From aa884cd9d286bc50c5eab7ee354eba55c1b626d2 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Fri, 11 Jul 2025 19:49:32 +0200 Subject: [PATCH] fix(authelia): clean up configuration Signed-off-by: Vegard Hagen --- k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml | 4 +- k8s/infra/auth/authelia/cert-rsa-jwk.yaml | 4 +- k8s/infra/auth/authelia/kustomization.yaml | 2 +- .../patches/deployment-host-aliases.yaml | 1 + k8s/infra/auth/authelia/values.yaml | 73 +++++-------------- 5 files changed, 26 insertions(+), 58 deletions(-) diff --git a/k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml b/k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml index 30285ce..002516b 100644 --- a/k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml +++ b/k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml @@ -1,7 +1,7 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: ecdsa-jwk + name: jwk-ecdsa namespace: authelia spec: dnsNames: @@ -14,7 +14,7 @@ spec: algorithm: ECDSA encoding: PKCS8 size: 256 - secretName: ecdsa-jwk + secretName: jwk-ecdsa usages: - digital signature - key encipherment diff --git a/k8s/infra/auth/authelia/cert-rsa-jwk.yaml b/k8s/infra/auth/authelia/cert-rsa-jwk.yaml index c599ddb..945e65d 100644 --- a/k8s/infra/auth/authelia/cert-rsa-jwk.yaml +++ b/k8s/infra/auth/authelia/cert-rsa-jwk.yaml @@ -1,7 +1,7 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: rsa-jwk + name: jwk-rsa namespace: authelia spec: dnsNames: @@ -14,7 +14,7 @@ spec: algorithm: RSA encoding: PKCS8 size: 2048 - secretName: rsa-jwk + secretName: jwk-rsa usages: - digital signature - key encipherment diff --git a/k8s/infra/auth/authelia/kustomization.yaml b/k8s/infra/auth/authelia/kustomization.yaml index 197e2f9..25d8f05 100644 --- a/k8s/infra/auth/authelia/kustomization.yaml +++ b/k8s/infra/auth/authelia/kustomization.yaml @@ -20,7 +20,7 @@ helmCharts: repo: https://charts.authelia.com releaseName: authelia namespace: authelia - version: 0.10.11 + version: 0.10.34 valuesFile: values.yaml patches: diff --git a/k8s/infra/auth/authelia/patches/deployment-host-aliases.yaml b/k8s/infra/auth/authelia/patches/deployment-host-aliases.yaml index 5b75140..dbb2ff6 100644 --- a/k8s/infra/auth/authelia/patches/deployment-host-aliases.yaml +++ b/k8s/infra/auth/authelia/patches/deployment-host-aliases.yaml @@ -2,6 +2,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: authelia + namespace: authelia spec: template: spec: diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml index 2ffc92f..08eec65 100644 --- a/k8s/infra/auth/authelia/values.yaml +++ b/k8s/infra/auth/authelia/values.yaml @@ -17,10 +17,6 @@ configMap: log: level: info - identity_validation: - reset_password: - secret: { secret_name: crypto } - access_control: default_policy: deny rules: @@ -28,12 +24,9 @@ configMap: policy: two_factor session: - encryption_key: { secret_name: crypto } - cookies: - - domain: stonegarden.dev + cookies: [ { domain: stonegarden.dev } ] storage: - encryption_key: { secret_name: crypto } postgres: enabled: true deploy: false @@ -69,18 +62,17 @@ configMap: oidc: ## Currently in beta stage. See https://www.authelia.com/r/openid-connect/ enabled: true - hmac_secret: { secret_name: crypto } jwks: - key_id: default algorithm: RS256 use: sig - key: { path: /secrets/rsa-jwk/tls.key } - certificate_chain: { path: /secrets/rsa-jwk/tls.crt } + key: { path: /secrets/jwk-rsa/tls.key } + certificate_chain: { path: /secrets/jwk-rsa/tls.crt } - key_id: ecdsa256 algorithm: ES256 use: sig - key: { path: /secrets/ecdsa-jwk/tls.key } - certificate_chain: { path: /secrets/ecdsa-jwk/tls.crt } + key: { path: /secrets/jwk-ecdsa/tls.key } + certificate_chain: { path: /secrets/jwk-ecdsa/tls.crt } cors: allowed_origins_from_client_redirect_uris: true endpoints: [ userinfo, authorization, token, revocation, introspection ] @@ -89,7 +81,7 @@ configMap: custom_claims: audiobookshelf: { attribute: audiobookshelf_groups } # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter - default: + legacy: id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ] username_email: id_token: [ email, email_verified, alt_emails, name, preferred_username ] @@ -146,7 +138,7 @@ configMap: client_name: kubectl public: true authorization_policy: two_factor - claims_policy: default + claims_policy: legacy pre_configured_consent_duration: 1 month require_pkce: true redirect_uris: [ http://localhost:8000, http://localhost:18000 ] @@ -175,50 +167,25 @@ configMap: token_endpoint_auth_method: client_secret_post secret: + existingSecret: crypto additionalSecrets: authelia-postgres-app: - items: - - key: password - path: storage.postgres.password.txt + items: [ { key: password, path: storage.postgres.password.txt } ] lldap-auth: - items: - - key: password - path: authentication.ldap.password.txt + items: [ { key: password, path: authentication.ldap.password.txt } ] smtp-auth: + items: [ { key: password, path: notifier.smtp.password.txt } ] + jwk-rsa: items: - - key: password - path: notifier.smtp.password.txt - crypto: + - { key: tls.key, path: tls.key } + - { key: tls.crt, path: tls.crt } + jwk-ecdsa: items: - - key: identity_providers.oidc.hmac.key - path: identity_providers.oidc.hmac.key - - key: identity_validation.reset_password.jwt.hmac.key - path: identity_validation.reset_password.jwt.hmac.key - - key: session.encryption.key - path: session.encryption.key - - key: storage.encryption.key - path: storage.encryption.key - rsa-jwk: - items: - - key: tls.key - path: tls.key - - key: tls.crt - path: tls.crt - ecdsa-jwk: - items: - - key: tls.key - path: tls.key - - key: tls.crt - path: tls.crt + - { key: tls.key, path: tls.key } + - { key: tls.crt, path: tls.crt } client-argocd: - items: - - key: clientSecret - path: client_secret.txt + items: [ { key: clientSecret, path: client_secret.txt } ] client-audiobookshelf: - items: - - key: clientSecret - path: client_secret.txt + items: [ { key: clientSecret, path: client_secret.txt } ] client-netbird: - items: - - key: clientSecret - path: client_secret.txt + items: [ { key: clientSecret, path: client_secret.txt } ]