fix(authelia): clean up configuration

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/auth/authelia/cert-ecdsa-jwk.yaml

@@ -1,7 +1,7 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: ecdsa-jwk
+  name: jwk-ecdsa
   namespace: authelia
 spec:
   dnsNames:
@@ -14,7 +14,7 @@ spec:
     algorithm: ECDSA
     encoding: PKCS8
     size: 256
-  secretName: ecdsa-jwk
+  secretName: jwk-ecdsa
   usages:
     - digital signature
     - key encipherment

k8s/infra/auth/authelia/cert-rsa-jwk.yaml

@@ -1,7 +1,7 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: rsa-jwk
+  name: jwk-rsa
   namespace: authelia
 spec:
   dnsNames:
@@ -14,7 +14,7 @@ spec:
     algorithm: RSA
     encoding: PKCS8
     size: 2048
-  secretName: rsa-jwk
+  secretName: jwk-rsa
   usages:
     - digital signature
     - key encipherment

k8s/infra/auth/authelia/kustomization.yaml

@@ -20,7 +20,7 @@ helmCharts:
     repo: https://charts.authelia.com
     releaseName: authelia
     namespace: authelia
-    version: 0.10.11
+    version: 0.10.34
     valuesFile: values.yaml
 
 patches:

k8s/infra/auth/authelia/patches/deployment-host-aliases.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: authelia
+  namespace: authelia
 spec:
   template:
     spec:

k8s/infra/auth/authelia/values.yaml

@@ -17,10 +17,6 @@ configMap:
   log:
     level: info
 
-  identity_validation:
-    reset_password:
-      secret: { secret_name: crypto }
-
   access_control:
     default_policy: deny
     rules:
@@ -28,12 +24,9 @@ configMap:
         policy: two_factor
 
   session:
-    encryption_key: { secret_name: crypto }
-    cookies:
-      - domain: stonegarden.dev
+    cookies: [ { domain: stonegarden.dev } ]
 
   storage:
-    encryption_key: { secret_name: crypto }
     postgres:
       enabled: true
       deploy: false
@@ -69,18 +62,17 @@ configMap:
     oidc:
       ## Currently in beta stage. See https://www.authelia.com/r/openid-connect/
       enabled: true
-      hmac_secret: { secret_name: crypto }
       jwks:
         - key_id: default
           algorithm: RS256
           use: sig
-          key: { path: /secrets/rsa-jwk/tls.key }
-          certificate_chain: { path: /secrets/rsa-jwk/tls.crt }
+          key: { path: /secrets/jwk-rsa/tls.key }
+          certificate_chain: { path: /secrets/jwk-rsa/tls.crt }
         - key_id: ecdsa256
           algorithm: ES256
           use: sig
-          key: { path: /secrets/ecdsa-jwk/tls.key }
-          certificate_chain: { path: /secrets/ecdsa-jwk/tls.crt }
+          key: { path: /secrets/jwk-ecdsa/tls.key }
+          certificate_chain: { path: /secrets/jwk-ecdsa/tls.crt }
       cors:
         allowed_origins_from_client_redirect_uris: true
         endpoints: [ userinfo, authorization, token, revocation, introspection ]
@@ -89,7 +81,7 @@ configMap:
           custom_claims:
             audiobookshelf: { attribute: audiobookshelf_groups }
         # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
-        default:
+        legacy:
           id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ]
         username_email:
           id_token: [ email, email_verified, alt_emails, name, preferred_username ]
@@ -146,7 +138,7 @@ configMap:
           client_name: kubectl
           public: true
           authorization_policy: two_factor
-          claims_policy: default
+          claims_policy: legacy
           pre_configured_consent_duration: 1 month
           require_pkce: true
           redirect_uris: [ http://localhost:8000, http://localhost:18000 ]
@@ -175,50 +167,25 @@ configMap:
           token_endpoint_auth_method: client_secret_post
 
 secret:
+  existingSecret: crypto
   additionalSecrets:
     authelia-postgres-app:
-      items:
-        - key: password
-          path: storage.postgres.password.txt
+      items: [ { key: password, path: storage.postgres.password.txt } ]
     lldap-auth:
-      items:
-        - key: password
-          path: authentication.ldap.password.txt
+      items: [ { key: password, path: authentication.ldap.password.txt } ]
     smtp-auth:
+      items: [ { key: password, path: notifier.smtp.password.txt } ]
+    jwk-rsa:
       items:
-        - key: password
-          path: notifier.smtp.password.txt
-    crypto:
+        - { key: tls.key, path: tls.key }
+        - { key: tls.crt, path: tls.crt }
+    jwk-ecdsa:
       items:
-        - key: identity_providers.oidc.hmac.key
-          path: identity_providers.oidc.hmac.key
-        - key: identity_validation.reset_password.jwt.hmac.key
-          path: identity_validation.reset_password.jwt.hmac.key
-        - key: session.encryption.key
-          path: session.encryption.key
-        - key: storage.encryption.key
-          path: storage.encryption.key
-    rsa-jwk:
-      items:
-        - key: tls.key
-          path: tls.key
-        - key: tls.crt
-          path: tls.crt
-    ecdsa-jwk:
-      items:
-        - key: tls.key
-          path: tls.key
-        - key: tls.crt
-          path: tls.crt
+        - { key: tls.key, path: tls.key }
+        - { key: tls.crt, path: tls.crt }
     client-argocd:
-      items:
-        - key: clientSecret
-          path: client_secret.txt
+      items: [ { key: clientSecret, path: client_secret.txt } ]
     client-audiobookshelf:
-      items:
-        - key: clientSecret
-          path: client_secret.txt
+      items: [ { key: clientSecret, path: client_secret.txt } ]
     client-netbird:
-      items:
-        - key: clientSecret
-          path: client_secret.txt
+      items: [ { key: clientSecret, path: client_secret.txt } ]