atuhelia update and secret fix

2024-11-29 18:21:35 +01:00 · 2024-11-29 18:21:35 +01:00 · 15d09d3284
commit 15d09d3284
parent 5f0fd69272
6 changed files with 211 additions and 56 deletions
--- a/infrastructure/authelia/authelia-internal.sealedsecret.yaml
+++ b/infrastructure/authelia/authelia-internal.sealedsecret.yaml
@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: authelia-internal
+  namespace: authelia
+spec:
+  encryptedData:
+    identity_providers.oidc.hmac.key: AgDEMMa2ztamy8IAP6WPshXa2A6rD6LG0Yr2tMEkI2rOt3jU+qweAeR6ykET0UcFQWQoSCjYcuNK2EsrL5XbyGV4Mdh/kmj9vn7nGyg97nxjtK9uWwGxClPIU3XfW1PqqheJmMAzH7YNiEotc+MzeIvT27wNt/yYaQZ/jxNtr7dseWFbRp+m+bGTcmckiCBWoZ623q7mtDClNWSHST4wrgTwaO0g07kH7763Js/TSO6zHQwZM+u41Po6S7jFKH6aIIKBsqwbk+aP9Oxgvw+LHvX/nALDQKRWRJ+q7AJYoQHBXVWNQJRKLXbXt0jm+fqimQULAsNVKPAi0Z/MKdq9x+x/YkaINaxWa58fKRVouON+/mQcc/h6xYbulv+bkdeyu5drHdSJ6eSwzyIapFGX0Omef7gC8bNWjKROdPNfL+3BAhQ1Gjgojy87OXImdVvQ1xqA1WPQP7QdQw22qDQOiCdmV3RiZfGXxpiIQHEC/7uc8bkUIY/VxUA9dDLWrToXPm1WmIc6+4t40tXtjdh8kz+rlRU0sVNA8vM98eUQ5bWsOVHnagBCd/pY3fvSYYbv12T+7IHq02K3mlNXZdORQiF+BKAyFiXqgfQPmL3qVZOI1x9aqx5a+X6DGO/Dm9V1EuH48mkhK8azjZcqZXiyzd01F7FUSsr6C3znLKB1e4jDT42sMumL7tPTPJQLdHEq8prSoZHuBzsPhxrJYCWD/xAn33uFDvLSBlrRKFIdQd9Dn5M85EwUdsHRUo9D/6JRvkAVEXsQTI2Ibx2iqz4DDQHpEm3txf7JK821lCfv2RvIqWKhVBlN451VcH+/RDFzkl//Sn4m1L5BQJ4P2kl00jLSEExbm9AczqO4DrxROI8dElPuPlkiQZQru7JuT4VW/gkfNqHWxJij4pW4WI9Pci42/Q1UKYUnttBwfl/Tr7WGO+fjS1g=
+    identity_validation.reset_password.jwt.hmac.key: AgA1UmeG8XqoFGzRh7qaR7S6gi3eZGh5af/Q9hwHhmTrMbkWBAPvlTZhk1oxSB/HKFxzQZA0KrBJ+Vuj8KdGN9m4jhuTj85vtiRjV3sgM26JkbabOUdSt9/0yQ2H69OtQagYe1xv3nJfqtZskAksFXgR8piHmHGVLNH87e6i+m83hpHol1pP6wpFZsoPDi4QTHGhfGLgaX8QW1sBKrXSKioMg6fao3SiqsNZn+RhQVKx7aE+BRDKMzb0Iey0laxhQaK2GcuIMK1Z8/T4bENKRQ+NulITzxs+fuqHThuz1gx/z8mwwJS8HrrYW4JXUsq70TT3/PZwn7NvnizFtu2JvT65NqCm3T1xgFpkr1qoMFBehcvXYJYd20pvqEK1Vqa7eFpS3W7YWzMul20SLitlL9+HgUXNPeFyz7YJha6pxzCwSDnCoW1E82VfagEaQ86ro8ZyZ1+HdrGB+v0kq9YoaLz49KT05/71RS8G8wqThMqwSTWFboEIbhmtfgjX4kuHVWIm6nvu14jPrC0FRH4RcxYSgySM9DiXgn+Rwc6FgX9abQ/cFAOqoe/zY6oX86keBrllprvhjLYPhwBN+c0ozYeyBW/LXa6s+MulFGcIq2fNQm+xXVTJWhAnBQB1yLEESKrFo+HgfCrhL3wCNFLx5rNQlu03fG1EqpoKRJui1PiDNiAOt8UK/mhp5KOHo1RJb0Nx1JyO4cyC/9J9g6cYw/GAqtEXSFyvf6MiQepdjzwLfKy6HXkR4TGGlp4LhuwdZ9ta2RHPQDS6N8jVMFaRjzNGU2TkzvYuopXMSLV/wkalwLhzv17Wk+YYZSEVdPgfg6Ilpw36KJRNKE1vkBD8hxJpzw3VRopw69u6KSgu3dTVAA==
+    session.encryption.key: AgAjdOC06F/ZlNQXCzHSGgrIbIjnbYM3bRDhEOqo8MSO6Isvh6tfEcDZi7HnGYHNwom7m7FQDu9CcmTkty7JD/VWmIT397Y+2JegLjh9mqJugWy9v56zAyFFKcTnOmviNKf6nsPo/dFkNzm4n77nMyFNL3JheggoUsJlCyVGlbR2OaK5VFOWeImu8MjBnNv8fT8wgUY3puWmDxrStRTUwtRZVGhLlowC/G6X0wi4whn2JDRnlHET+z/RJRYXLT6ftgCw4eZaKbUrNW65kmUf066SH4xuVb9ae7E72SfMaN3T4ItQDtwMuHKSq//pnLgJkCifMnywY7sgwBQT+P8wwR3qwKzw9U+futKTye+Oce2/P8plhMoyVG0doWQVUdJmvr/oHQOKYSjIjbw41rEaSorA6SCb7V6vEyI/gNyYpqMDQgHGgcsBvbREfCqCU6oBS/gLbDWxBb/MvE+qlJO6go0Di1cBNbQWqckUzF9rqyeXj1nlsN3RaIT/fePivxSjUd9YQkqr69DelVDyVQXIs+bqohjFdDORGdz4yiwMRkgpZu2Vxc/3QuOVMP2tjqZAxOhPekR7hgDUZvCTmRMk7oW7OFGpNmxx+TdTbgBt3Bxe6h2d/HvaH1MwuLFU1zpkx7GZ1kJxNVcd8jcO1fP+uFK7+wtgO6fo+qOvxFiUp2oEdcJvyNiFQZ6dHJ1Yfi9pcQ2MefEpYSO0aBk7xi5Iofh3n1W0RPtUcnZTYVCY11YXLnkAN/ECI5punA==
+    storate.encryption.key: AgBno+V6jXK2ae6lyASYZVatJ2h3j14zG4Y0Sc0lP6otBNrFVNd7/yIeGJhExKZiX9rPVh8IO4sRaxiYTJPpHizYZR6ULg8B3Z1jbYEGuUToj2hvgIFWtqnxAhfj1Z0G5oOZFKeWm/pg8ZX4fs3Be0Lxq05+ecwv52nXHCdSm8cp5Nwdkt3WGZcBmGQUSJlf8JIAG+79eAvlsW32xxZK5if0lqKOKMOR38hbaeT6XdPMHX4ytBzBmghs+MJQMnH6WygUHdeBqF6Aj3pACxRdwkGRPdWrY5KhJG610KNzI6H+eRSqUNWYRhG84xzKFVFk/T3RjaLUBwnpG7p0vudafAWH/ljoeJNLL7Qcq9dI17v6oNN7a9cl9HXpQvHYyfBTpv6YBVS+0V68gNv7sGgfJBunalNcWQtjc6N16+OVaPz/jIQGKElqkCWTv8Boa70EzH550oP3igciNRhWDnVQepB5GauKT410rArhRDqUmCywxGvnhVihL5CULNAFesm8KfuT2ofI8nNfiBBLaoR2tYmvPwf7bGqWOhMLftMWw+vH5sebLREuwkco/o8RkRStyNLMDy9tT+qBLMeQX8FT1j4Jn/7y653tqZ4W5kN6InO1j0rC0YMCLOIksFcftQ5HKQjm5WewJDmzjPAyz4Csvm1l+6KCTXZjDcFigtTnjpa1WOuk/jd89ioaCEyh2rtHbq/fNAPlSy0cvSnan28/bzOp/gIgeYvpiA==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: authelia-internal
+      namespace: authelia
+    type: Opaque
--- a/infrastructure/authelia/authelia-ldap.sealedsecret.yaml
+++ b/infrastructure/authelia/authelia-ldap.sealedsecret.yaml
--- a/infrastructure/authelia/authelia-oidc.sealedsecret.yaml
+++ b/infrastructure/authelia/authelia-oidc.sealedsecret.yaml
--- a/infrastructure/authelia/authelia-smtp.sealedsecret.yaml
+++ b/infrastructure/authelia/authelia-smtp.sealedsecret.yaml
@ -7,7 +7,7 @@ metadata:
  namespace: authelia
 spec:
  encryptedData:
-    smtp.yml: AgAHiNwse+aFYVoun500VoUTUKg22yDSn+cD9pLO4HKG26nqmOxkiTSi5BELpzWouqHXiHNwYLEKPv13ZFJX6AFfFskspBfe+svLvLSzEvtH8kNCSJar0G5jcACEk27xcCxTN0nhmjc6L9lmZF8UUth7l5Mrsl0EG+79pCNYhUtjy16g7HdbmYgmgrY6d7VWCen2R4HZK4A9zPx+8HEsoMzUD0mG+uKKKfmqYaxJ563Gzp7trDcQRXd4tmea9MM8t+bk9TYCDvBj9JbsNuIdzFk8MArlvlesDYqiJj/8wny49NoVyX8vvGVDF3Y5s+OmKA9+MoBIYNc4oT4FLcc14wpnMnk5WgbKtTYfExcGTdTWuTTVWPsF18dvbKTU3C6dnf2kh9T8CydIdu27jwrBbChWffxNbh5nlLlQT3Xvogai8o6qhMn+EqTnw/u93OIxNzPEooVP349VVW/mlhGX3od/IlVzXiIlQIxL5EP2pRCXL2T1KONvkpbClJ/BTuwfjRZTXz3ZaRhaTPdBAZ+bpkRkt+kEAecjqaf9EF+pHy+dOaR4tIrwBWBbrAy47iV4e/Q60B97bRHzgo9N1uaYonGmyzmyVc9TXIkhf7PIlu/cSyDaHKdobVx0AA0p2usi5D1QYMcS9fngXyM1U9imO6QiYopysxQ9gJL8rfuySRJ/YQ6JJ71fLdMxsiQ0r21D7v7LEdJK5SKLovpnmPgk4PBoL9E4ZPE6g5zRXZFj1IxpKkOqRMpyBzBvas9Q1OFFs0Y79kGtyWIXb7Z2HGYmMU1us9Pm95xVF/V34sAtMIEz7qi+SaXQHFvyqbaiJ48U8qHhHL5y+lt9e8PGmQo0tRWfHMejs5BCcFAEZKDiif6zUEsjV/WC9WKO9NUjvRiu0CYCq5z9QzKaZQqWo0LPeM6DMY8pT3w4OqpJ/OLyMfbdoWT/uQ1JW5npApGifL0lhWRIkQHCG7oZA/BkJfbiexV8jwtToS+UX/s9HkbkuQ/O4zDte8qg/Xzh5TOj5AxlAPN6wGCwd6t1RTSITSKVMnTpFabkEvPYnGeiyWU8TrckvaKmhRUNoj2ZWQCCffHKp/bimEHxRqFnW6B+cu35reTjFc2dqp12EhCBR727G0EARx3Gt/LSdPh8OYt+Bs0rLaHiUrCJh4HRBJPmg0PARVwDL7OWx6pwtclnrALmfELKKaopy6yFctDogOtkvxHbL8DNhJqNuQJo6ttzlHhz4bnQcWb2K92HIw==
+    smtp.yml: AgCfZqHvV3N/S7C3BCeBZv5erYNnbc3yuhYswXBxJUmvfWt/oyEi0VM9830cV740zF532ZteMaEC47Yer1dm1zwBb8degsSPOnivTU3HVN1MQKMxB0T9roN7ytXnS48dIVLlZAy5/7AqU/+F081zJeGW/8lsQKJ7QVa3zG7BDGJmaExxttrB5ZsSiVmFldSQap1FNIcPFU1O4N1w59r29IsUNbOVpnb4NqONBBh7Lt/RoUwYVmdMT8OxOAtgovft1z+KuZN2ZnvBlm3EgY70wAWTs/tSmZLWuDGa8yo0M6LPIjO9zlc+l1YuI25AqGHDuhGU+H+gQWZhtIglwKHtU8oUuDchWxQpb4tJSokpyegkWrpty8vBEEGK9CtLk13EmPUHTPicv9XYgwxvROeXB7+6/gQC8Yc/PzjjZwSrNo8SC/rF4VJY9jXMJ2nS7UkubcfdOY/bKhu1jZENrav7Zd/z5hiy2stg2LFJ2rnzIrSKeYWN3ygR24KRGh/7Bpwz6LhCkPdrfJJyymA+Azwq06CoyyPTLkYRMpTdkzx8zLNCvfQfmEKYRxRcXVBDfSr/Wn/9QNmCAG/rp1Ep23xRYegQRTUyGD2JVVSjE0WcMRRnqb70IYfEPk4w5TS14RcO2/59Lvs+1mF8g9JfLhrxOjLDAvnSKjN5KZ3PgLdpqbkcVjUb0Hs18SAilmZhs5cQtNR++LqYePIe1r7R3V9IPIvPudCs7/2BrLLpuREhTdQIiA3catZ6kLZgHuh/KswFEDAcZ1NisSNvZZLAKTHupIe7XjBp+0zGHLZ7hgbA/Ojf4e6M4RLjqR41Uix+stkKuwWwdoXs/YAf2GUl6+4fb/8iPVUwPA7XHf92ALxv5neNEDlo4awXvuBQG8XdmaCqkYXBe1GE+vgmzfQhr1gjcO1VxvpsAJXT9/Ak1whQbs8kLfwxDfGp3CYQxx+eaxxm4Q2xumeQYXHFyhNZ5d5XOpmlx9EovRwM/uGoZdslykZ27ZbKRMYcqwhJ16CS/y5ptMcEbB1RkqodM55UCslR/fo+9aJejX0x8V91U2bm8eFrDFhFJsM6Z6oClxOXeAbSoE8m4KclRWTtF4+CIXq+qszdWzwqrHBWvKAtVwGo3L08Sxw24ajT9Rw1Ay2kvb4xO2SVzIRhHdzIFpF6iSiDqBJsSH7SL0kP1C07j3vl95qZBp01BW8BUnVxFyqOVMvVnXMaNQZdFrsq4MVEsxDftgciF9oE8rVv4Q==
  template:
    metadata:
      creationTimestamp: null
--- a/infrastructure/authelia/authelia.values.yaml
+++ b/infrastructure/authelia/authelia.values.yaml
@ -1,4 +1,3 @@
-
 ingress:
  enabled: false

@ -6,44 +5,55 @@ ingress:
 pod:
  kind: 'Deployment'
  replicas: 1
-  extraVolumes:
-    - name: config-ldap
-      secret:
-        secretName: authelia-ldap
-    - name: config-oidc
-      secret:
-        secretName: authelia-oidc
-    - name: config-smtp
-      secret:
-        secretName: authelia-smtp

-  extraVolumeMounts:
-    - name: config-ldap
-      mountPath: /extra-config/ldap.yml
-      readOnly: true
-    - name: config-oidc
-      mountPath: /extra-config/oidc.yml
-      readOnly: true
-    - name: config-smtp
-      mountPath: /extra-config/smtp.yml
-      readOnly: true


 ##
 ## Authelia Config Map Generator
 ##
 configMap:
-
-  # Enable the configMap source for the Authelia config.
-  # If this is false you need to provide a volumeMount via PV/PVC or other means that mounts to /config.
-  disabled: false
  key: 'configuration.yml'
-  # do not use a pre-existing configMap
-  # BUT, include sub-maps wich OVERRIDE the values generated by the helm chart
+  # include sub-maps wich OVERRIDE the values generated by the helm chart
  extraConfigs:
-    - /extra-config/ldap.yml
-    - /extra-config/oidc.yml
-    - /extra-config/smtp.yml
+    - /secrets/authelia-smtp/smtp.yml
+
+
+  # many of the values remain default from the helm chart
+  authentication_backend:
+    ldap:
+      implementation: 'custom'
+      address: 'ldap://lldap:3890'
+      base_dn: 'DC=moll,DC=re'
+      additional_users_dn: 'OU=people'
+      users_filter: "(&({username_attribute}={input})(objectClass=person))"
+      additional_groups_dn: 'OU=groups'
+      groups_filter: "(member={dn})"
+
+      ## The username of the admin user.
+      user: 'uid=authelia,ou=people,dc=moll,dc=re'
+      password:
+        # ## Disables this secret and leaves configuring it entirely up to you.
+        # disabled: false
+
+        # ## The secret name. The ~ name is special as it is the secret we generate either automatically or via the
+        # ## secret_value option below.
+        # secret_name: ~
+
+        # ## The value of a generated secret when using the ~ secret_name.
+        # value: ''
+
+        # ## The path to the secret. If it has a '/' prefix it's assumed to be an absolute path within the pod. Otherwise
+        # ## it uses the format '{mountPath}/{secret_name}/{path}' where '{mountPath}' refers to the 'secret.mountPath'
+        # ## value, '{secret_name}' is the secret_name above, and '{path}' is this value.
+        path: 'authentication.ldap.password.txt'
+        secret_name: authelia-ldap
+
+      attributes:
+        display_name: displayName
+        username: uid
+        group_name: cn
+        mail: mail
+

  session:
    inactivity: '2d'
@ -52,37 +62,157 @@ configMap:
    cookies:
      - name: authelia_session
        domain: auth.kluster.moll.re
+    encryption_key:
+      secret_name: authelia-internal
+
+
  storage:
    encryption_key:
-      value: 'authelia-encryption-key'
+      secret_name: authelia-internal
+
    local:
      enabled: true
      file: /config/db.sqlite3


-##
-## Authelia Secret Configuration.
-##
+  # notifier:
+  # notifier is configured via the smtp secret and merged by authelia upon startup
+
+
+  identity_validation:
+    reset_password:
      secret:
-
-  disabled: false
-
-  existingSecret: ''
+        secret_name: authelia-internal
+        path: 'identity_validation.reset_password.jwt.hmac.key'


-certificates:
-  # don't use the pre-existing secret
-  existingSecret: ''
+  identity_providers:
+    oidc:
+      enabled: true
+      hmac_secret:
+        secret_name: authelia-internal
+        path: 'identity_providers.oidc.hmac.key'
+      # lifespans:
+      #   access_token: '1 hour'
+      #   authorize_code: '1 minute'
+      #   id_token: '1 hour'
+      #   refresh_token: '1 hour and 30 minutes'
+      cors:
+        allowed_origins_from_client_redirect_uris: true
+      
+      clients:
+        - client_id: 'grafana'
+          client_name: 'Grafana'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.grafana'
+          public: false
+          authorization_policy: 'one_factor'
+          require_pkce: true
+          pkce_challenge_method: 'S256'
+          redirect_uris:
+            - 'https://grafana.kluster.moll.re/login/generic_oauth'
+          scopes:
+            - 'openid'
+            - 'profile'
+            - 'groups'
+            - 'email'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_post'
+          consent_mode: 'implicit'
+        - client_id: 'recipes'
+          client_name: 'Recipes'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.recipes'
+          public: false
+          authorization_policy: 'one_factor'
+          require_pkce: true
+          pkce_challenge_method: 'S256'
+          redirect_uris:
+            - 'https://recipes.kluster.moll.re/login'
+          scopes:
+            - 'openid'
+            - 'email'
+            - 'profile'
+            - 'groups'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_basic'
+          consent_mode: 'implicit'
+        - client_id: 'gitea'
+          client_name: 'Gitea'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.gitea'
+          public: false
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'https://git.kluster.moll.re/user/oauth2/authelia/callback'
+          scopes:
+            - 'openid'
+            - 'email'
+            - 'profile'
+            - 'groups'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_basic'
+          consent_mode: 'implicit'
+        - client_id: 'argocd'
+          client_name: 'Argo CD'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.argocd'
+          public: false
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'https://argocd.kluster.moll.re/auth/callback'
+          scopes:
+            - 'openid'
+            - 'groups'
+            - 'email'
+            - 'profile'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_post'
+          consent_mode: 'implicit'
+        - client_id: 'paperless'
+          client_name: 'Paperless'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.paperless'
+          public: false
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'https://paperless.kluster.moll.re/accounts/oidc/authelia/login/callback/'
+          scopes:
+            - 'openid'
+            - 'profile'
+            - 'email'
+            - 'groups'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_basic'
+          consent_mode: 'implicit'
+        - client_id: 'linkding'
+          client_name: 'LinkDing'
+          client_secret:
+            path: '/secrets/authelia-oidc/client.linkding'
+          public: false
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'https://linkding.kluster.moll.re/oidc/callback/'
+          scopes:
+            - 'openid'
+            - 'groups'
+            - 'email'
+            - 'profile'
+          userinfo_signed_response_alg: 'none'
+          token_endpoint_auth_method: 'client_secret_post'
+          consent_mode: 'implicit'
+

-##
-## Authelia Persistence Configuration.
-##
-## Useful in scenarios where you need persistent storage.
-## Auth Provider Use Case: file; we recommend you use the ldap provider instead.
-## Storage Provider Use Case: local; we recommend you use the mysql/mariadb or postgres provider instead.
-## Configuration Use Case: when you want to manually configure the configuration entirely (set configMap.enabled = false).
-##
 persistence:
  enabled: true
  storageClass: 'nfs-client'

+
+secret:
+  mountPath: '/secrets'
+  additionalSecrets:
+    # the oidc client secrets referenced in the oidc config
+    authelia-oidc: {}
+    authelia-internal: {}
+    authelia-ldap: {}
+    authelia-smtp: {}
--- a/infrastructure/authelia/kustomization.yaml
+++ b/infrastructure/authelia/kustomization.yaml
@ -14,6 +14,7 @@ resources:
  - authelia-ldap.sealedsecret.yaml
  - authelia-oidc.sealedsecret.yaml
  - authelia-smtp.sealedsecret.yaml
+  - authelia-internal.sealedsecret.yaml
  - ingress.yaml


@ -26,6 +27,6 @@ images:
 helmCharts:
  - name: authelia
    releaseName: authelia
-    version: 0.9.9
+    version: 0.9.13
    repo: https://charts.authelia.com
    valuesFile: authelia.values.yaml