apiVersion: apps/v1 kind: Deployment metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: authentik app.kubernetes.io/part-of: authentik app.kubernetes.io/version: 2026.2.2 helm.sh/chart: authentik-2026.2.2 name: authentik-server namespace: infra spec: progressDeadlineSeconds: 600 replicas: 2 revisionHistoryLimit: 3 selector: matchLabels: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/name: authentik strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d kubectl.kubernetes.io/restartedAt: 2026-10-28 22:52:19.572345 labels: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: authentik app.kubernetes.io/part-of: authentik app.kubernetes.io/version: 2026.2.2 helm.sh/chart: authentik-2026.2.2 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/name: authentik topologyKey: kubernetes.io/hostname weight: 100 containers: - args: - server env: - name: AUTHENTIK_LISTEN__HTTP value: 0.0.0.0:9000 - name: AUTHENTIK_LISTEN__HTTPS value: 0.0.0.0:9443 - name: AUTHENTIK_LISTEN__METRICS value: 0.0.0.0:9300 envFrom: - secretRef: name: authentik image: ghcr.io/goauthentik/server:2026.2.2 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /-/health/live/ port: http scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 name: server ports: - containerPort: 9000 name: http protocol: TCP - containerPort: 9443 name: https protocol: TCP - containerPort: 9300 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /-/health/ready/ port: http scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 resources: {} startupProbe: failureThreshold: 60 httpGet: path: /-/health/live/ port: http scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: true restartPolicy: Always schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 30 --- apiVersion: apps/v1 kind: Deployment metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: worker app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: authentik app.kubernetes.io/part-of: authentik app.kubernetes.io/version: 2026.2.2 helm.sh/chart: authentik-2026.2.2 name: authentik-worker namespace: infra spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 3 selector: matchLabels: app.kubernetes.io/component: worker app.kubernetes.io/instance: authentik app.kubernetes.io/name: authentik strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d labels: app.kubernetes.io/component: worker app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: authentik app.kubernetes.io/part-of: authentik app.kubernetes.io/version: 2026.2.2 helm.sh/chart: authentik-2026.2.2 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: worker app.kubernetes.io/instance: authentik app.kubernetes.io/name: authentik topologyKey: kubernetes.io/hostname weight: 100 containers: - args: - worker env: - name: AUTHENTIK_LISTEN__HTTP value: 0.0.0.0:9000 - name: AUTHENTIK_LISTEN__METRICS value: 0.0.0.0:9300 envFrom: - secretRef: name: authentik image: ghcr.io/goauthentik/server:2026.2.2 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - ak - healthcheck failureThreshold: 3 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 name: worker ports: - containerPort: 9000 name: http protocol: TCP - containerPort: 9300 name: metrics protocol: TCP readinessProbe: exec: command: - ak - healthcheck failureThreshold: 3 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 resources: {} startupProbe: exec: command: - ak - healthcheck failureThreshold: 60 initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst enableServiceLinks: true restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: authentik serviceAccountName: authentik terminationGracePeriodSeconds: 30 --- apiVersion: apps/v1 kind: StatefulSet metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: postgresql app.kubernetes.io/version: 17.6.0 helm.sh/chart: postgresql-16.7.27 name: authentik-postgresql namespace: infra spec: persistentVolumeClaimRetentionPolicy: whenDeleted: Retain whenScaled: Retain podManagementPolicy: OrderedReady replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/name: postgresql serviceName: authentik-postgresql-hl template: metadata: annotations: checksum/configuration: c7768a9df482d4c1de21ac88a598f24ff260dad3ff5925385ab5225b3ef8be39 checksum/extended-configuration: f231c584ead90a4176b09eb6d6073240ab2939b8bd09b20013265962083b3208 labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: postgresql app.kubernetes.io/version: 17.6.0 helm.sh/chart: postgresql-16.7.27 name: authentik-postgresql spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/name: postgresql topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - args: - -c - config_file=/bitnami/postgresql/conf/postgresql.conf - -c - hba_file=/bitnami/postgresql/conf/pg_hba.conf env: - name: BITNAMI_DEBUG value: 'false' - name: POSTGRESQL_PORT_NUMBER value: '5432' - name: POSTGRESQL_VOLUME_DIR value: /bitnami/postgresql - name: PGDATA value: /bitnami/postgresql/data - name: POSTGRES_USER value: authentik - name: POSTGRES_PASSWORD_FILE value: /opt/bitnami/postgresql/secrets/password - name: POSTGRES_POSTGRES_PASSWORD_FILE value: /opt/bitnami/postgresql/secrets/postgres-password - name: POSTGRES_DATABASE value: authentik - name: POSTGRESQL_ENABLE_LDAP value: 'no' - name: POSTGRESQL_ENABLE_TLS value: 'no' - name: POSTGRESQL_LOG_HOSTNAME value: 'false' - name: POSTGRESQL_LOG_CONNECTIONS value: 'false' - name: POSTGRESQL_LOG_DISCONNECTIONS value: 'false' - name: POSTGRESQL_PGAUDIT_LOG_CATALOG value: 'off' - name: POSTGRESQL_CLIENT_MIN_MESSAGES value: error - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES value: pgaudit - name: POSTGRES_DB value: authentik image: docker.io/library/postgres:17.9-bookworm imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -c - exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p 5432 failureThreshold: 6 initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: postgresql ports: - containerPort: 5432 name: tcp-postgresql protocol: TCP readinessProbe: exec: command: - /bin/sh - -c - -e - 'exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p 5432 [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] ' failureThreshold: 6 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /tmp name: empty-dir subPath: tmp-dir - mountPath: /opt/bitnami/postgresql/conf name: empty-dir subPath: app-conf-dir - mountPath: /opt/bitnami/postgresql/tmp name: empty-dir subPath: app-tmp-dir - mountPath: /bitnami/postgresql/conf/conf.d/ name: postgresql-extended-config - mountPath: /opt/bitnami/postgresql/secrets/ name: postgresql-password - mountPath: /dev/shm name: dshm - mountPath: /bitnami/postgresql name: data - mountPath: /bitnami/postgresql/conf name: postgresql-config - mountPath: /var/run/postgresql name: postgresql-socket dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 1001 fsGroupChangePolicy: Always serviceAccount: authentik-postgresql serviceAccountName: authentik-postgresql terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: empty-dir - configMap: defaultMode: 420 name: authentik-postgresql-configuration name: postgresql-config - configMap: defaultMode: 420 name: authentik-postgresql-extended-configuration name: postgresql-extended-config - name: postgresql-password secret: defaultMode: 420 secretName: authentik-postgresql - emptyDir: {} name: postgresql-socket - emptyDir: medium: Memory name: dshm updateStrategy: rollingUpdate: partition: 0 type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: data spec: accessModes: - ReadWriteOnce resources: requests: storage: 8Gi volumeMode: Filesystem status: phase: Pending --- apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: postgresql app.kubernetes.io/version: 17.6.0 helm.sh/chart: postgresql-16.7.27 name: authentik-postgresql namespace: infra spec: clusterIP: 10.43.189.60 clusterIPs: - 10.43.189.60 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: tcp-postgresql port: 5432 protocol: TCP targetPort: tcp-postgresql selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/name: postgresql sessionAffinity: None type: ClusterIP --- apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: postgresql app.kubernetes.io/version: 17.6.0 helm.sh/chart: postgresql-16.7.27 name: authentik-postgresql-hl namespace: infra spec: clusterIP: None clusterIPs: - None internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: tcp-postgresql port: 5432 protocol: TCP targetPort: tcp-postgresql publishNotReadyAddresses: true selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: authentik app.kubernetes.io/name: postgresql sessionAffinity: None type: ClusterIP --- apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: authentik meta.helm.sh/release-namespace: infra labels: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: authentik app.kubernetes.io/part-of: authentik app.kubernetes.io/version: 2026.2.2 helm.sh/chart: authentik-2026.2.2 name: authentik-server namespace: infra spec: clusterIP: 10.43.250.197 clusterIPs: - 10.43.250.197 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: http port: 80 protocol: TCP targetPort: 9000 - name: https port: 443 protocol: TCP targetPort: 9443 selector: app.kubernetes.io/component: server app.kubernetes.io/instance: authentik app.kubernetes.io/name: authentik sessionAffinity: None type: ClusterIP