Allow defining Providers and Applications via Kubernetes Resources

[benedikt-bartscher]

Maybe it's a good idea to add CRDs to define Authentik Providers and Applications with Kubernetes Resources. Applications could provide these Resources in their Helm Charts and pass all secret information via K8 Secrets.
This would be a big improvement for security and useability reasons.

[sdimovv]

You should already be able to define those via blueprints. Blueprints are just yaml files, so you can store them as config maps and mount them in the worker container.

[genofire]

That is a good news - i will try to extends the helm-chart with:
https://github.com/kiwigrid/k8s-sidecar

to collect all the different ConfigMap and Secrets in the Cluster and give them Authentik.
(better then patch every time authentik for a new blueprint)

like it does grafana for dashboards and datasources:

Pod:
https://github.com/grafana/helm-charts/blob/a07a658305acd34810b3778e9be741ba74b8b258/charts/grafana/templates/_pod.tpl#L335-L444

Values:
https://github.com/grafana/helm-charts/blob/a07a658305acd34810b3778e9be741ba74b8b258/charts/grafana/values.yaml#L771-L873

---

Is there an API to force reload (and not to wait 1h till new blueprints take effect)?

[BeryJu]

The authentik worker uses ionotify to get events when a blueprint file is created/updated and will trigger the task to deal with it. Removed files are not automatically removed from this event, but there's a scheduled task that deletes blueprint instances in authentik if the file is not able to be fetched (only blueprints that use file based storage)

[genofire]

Thats is good to know, theb i have miss understand that:

https://goauthentik.io/developer-docs/blueprints/

As a Blueprint instance, which is a YAML file mounted into the authentik (worker) container. This file is read and applied regularly (every 60 minutes). Multiple instances can be created for a single blueprint file, and instances can be given context key:value attributes to configure the blueprint.

[genofire]

I solve it with this sidecar see HelmChart PR goauthentik/helm#146

[genofire]

@BeryJu please review

[genofire]

i start also develop an HelmChart which setup an blueprint for an OAuth2 Application here:
https://codeberg.org/Sum7/Kubernetes/src/branch/main/charts/helper/authentik-application

I setup oidc for weave gitops (https://docs.gitops.weave.works/docs/configuration/oidc-access/) with it here:
https://codeberg.org/Sum7/Kubernetes/src/branch/main/clusters/sum7-00/apps/gitops/auth-release.yaml

[genofire]

Removing has to change the ConfigMap/Secret ;( - for a easy solution i create this issue #5300

[benedikt-bartscher]

Closing in favor of #5675