http_requests_body_total_bytes:sum_rate30s
+          expr: sum(rate(django_http_requests_body_total_bytes[30s])) by (job)
+        - record: job:django_http_responses_streaming_total:sum_rate30s
+          expr: sum(rate(django_http_responses_streaming_total[30s])) by (job)
+        - record: job:django_http_responses_body_total_bytes:sum_rate30s
+          expr: sum(rate(django_http_responses_body_total_bytes[30s])) by (job)
+        - record: job:django_http_requests_total:sum_rate30s
+          expr: sum(rate(django_http_requests_total_by_method[30s])) by (job)
+        - record: job:django_http_requests_total_by_method:sum_rate30s
+          expr: sum(rate(django_http_requests_total_by_method[30s])) by (job,method)
+        - record: job:django_http_requests_total_by_transport:sum_rate30s
+          expr: sum(rate(django_http_requests_total_by_transport[30s])) by (job,transport)
+        - record: job:django_http_requests_total_by_view:sum_rate30s
+          expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view)
+        - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
+          expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view,transport,method)
+        - record: job:django_http_responses_total_by_templatename:sum_rate30s
+          expr: sum(rate(django_http_responses_total_by_templatename[30s])) by (job,templatename)
+        - record: job:django_http_responses_total_by_status:sum_rate30s
+          expr: sum(rate(django_http_responses_total_by_status[30s])) by (job,status)
+        - record: job:django_http_responses_total_by_status_name_method:sum_rate30s
+          expr: sum(rate(django_http_responses_total_by_status_name_method[30s])) by (job,status,name,method)
+        - record: job:django_http_responses_total_by_charset:sum_rate30s
+          expr: sum(rate(django_http_responses_total_by_charset[30s])) by (job,charset)
+        - record: job:django_http_exceptions_total_by_type:sum_rate30s
+          expr: sum(rate(django_http_exceptions_total_by_type[30s])) by (job,type)
+        - record: job:django_http_exceptions_total_by_view:sum_rate30s
+          expr: sum(rate(django_http_exceptions_total_by_view[30s])) by (job,view)
+
+    - name: authentik Aggregate latency histograms
+      rules:
+        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+          expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "50"
+        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+          expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "95"
+        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+          expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "99"
+        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+          expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "99.9"
+        - record: job:django_http_requests_latency_seconds:quantile_rate30s
+          expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "50"
+        - record: job:django_http_requests_latency_seconds:quantile_rate30s
+          expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "95"
+        - record: job:django_http_requests_latency_seconds:quantile_rate30s
+          expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "99"
+        - record: job:django_http_requests_latency_seconds:quantile_rate30s
+          expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+          labels:
+            quantile: "99.9"
+
+    - name: authentik Aggregate model operations
+      rules:
+        - record: job:django_model_inserts_total:sum_rate1m
+          expr: sum(rate(django_model_inserts_total[1m])) by (job, model)
+        - record: job:django_model_updates_total:sum_rate1m
+          expr: sum(rate(django_model_updates_total[1m])) by (job, model)
+        - record: job:django_model_deletes_total:sum_rate1m
+          expr: sum(rate(django_model_deletes_total[1m])) by (job, model)
+    - name: authentik Aggregate database operations
+      rules:
+        - record: job:django_db_new_connections_total:sum_rate30s
+          expr: sum(rate(django_db_new_connections_total[30s])) by (alias, vendor)
+        - record: job:django_db_new_connection_errors_total:sum_rate30s
+          expr: sum(rate(django_db_new_connection_errors_total[30s])) by (alias, vendor)
+        - record: job:django_db_execute_total:sum_rate30s
+          expr: sum(rate(django_db_execute_total[30s])) by (alias, vendor)
+        - record: job:django_db_execute_many_total:sum_rate30s
+          expr: sum(rate(django_db_execute_many_total[30s])) by (alias, vendor)
+        - record: job:django_db_errors_total:sum_rate30s
+          expr: sum(rate(django_db_errors_total[30s])) by (alias, vendor, type)
+
+    - name: authentik Aggregate migrations
+      rules:
+        - record: job:django_migrations_applied_total:max
+          expr: max(django_migrations_applied_total) by (job, connection)
+        - record: job:django_migrations_unapplied_total:max
+          expr: max(django_migrations_unapplied_total) by (job, connection)
+
+    - name: authentik Alerts
+      rules:
+        - alert: NoWorkersConnected
+          labels:
+            severity: critical
+          expr: max without (pid) (authentik_admin_workers) < 1
+          for: 10m
+          annotations:
+            
+            summary: No workers connected
+            message: authentik instance {{ $labels.instance }}'s worker are either not running or not connected.
+            
+
+
+        - alert: PendingMigrations
+          labels:
+            severity: critical
+          expr: max without (pid) (django_migrations_unapplied_total) > 0
+          for: 10m
+          annotations:
+            
+            summary: Pending database migrations
+            message: authentik instance {{ $labels.instance }} has pending database migrations
+            
+
+        - alert: FailedSystemTasks
+          labels:
+            severity: critical
+          expr: sum(increase(authentik_system_tasks{status="error"}[2h])) > 0
+          for: 2h
+          annotations:
+            
+            summary: Failed system tasks
+            message: System task {{ $labels.task_name }} has failed
+            
+
+        - alert: DisconnectedOutposts
+          labels:
+            severity: critical
+          expr: sum by (outpost) (max without (pid) (authentik_outposts_connected{uid!~"specific.*"}))  < 1
+          for: 30m
+          annotations:
+            
+            summary: Disconnected outpost
+            message: Outpost {{ $labels.outpost }} has at least 1 disconnected instance

share/authentik/monitoring.coreos.com_v1_ServiceMonitor_authentik.yaml

@@ -0,0 +1,20 @@
+# Source: authentik/templates/prom-service-monitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  endpoints:
+    - port: http-metrics
+      scrapeTimeout: 3s
+      interval: 30s
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: authentik

share/authentik/postgresql.tf

@@ -0,0 +1,26 @@
+resource "kubectl_manifest" "authentik_postgresql" {
+  yaml_body  = <<-EOF
+    apiVersion: "acid.zalan.do/v1"
+    kind: "postgresql"
+    metadata:
+      name: "${var.instance}-${var.component}"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+      databases:
+        ${var.component}: "${var.component}"
+      numberOfInstances: ${var.postgres.replicas}
+      podAnnotations:
+        "k8up.io/backupcommand": "pg_dump -U postgres -d ${var.component} --clean"
+        "k8up.io/file-extension": ".sql"
+      postgresql:
+        version: "${var.postgres.version}"
+      teamId: "${var.instance}"
+      users:
+        ${var.component}:
+          - "superuser"
+          - "createdb"
+      volume:
+        size: "${var.postgres.storage}"
+  EOF
+}

share/authentik/rbac.authorization.k8s.io_v1_ClusterRoleBinding_authentik-vynil-auth.yaml

@@ -0,0 +1,19 @@
+# Source: authentik/charts/serviceAccount/templates/cluster-role-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: authentik-vynil-auth
+  labels:
+    helm.sh/chart: serviceAccount-1.2.2
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.0"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authentik-vynil-auth
+subjects:
+  - kind: ServiceAccount
+    name: authentik
+    namespace: vynil-auth

share/authentik/rbac.authorization.k8s.io_v1_ClusterRole_authentik-vynil-auth.yaml

@@ -0,0 +1,18 @@
+# Source: authentik/charts/serviceAccount/templates/cluster-role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: authentik-vynil-auth
+  labels:
+    helm.sh/chart: serviceAccount-1.2.2
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list

share/authentik/rbac.authorization.k8s.io_v1_RoleBinding_authentik.yaml

@@ -0,0 +1,20 @@
+# Source: authentik/charts/serviceAccount/templates/role-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik
+  namespace: vynil-auth
+  labels:
+    helm.sh/chart: serviceAccount-1.2.2
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.0"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: authentik
+subjects:
+  - kind: ServiceAccount
+    name: authentik
+    namespace: vynil-auth

share/authentik/rbac.authorization.k8s.io_v1_Role_authentik.yaml

@@ -0,0 +1,74 @@
+# Source: authentik/charts/serviceAccount/templates/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: authentik
+  namespace: vynil-auth
+  labels:
+    helm.sh/chart: serviceAccount-1.2.2
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+      - services
+      - configmaps
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - patch
+  - apiGroups:
+      - extensions
+      - apps
+    resources:
+      - deployments
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - patch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - patch
+  - apiGroups:
+      - traefik.containo.us
+      - traefik.io
+    resources:
+      - middlewares
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - patch
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - patch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list

share/authentik/redis.tf

@@ -0,0 +1,30 @@
+resource "kubectl_manifest" "authentik_redis" {
+  yaml_body  = <<-EOF
+    apiVersion: "redis.redis.opstreelabs.in/v1beta1"
+    kind: "Redis"
+    metadata:
+      name: "${var.name}-${var.component}-redis"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+      kubernetesConfig:
+        image: "${var.redis.image}"
+        imagePullPolicy: "IfNotPresent"
+        redisSecret:
+          name: "${var.component}"
+          key: "AUTHENTIK_REDIS__PASSWORD"
+      storage:
+        volumeClaimTemplate:
+          spec:
+            accessModes: ["ReadWriteOnce"]
+            resources:
+              requests:
+                storage: "${var.redis.storage}"
+      redisExporter:
+        enabled: ${var.redis.exporter.enabled}
+        image: "${var.redis.exporter.image}"
+      securityContext:
+        runAsUser: 1000
+        fsGroup: 1000
+  EOF
+}

share/authentik/secret.tf

@@ -0,0 +1,23 @@
+
+resource "kubectl_manifest" "authentik_secret" {
+  ignore_fields = ["metadata.annotations"]
+  yaml_body  = <<-EOF
+    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
+    kind: "StringSecret"
+    metadata:
+      name: "${var.component}"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+      forceRegenerate: false
+      fields:
+      - fieldName: "AUTHENTIK_SECRET_KEY"
+        length: "128"
+      - fieldName: "AUTHENTIK_BOOTSTRAP_PASSWORD"
+        length: "32"
+      - fieldName: "AUTHENTIK_BOOTSTRAP_TOKEN"
+        length: "64"
+      - fieldName: "AUTHENTIK_REDIS__PASSWORD"
+        length: "32"
+  EOF
+}

share/authentik/v1_ServiceAccount_authentik.yaml

@@ -0,0 +1,12 @@
+# Source: authentik/charts/serviceAccount/templates/service-account.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authentik
+  namespace: vynil-auth
+  labels:
+    helm.sh/chart: serviceAccount-1.2.2
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.0"
+    app.kubernetes.io/managed-by: Helm

share/authentik/v1_Service_authentik.yaml

@@ -0,0 +1,26 @@
+# Source: authentik/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik
+  labels:
+    helm.sh/chart: authentik-2023.6.3
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/version: "2023.6.1"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9300
+      name: http-metrics
+      protocol: TCP
+      targetPort: http-metrics
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: authentik
+    app.kubernetes.io/component: "server"