Jeffrey/Kubernetes-Manifests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

authentik: migrate to envFrom with per-container InfisicalSecrets

Browse Source 
Server and worker share one Secret since their env is byte-identical. Database and SMTP values are Infisical references rather than copies.
This commit is contained in:
Jeffrey
2026-08-24 00:16:26 +02:00
parent 3e13b76c6a
commit 079830a8ff
5 changed files with 39 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/authentik/postgres/authentik-postgres-statefulset.yaml
+3 -18
View File
@@ -19,24 +19,9 @@ spec:
image: postgres:16-alpine image: postgres:16-alpine
ports: ports:
- containerPort: 5432 - containerPort: 5432
env: envFrom:
- name: POSTGRES_DB - secretRef:
valueFrom: name: authentik-postgres-secrets
secretKeyRef:
name: authentik-secrets
key: db_name
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_user
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_password
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts: volumeMounts:
- name: data - name: data
mountPath: /var/lib/postgresql/data mountPath: /var/lib/postgresql/data
applications/authentik/postgres/infisicalsecret.yaml
+25
View File
@@ -0,0 +1,25 @@
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
name: authentik-postgres-secrets
namespace: infisical
spec:
hostAPI: https://infisical.jsme.be
resyncInterval: 30
authentication:
kubernetesAuth:
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
serviceAccountRef:
name: infisical-auth
namespace: infisical
autoCreateServiceAccountToken: true
secretsScope:
projectSlug: "kubernetes"
envSlug: "prod"
secretsPath: "/authentik/postgres"
# Non-recursive: keys are already named as the container expects.
recursive: false
managedSecretReference:
secretName: authentik-postgres-secrets
secretNamespace: authentik
secretType: Opaque
applications/authentik/server/authentik-server-deployment.yaml
+3 -56
View File
@@ -25,62 +25,9 @@ spec:
name: http name: http
- containerPort: 9443 - containerPort: 9443
name: https name: https
env: envFrom:
- name: AUTHENTIK_POSTGRESQL__HOST - secretRef:
valueFrom: name: authentik-app-secrets
secretKeyRef:
name: authentik-secrets
key: db_host
- name: AUTHENTIK_POSTGRESQL__NAME
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_name
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_user
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_password
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secrets
key: AUTHENTIK_SECRET_KEY
- name: AUTHENTIK_EMAIL__HOST
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_host
- name: AUTHENTIK_EMAIL__PORT
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_port
- name: AUTHENTIK_EMAIL__USERNAME
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_username
- name: AUTHENTIK_EMAIL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_password
- name: AUTHENTIK_EMAIL__FROM
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_from
- name: AUTHENTIK_EMAIL__USE_TLS
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_use_tls
volumeMounts: volumeMounts:
- name: data - name: data
mountPath: /data mountPath: /data
applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml → applications/authentik/server/infisicalsecret.yaml
+5 -4
View File
@@ -1,7 +1,7 @@
apiVersion: secrets.infisical.com/v1alpha1 apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret kind: InfisicalSecret
metadata: metadata:
name: authentik-secrets name: authentik-app-secrets
namespace: infisical namespace: infisical
spec: spec:
hostAPI: https://infisical.jsme.be hostAPI: https://infisical.jsme.be
@@ -16,9 +16,10 @@ spec:
secretsScope: secretsScope:
projectSlug: "kubernetes" projectSlug: "kubernetes"
envSlug: "prod" envSlug: "prod"
secretsPath: "/authentik" secretsPath: "/authentik/authentik"
recursive: true # Non-recursive: keys are already named as the container expects.
recursive: false
managedSecretReference: managedSecretReference:
secretName: authentik-secrets secretName: authentik-app-secrets
secretNamespace: authentik secretNamespace: authentik
secretType: Opaque secretType: Opaque
applications/authentik/worker/authentik-worker-deployment.yaml
+3 -56
View File
@@ -22,62 +22,9 @@ spec:
image: ghcr.io/goauthentik/server:2026.5.2 image: ghcr.io/goauthentik/server:2026.5.2
command: ["ak"] command: ["ak"]
args: ["worker"] args: ["worker"]
env: envFrom:
- name: AUTHENTIK_POSTGRESQL__HOST - secretRef:
valueFrom: name: authentik-app-secrets
secretKeyRef:
name: authentik-secrets
key: db_host
- name: AUTHENTIK_POSTGRESQL__NAME
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_name
- name: AUTHENTIK_POSTGRESQL__USER
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_user
- name: AUTHENTIK_POSTGRESQL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: db_password
- name: AUTHENTIK_SECRET_KEY
valueFrom:
secretKeyRef:
name: authentik-secrets
key: AUTHENTIK_SECRET_KEY
- name: AUTHENTIK_EMAIL__HOST
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_host
- name: AUTHENTIK_EMAIL__PORT
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_port
- name: AUTHENTIK_EMAIL__USERNAME
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_username
- name: AUTHENTIK_EMAIL__PASSWORD
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_password
- name: AUTHENTIK_EMAIL__FROM
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_from
- name: AUTHENTIK_EMAIL__USE_TLS
valueFrom:
secretKeyRef:
name: authentik-secrets
key: email_use_tls
volumeMounts: volumeMounts:
- name: data - name: data
mountPath: /data mountPath: /data