authentik: serve LDAP via an outpost behind the internal gateway

Adds the LDAP outpost deployment and routes ports 389 and 636 on gateway-internal to it. 636 is a TLS listener in Terminate mode so cert-manager renews the LDAPS certificate automatically, and both listeners forward to the outpost's plaintext 3389. allowedRoutes.kinds is set explicitly on both listeners: a TCP listener permits no route kinds by default and a TLS listener defaults to TLSRoute, so the TCPRoute would not attach otherwise.
2026-09-13 11:24:23 +02:00
parent 7ee7db2346
commit c1287fa343
7 changed files with 165 additions and 0 deletions
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-ldap
+  ports:
+    - name: ldap
+      port: 3389
+      targetPort: 3389
+    - name: metrics
+      port: 9300
+      targetPort: 9300