t.behrendt
6a9cefbaf3
CI / install dependencies (pull_request) Failing after 8s
CI / build check (pull_request) Has been skipped
CI / check format (pull_request) Has been skipped
CI / check lint (pull_request) Has been skipped
CI / test (pull_request) Has been skipped
CI / image check (pull_request) Has been skipped
58 lines
2.9 KiB
Markdown
58 lines
2.9 KiB
Markdown
# authentik-kubernetes-operator
|
|
|
|
Authentik Kubernetes Operator allows to manage Authentik resources directly in Kubernetes using Custom Kubernetes Resources.
|
|
|
|
The custom resources of this operator ultimately will mirror the Authentik resources. New resources will be added as there is a need for them.
|
|
|
|
Manual changes to the resources in Authentik will be overwritten by the operator. So always manage the resources in Kubernetes.
|
|
|
|
## Custom Resources
|
|
|
|
| Custom Resource | CRD File | Short Name |
|
|
| --------------- | ---------------------------------------------------------- | ---------- |
|
|
| ProxyProvider | [`proxyProvider.yaml`](`artifacts/crd/proxyProvider.yaml`) | pp |
|
|
|
|
### ProxyProvider
|
|
|
|
Currently only the "Forward Single" ProxyProvider is supported and only a reduced set of fields are exposed by the custom resources.
|
|
|
|
Example [`proxyProvider.yaml`](`artifacts/examples/proxyProvider.yaml`):
|
|
|
|
```yaml
|
|
apiVersion: proxyprovider.t000-n.de/v1alpha1
|
|
kind: ProxyProvider
|
|
metadata:
|
|
name: proxy-provider-example
|
|
namespace: kube-system
|
|
spec:
|
|
name: proxy-provider-example
|
|
# The ID of the authorization flow. In this example: "default-provider-authorization-implicit-consent (Authorize Application)"
|
|
authorization_flow: 16896c6d-b326-42d1-8d3f-93f32921962e
|
|
# The ID of the invalidation flow. In this example: "default-provider-invalidation-flow (Logged out of application)"
|
|
invalidation_flow: 7acac1ef-19e3-4a6f-8d8d-14ca7031d184
|
|
# The external host of your application.
|
|
external_host: https://example.t00n.de
|
|
```
|
|
|
|
The ProxyProvider will be created in Authentik, but will not be assigned to an outpost or an application (Resources are TBD).
|
|
|
|
## Versioning
|
|
|
|
As soon as the operator covers an entire use case, the version will be raised to v1 and follow default versioning rules. Before that, the version will be v1alpha1.
|
|
|
|
## Development
|
|
|
|
### Guidelines & Tips
|
|
|
|
- Only do a single reconciliation at a time and then return.
|
|
- This is because your references from the k8s API get stale after each update.
|
|
- Whenever you update a resource, k8s API will send a new event to your controller, which will trigger a new reconciliation.
|
|
- The API will periodically send a resource to the controller for re-syncing, giving the controller a chance to reconcile the state with the outside world.
|
|
- Use finalizers to ensure that the controller gets a chance to reconcile the state with the outside world before the object is deleted. If no finalizer is present, the object is deleted immediately without the controller seeing it.
|
|
- Use the resource's state to keep track of the current state of the outside world, e.g. identifiers of external resources, etc.
|
|
|
|
### References
|
|
|
|
- [Extend Kubernetes](https://kubernetes.io/docs/concepts/extend-kubernetes/#api-extensions)
|
|
- [Example Controller Implementation](https://github.com/kubernetes/sample-controller)
|