2025.12 upgrade

2026-01-22 15:38:45 +11:00
parent 7e1f361aa3
commit a21da49351
112 changed files with 13484 additions and 0 deletions
--- a/templates/worker/deployment.yaml
+++ b/templates/worker/deployment.yaml
@@ -0,0 +1,258 @@
+{{- if .Values.worker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "authentik.worker.fullname" . }}
+  namespace: {{ include "authentik.namespace" . | quote }}
+  labels:
+    {{- include "authentik.labels" (dict "context" . "component" .Values.worker.name) | nindent 4 }}
+  {{- with (mergeOverwrite (deepCopy .Values.global.deploymentAnnotations) .Values.worker.deploymentAnnotations) }}
+  annotations:
+    {{- range $key, $value := . }}
+    {{ $key}}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
+spec:
+  {{- with include "authentik.strategy" (mergeOverwrite (deepCopy .Values.global.deploymentStrategy) .Values.worker.deploymentStrategy) }}
+  strategy:
+    {{- trim . | nindent 4 }}
+  {{- end }}
+  {{- if not .Values.worker.autoscaling.enabled }}
+  replicas: {{ .Values.worker.replicas }}
+  {{- end }}
+  revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "authentik.selectorLabels" (dict "context" . "component" .Values.worker.name) | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "authentik.labels" (dict "context" . "component" .Values.worker.name) | nindent 8 }}
+        {{- with (mergeOverwrite (deepCopy .Values.global.podLabels) .Values.worker.podLabels) }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with (mergeOverwrite (deepCopy .Values.global.podAnnotations) .Values.worker.podAnnotations) }}
+        {{- range $key, $value := . }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
+    spec:
+      {{- with .Values.worker.imagePullSecrets | default .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.serviceAccountName }}
+      serviceAccountName: {{ . }}
+      {{- with $.Values.worker.automountServiceAccountToken }}
+      automountServiceAccountToken:  {{ . }}
+      {{- end }}
+      {{- else }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "authentik-remote-cluster.fullname" .Subcharts.serviceAccount }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with (mergeOverwrite (deepCopy .Values.global.securityContext) .Values.worker.securityContext) }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.priorityClassName | default .Values.global.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
+      {{- if .Values.worker.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- with .Values.worker.initContainers }}
+      initContainers:
+        {{- tpl (toYaml . ) $ | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: {{ .Values.worker.name }}
+          image: {{ default .Values.global.image.repository .Values.worker.image.repository }}:{{ default (include "authentik.defaultTag" .) .Values.worker.image.tag }}{{- if (default .Values.global.image.digest .Values.worker.image.digest) -}}@{{ default .Values.global.image.digest .Values.worker.image.digest }}{{- end }}
+          imagePullPolicy: {{ default .Values.global.image.pullPolicy .Values.worker.image.pullPolicy }}
+          args:
+            - worker
+          env:
+            {{- with (concat .Values.global.env .Values.worker.env) }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            - name: AUTHENTIK_LISTEN__HTTP
+              value: {{ printf "0.0.0.0:%v" .Values.worker.containerPorts.http | quote }}
+            - name: AUTHENTIK_LISTEN__METRICS
+              value: {{ printf "0.0.0.0:%v" .Values.worker.containerPorts.metrics | quote }}
+          envFrom:
+            - secretRef:
+                name: {{ template "authentik.secret.name" . }}
+            {{- with (concat .Values.global.envFrom .Values.worker.envFrom) }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- if or .Values.geoip.enabled .Values.global.volumeMounts .Values.worker.volumeMounts .Values.blueprints.configMaps .Values.blueprints.secrets }}
+          volumeMounts:
+            {{- with .Values.global.volumeMounts }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.worker.volumeMounts }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- if .Values.geoip.enabled }}
+            - name: geoip-db
+              mountPath: /geoip
+            {{- end }}
+            {{- range $name := .Values.blueprints.configMaps }}
+            - name: blueprints-cm-{{ $name }}
+              mountPath: /blueprints/mounted/cm-{{ $name }}
+            {{- end }}
+            {{- range $name := .Values.blueprints.secrets }}
+            - name: blueprints-secret-{{ $name }}
+              mountPath: /blueprints/mounted/secret-{{ $name }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.worker.containerPorts.http }}
+              protocol: TCP
+            - name: metrics
+              containerPort: {{ .Values.worker.containerPorts.metrics }}
+              protocol: TCP
+          {{- with .Values.worker.livenessProbe }}
+          livenessProbe:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.worker.readinessProbe }}
+          readinessProbe:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.worker.startupProbe }}
+          startupProbe:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.worker.resources | nindent 12 }}
+          {{- with .Values.worker.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.worker.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        {{- if .Values.geoip.enabled }}
+        - name: geoip
+          image: {{ .Values.geoip.image.repository }}:{{ .Values.geoip.image.tag }}{{- if .Values.geoip.image.digest -}}@{{ .Values.geoip.image.digest }}{{- end }}
+          imagePullPolicy: {{ .Values.geoip.image.pullPolicy }}
+          env:
+            {{- with .Values.geoip.env }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            - name: GEOIPUPDATE_FREQUENCY
+              value: {{ .Values.geoip.updateInterval | quote }}
+            - name: GEOIPUPDATE_PRESERVE_FILE_TIMES
+              value: "1"
+            {{- if not .Values.geoip.existingSecret.secretName }}
+            - name: GEOIPUPDATE_ACCOUNT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "authentik.fullname" . }}
+                  key: GEOIPUPDATE_ACCOUNT_ID
+            - name: GEOIPUPDATE_LICENSE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "authentik.fullname" . }}
+                  key: GEOIPUPDATE_LICENSE_KEY
+            {{- else }}
+            - name: GEOIPUPDATE_ACCOUNT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.geoip.existingSecret.secretName }}
+                  key: {{ .Values.geoip.existingSecret.accountId }}
+            - name: GEOIPUPDATE_LICENSE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.geoip.existingSecret.secretName }}
+                  key: {{ .Values.geoip.existingSecret.licenseKey }}
+            {{- end }}
+            - name: GEOIPUPDATE_EDITION_IDS
+              value: {{ required "geoip edition id required" .Values.geoip.editionIds | quote }}
+          {{- with .Values.geoip.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- with .Values.geoip.volumeMounts }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            - name: geoip-db
+              mountPath: /usr/share/GeoIP
+          resources:
+            {{- toYaml .Values.geoip.resources | nindent 12 }}
+          {{- with .Values.geoip.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        {{- end }}
+        {{- with .Values.worker.extraContainers }}
+          {{- tpl (toYaml . ) $ | nindent 8 }}
+        {{- end }}
+      {{- with include "authentik.affinity" (dict "context" . "component" .Values.worker) }}
+      affinity:
+        {{- trim . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.nodeSelector | default .Values.global.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.tolerations | default .Values.global.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.topologySpreadConstraints | default .Values.global.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- range $constraint := . }}
+      - {{ toYaml $constraint | nindent 8 | trim }}
+        {{- if not $constraint.labelSelector }}
+        labelSelector:
+          matchLabels:
+            {{- include "authentik.selectorLabels" (dict "context" $ "component" $.Values.worker.name) | nindent 12 }}
+        {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if or .Values.geoip.enabled .Values.global.volumes .Values.worker.volumes .Values.blueprints.configMaps .Values.blueprints.secrets }}
+      volumes:
+      {{- with .Values.global.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.geoip.enabled }}
+        - name: geoip-db
+          emptyDir: {}
+      {{- end }}
+      {{- range $name := .Values.blueprints.configMaps }}
+        - name: blueprints-cm-{{ $name }}
+          configMap:
+            name: {{ $name }}
+      {{- end }}
+      {{- range $name := .Values.blueprints.secrets }}
+        - name: blueprints-secret-{{ $name }}
+          secret:
+            secretName: {{ $name }}
+      {{- end }}
+      {{- end }}
+      enableServiceLinks: true
+      {{- if .Values.worker.hostNetwork }}
+      hostNetwork: {{ .Values.worker.hostNetwork }}
+      {{- end }}
+      {{- with .Values.worker.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.worker.dnsPolicy }}
+      dnsPolicy: {{ .Values.worker.dnsPolicy }}
+      {{- end }}
+{{- end }}
--- a/templates/worker/hpa.yaml
+++ b/templates/worker/hpa.yaml
@@ -0,0 +1,47 @@
+{{- if .Values.worker.enabled }}
+{{- if .Values.worker.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "authentik.worker.fullname" . }}
+  namespace: {{ include "authentik.namespace" . | quote }}
+  labels:
+    {{- include "authentik.labels" (dict "context" . "component" .Values.worker.name) | nindent 4 }}
+  {{- with .Values.worker.autoscaling.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "authentik.worker.fullname" . }}
+  minReplicas: {{ .Values.worker.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.worker.autoscaling.maxReplicas }}
+  metrics:
+  {{- with .Values.worker.autoscaling.metrics }}
+    {{- toYaml . | nindent 4 }}
+  {{- else }}
+    {{- with .Values.worker.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+    {{- with .Values.worker.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+  {{- end }}
+  {{- with .Values.worker.autoscaling.behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
--- a/templates/worker/metrics.yaml
+++ b/templates/worker/metrics.yaml
@@ -0,0 +1,34 @@
+{{- if and .Values.worker.enabled .Values.worker.metrics.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "authentik.worker.fullname" . }}-metrics
+  namespace: {{ include "authentik.namespace" . | quote }}
+  labels:
+    {{- include "authentik.labels" (dict "context" . "component" (printf "%s-metrics" .Values.worker.name)) | nindent 4 }}
+    {{- with .Values.worker.metrics.service.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- if or .Values.worker.metrics.service.annotations .Values.global.addPrometheusAnnotations }}
+  annotations:
+    {{- if .Values.global.addPrometheusAnnotations }}
+    prometheus.io/port: {{ .Values.worker.metrics.service.servicePort | quote }}
+    prometheus.io/scrape: "true"
+    {{- end }}
+    {{- range $key, $value := .Values.worker.metrics.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
+spec:
+  type: {{ .Values.worker.metrics.service.type }}
+  {{- if and .Values.worker.metrics.service.clusterIP (eq .Values.worker.metrics.service.type "ClusterIP") }}
+  clusterIP: {{ .Values.worker.metrics.service.clusterIP }}
+  {{- end }}
+  ports:
+  - name: {{ .Values.worker.metrics.service.portName }}
+    protocol: TCP
+    port: {{ .Values.worker.metrics.service.servicePort }}
+    targetPort: metrics
+  selector:
+    {{- include "authentik.selectorLabels" (dict "context" . "component" .Values.worker.name) | nindent 4 }}
+{{- end }}
--- a/templates/worker/pdb.yaml
+++ b/templates/worker/pdb.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.worker.enabled }}
+{{- if .Values.worker.pdb.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "authentik.worker.fullname" . }}
+  namespace: {{ include "authentik.namespace" . | quote }}
+  labels:
+    {{- include "authentik.labels" (dict "context" . "component" .Values.worker.name) | nindent 4 }}
+    {{- with .Values.worker.pdb.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{ with .Values.worker.pdb.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.worker.pdb.maxUnavailable }}
+  maxUnavailable: {{ . }}
+  {{- else }}
+  minAvailable: {{ .Values.worker.pdb.minAvailable | default 0 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "authentik.selectorLabels" (dict "context" . "component" .Values.worker.name) | nindent 6 }}
+{{- end }}
+{{- end }}
--- a/templates/worker/servicemonitor.yaml
+++ b/templates/worker/servicemonitor.yaml
@@ -0,0 +1,50 @@
+{{- if and .Values.worker.enabled .Values.worker.metrics.enabled .Values.worker.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "authentik.worker.fullname" . }}
+  namespace: {{ .Values.worker.metrics.serviceMonitor.namespace | default (include "authentik.namespace" .) | quote }}
+  labels:
+    {{- include "authentik.labels" (dict "context" . "component" (printf "%s-metrics" .Values.worker.name)) | nindent 4 }}
+    {{- with .Values.worker.metrics.serviceMonitor.selector }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.worker.metrics.serviceMonitor.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.worker.metrics.serviceMonitor.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  endpoints:
+    - port: {{ .Values.worker.metrics.service.portName }}
+      {{- with .Values.worker.metrics.serviceMonitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.worker.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      path: /metrics
+      {{- with .Values.worker.metrics.serviceMonitor.relabelings }}
+      relabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.metrics.serviceMonitor.metricRelabelings }}
+      metricRelabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.metrics.serviceMonitor.scheme }}
+      scheme: {{ . }}
+      {{- end }}
+      {{- with .Values.worker.metrics.serviceMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "authentik.namespace" . }}
+  selector:
+    matchLabels:
+      {{- include "authentik.selectorLabels" (dict "context" . "component" (printf "%s-metrics" .Values.worker.name)) | nindent 6 }}
+{{- end }}