unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

authentik: deploy LDAP outpost for in-cluster app-password binds #422

Merged
benvin merged 1 commits from benvin/authentik-ldap-outpost into main 2026-08-26 23:19:24 +10:00
Conversation 0 Commits 1 Files Changed 5
+147
unkin-agent commented 2026-08-26 22:13:18 +10:00
Member
Copy Link
Copy Source

Why

Jellyfin authenticates users against Authentik over LDAP (app-password binds). The authentik-ldap Service, Gateway, and TLSRoute already exist in the authentik base, but nothing backed the Service — no LDAP outpost was ever deployed. This adds the missing Deployment so in-cluster clients (Jellyfin) can bind.

Deployed as a separate Deployment inside the existing authentik namespace rather than a new app/namespace: the authentik overlay is already wired into the platform ApplicationSet and the LDAP Service/Gateway/TLSRoute already live here, so this needs no new AppProject/ApplicationSet wiring and keeps the outpost next to the core it serves.

How

  • ldap-outpost-deployment.yaml: 2-replica (stateless) Deployment, image ghcr.io/goauthentik/ldap:2026.5.3 (canonical upstream name; matches the deployed authentik chart version; containerd mirrors route via artifactapi). Pod labels match the existing authentik-ldap Service selector.
    • AUTHENTIK_HOST=https://identity.k8s.syd1.au.unkin.net, AUTHENTIK_INSECURE=false.
    • Trusts the internal CA via the established combine-certs initContainer pattern (concatenates the base roots with the reflected vault-ca-cert) + SSL_CERT_FILE.
    • AUTHENTIK_TOKEN sourced from secret authentik-ldap-outpost-token.
    • Resources set; TCP probes on the LDAP port; reloader annotation for token + CA rotation.
  • ldap-outpost-vaultstaticsecret.yaml: VSS (reuses the namespace default VaultAuth) materialising the token from KV kubernetes/namespace/authentik/default/outpost-token (key token).
  • ldap-service.yaml: adds the plaintext ldap port 3389 alongside the existing ldaps 6636 (ClusterIP only, no public exposure — external reach is via the pre-existing internal Gateway/TLSRoute).
  • ldap-outpost-vmpodscrape.yaml: VMPodScrape for the outpost metrics endpoint (:9300).
  • No sync-wave annotations.

Dependency — token seed (blocking)

The outpost pods CrashLoop until the token exists. After merge, the Authentik LDAP outpost token must be seeded into Vault KV at kv/kubernetes/namespace/authentik/default/outpost-token with key token. This path is provided by the corresponding terraform-authentik PR; the value must match the outpost token authentik issues.

Validation

kustomize build --enable-helm apps/overlays/au-syd1/authentik + repo kubeconform: 38 resources, Valid: 38, Invalid: 0, Errors: 0.

## Why Jellyfin authenticates users against Authentik over LDAP (app-password binds). The `authentik-ldap` Service, Gateway, and TLSRoute already exist in the authentik base, but nothing backed the Service — no LDAP outpost was ever deployed. This adds the missing Deployment so in-cluster clients (Jellyfin) can bind. Deployed as a separate Deployment inside the existing `authentik` namespace rather than a new app/namespace: the authentik overlay is already wired into the `platform` ApplicationSet and the LDAP Service/Gateway/TLSRoute already live here, so this needs no new AppProject/ApplicationSet wiring and keeps the outpost next to the core it serves. ## How - `ldap-outpost-deployment.yaml`: 2-replica (stateless) Deployment, image `ghcr.io/goauthentik/ldap:2026.5.3` (canonical upstream name; matches the deployed authentik chart version; containerd mirrors route via artifactapi). Pod labels match the existing `authentik-ldap` Service selector. - `AUTHENTIK_HOST=https://identity.k8s.syd1.au.unkin.net`, `AUTHENTIK_INSECURE=false`. - Trusts the internal CA via the established combine-certs initContainer pattern (concatenates the base roots with the reflected `vault-ca-cert`) + `SSL_CERT_FILE`. - `AUTHENTIK_TOKEN` sourced from secret `authentik-ldap-outpost-token`. - Resources set; TCP probes on the LDAP port; reloader annotation for token + CA rotation. - `ldap-outpost-vaultstaticsecret.yaml`: VSS (reuses the namespace `default` VaultAuth) materialising the token from KV `kubernetes/namespace/authentik/default/outpost-token` (key `token`). - `ldap-service.yaml`: adds the plaintext `ldap` port 3389 alongside the existing `ldaps` 6636 (ClusterIP only, no public exposure — external reach is via the pre-existing internal Gateway/TLSRoute). - `ldap-outpost-vmpodscrape.yaml`: VMPodScrape for the outpost metrics endpoint (:9300). - No sync-wave annotations. ## Dependency — token seed (blocking) The outpost pods CrashLoop until the token exists. After merge, the Authentik LDAP outpost token must be seeded into Vault KV at `kv/kubernetes/namespace/authentik/default/outpost-token` with key `token`. This path is provided by the corresponding terraform-authentik PR; the value must match the outpost token authentik issues. ## Validation `kustomize build --enable-helm apps/overlays/au-syd1/authentik` + repo kubeconform: 38 resources, Valid: 38, Invalid: 0, Errors: 0.
unkin-agent added 1 commit 2026-08-26 22:13:18 +10:00
authentik: deploy LDAP outpost for in-cluster app-password binds
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
eb91134fdf 
Adds the Deployment that backs the pre-existing authentik-ldap Service so
Jellyfin's LDAP auth plugin can validate app-password binds in-cluster.
benvin merged commit 8eb57f9c19 into main 2026-08-26 23:19:24 +10:00
benvin deleted branch benvin/authentik-ldap-outpost 2026-08-26 23:19:25 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#422
Delete Branch "benvin/authentik-ldap-outpost"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?