Setting Up Authentik in Kubernetes: A Complete Guide

August 4, 2024

Setting Up Authentik in Kubernetes: A Complete Guide

Authentik is a powerful open-source identity provider that offers modern authentication and authorization capabilities. In this comprehensive guide, we’ll walk through deploying Authentik in a Kubernetes cluster with PostgreSQL as the database backend, Redis for caching, and proper SSL certificate management.

Prerequisites

Before we begin, ensure you have:

A running Kubernetes cluster (1.20+)
kubectl configured to access your cluster
Helm 3.x installed
NGINX Ingress Controller deployed
cert-manager for SSL certificate management
PostgreSQL Operator (we’ll use Zalando’s PostgreSQL Operator)

Architecture Overview

Our Authentik deployment will consist of:

Authentik server and worker pods
PostgreSQL database (managed by Zalando operator)
Redis for session storage and caching
NGINX Ingress for external access
Let’s Encrypt certificates for SSL/TLS

Step 1: Create the Namespace

First, let’s create a dedicated namespace for Authentik with appropriate security labels:

apiVersion: v1
kind: Namespace
metadata:
  name: authentik
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged

Apply this configuration:

kubectl apply -f namespace.yaml

Step 2: Set Up PostgreSQL Database

We’ll use the Zalando PostgreSQL Operator to manage our database. Create a PostgreSQL cluster:

apiVersion: "acid.zalan.do/v1"
kind: postgresql
metadata:
  name: authentik-postgres
  namespace: authentik
spec:
  teamId: "authentik-team"
  volume:
    size: 5Gi
  numberOfInstances: 2
  users:
    authentik_user:
    - superuser
    - createdb
  databases:
    authentik_db: authentik_user
  postgresql:
    version: "17"

This creates a highly available PostgreSQL cluster with:

5GB storage
2 instances for redundancy
A dedicated user and database for Authentik

Apply the configuration:

kubectl apply -f db.yaml

The operator will automatically create secrets containing the database credentials.

Step 3: Configure Authentik Values

Create a comprehensive Helm values file for Authentik:

authentik:
  secret_key: "your-secret-key-here-make-it-long-and-random-at-32-chars"
  error_reporting:
    enabled: false  # Set to false for privacy
  postgresql:
    host: "authentik-postgres"
    name: "authentik_db"
    user: file:///postgres-creds/username
    password: file:///postgres-creds/password
  email:
    from: "[email protected]"
    host: "smtp.example.com"
    use_tls: true
    username: "smtp-username"
    password: "smtp-password"

server:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
      nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
    tls:
      - secretName: authentik-tls
        hosts:
          - auth.example.com
    hosts:
      - auth.example.com
  volumes:
    - name: postgres-creds
      secret:
        secretName: authentik-postgres.credentials.postgresql.acid.zalan.do # Secret created by Zalando PostgreSQL Operator
  volumeMounts:
    - name: postgres-creds
      mountPath: /postgres-creds
      readOnly: true

# Enable GeoIP for enhanced security
geoip:
  enabled: true

# Disable built-in PostgreSQL since we're using external
postgresql:
  enabled: false

# Enable Redis for session storage
redis:
  enabled: true

worker:
  volumes:
    - name: postgres-creds
      secret:
        secretName: authentik-postgres.credentials.postgresql.acid.zalan.do # Secret created by Zalando PostgreSQL Operator
  volumeMounts:
    - name: postgres-creds
      mountPath: /postgres-creds
      readOnly: true

Step 4: Deploy Authentik with Helm

Add the Authentik Helm repository and deploy:

# Add the Authentik Helm repository
helm repo add authentik https://charts.goauthentik.io
helm repo update

# Install Authentik
helm install authentik authentik/authentik \
  --namespace authentik \
  --values values.yaml

Step 6: Verify the Deployment

Check that all components are running:

# Check pod status
kubectl get pods -n authentik

# Check services
kubectl get svc -n authentik

# Check ingress
kubectl get ingress -n authentik

# Check certificate status
kubectl get certificate -n authentik

Step 6: Initial Configuration

Once Authentik is running, access it via your configured domain (e.g., https://auth.example.com).

Default Credentials

The default admin credentials are:

Username: akadmin
Password: Check the Authentik pod logs or secret for the generated password

kubectl logs -n authentik deployment/authentik-server | grep "Bootstrap"

Basic Configuration Steps

Change the default admin password
Configure your first authentication flow
Set up user sources (LDAP, OAuth, etc.)
Configure applications and providers
Set up groups and permissions

Security Best Practices

1. Secret Management

Never store secrets in plain text. Use Kubernetes secrets or external secret management:

# Create a secret for sensitive data
kubectl create secret generic authentik-secrets \
  --from-literal=secret-key="your-long-secret-key" \
  --from-literal=email-password="your-email-password" \
  -n authentik

2. Network Policies

Implement network policies to restrict traffic:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: authentik-network-policy
  namespace: authentik
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: authentik
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: authentik
  - to: []
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

3. Resource Limits

Set appropriate resource limits:

server:
  resources:
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      cpu: 500m
      memory: 1Gi

worker:
  resources:
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      cpu: 500m
      memory: 1Gi

Monitoring and Troubleshooting

Common Issues

Database Connection Issues

kubectl logs -n authentik deployment/authentik-server
kubectl describe secret -n authentik authentik-postgres.credentials.postgresql.acid.zalan.do

Certificate Problems

kubectl describe certificate -n authentik authentik-cert
kubectl logs -n cert-manager deployment/cert-manager

Ingress Issues

kubectl describe ingress -n authentik
kubectl logs -n ingress-nginx deployment/ingress-nginx-controller

Health Checks

Monitor Authentik health:

# Check if Authentik is responding
curl -k https://auth.example.com/-/health/ready/

# Monitor metrics (if enabled)
curl -k https://auth.example.com/-/metrics/

Maintenance and Updates

Backup Strategy

Database Backups: Configure PostgreSQL backups through the operator
Configuration Backup: Export Authentik configuration regularly
Secret Backup: Ensure secrets are backed up securely

Updating Authentik

# Update Helm repository
helm repo update

# Check for available updates
helm search repo authentik/authentik

# Upgrade Authentik
helm upgrade authentik authentik/authentik \
  --namespace authentik \
  --values values.yaml

Conclusion

You now have a fully functional Authentik deployment in Kubernetes with:

High availability PostgreSQL database
Redis for performance optimization
SSL/TLS encryption with automatic certificate renewal
Scalable architecture with separate server and worker components
Proper security configurations

This setup provides a robust foundation for modern authentication and authorization in your Kubernetes environment. Remember to regularly update your deployment, monitor logs, and follow security best practices.

Next Steps

Configure LDAP/Active Directory integration
Set up SAML or OAuth providers
Implement multi-factor authentication
Configure custom branding and flows
Set up monitoring and alerting

For more advanced configurations and integrations, refer to the official Authentik documentation.

Enable Nginx as a reverse proxy with ACME support