mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2025-12-13 01:36:23 +00:00
make premix public
Signed-off-by: David Young <davidy@funkypenguin.co.nz>
This commit is contained in:
David Young
80
docs/recipes/kubernetes/descheduler.md
Normal file
80
docs/recipes/kubernetes/descheduler.md
Normal file
@@ -0,0 +1,80 @@
|
||||
---
|
||||
title: Balance node usage on Kubernetes with descheduler
|
||||
description: Use descheduler to balance load on your Kubernetes cluster by "descheduling" pods (to be rescheduled on appropriate nodes)
|
||||
values_yaml_url: https://github.com/kubernetes-sigs/descheduler/blob/master/charts/descheduler/values.yaml
|
||||
helm_chart_version: 0.27.x
|
||||
helm_chart_name: descheduler
|
||||
helm_chart_repo_name: descheduler
|
||||
helm_chart_repo_url: https://kubernetes-sigs.github.io/descheduler/
|
||||
helmrelease_name: descheduler
|
||||
helmrelease_namespace: descheduler
|
||||
kustomization_name: descheduler
|
||||
slug: Descheduler
|
||||
status: new
|
||||
upstream: https://sigs.k8s.io/descheduler
|
||||
links:
|
||||
- name: GitHub Repo
|
||||
uri: https://github.com/kubernetes-sigs/descheduler
|
||||
---
|
||||
|
||||
# Balancing a Kubernetes cluster with descheduler
|
||||
|
||||
So you've got multiple nodes in your kubernetes cluster, you throw a bunch of workloads in there, and Kubernetes schedules the workloads onto the nodes, making sensible choices based on load, affinity, etc.
|
||||
|
||||
Note that this scheduling only happens when a pod is created. Once a pod has been scheduled to a node, Kubernetes won't take it **away** from that node. This can result in "sub-optimal" node loading, especially if you're elastically expanding your nodes themselves, or working through rolling updates.
|
||||
|
||||
Descheduler is used to rebalance clusters by evicting pods that can potentially be scheduled on better nodes.
|
||||
|
||||
{ loading=lazy }
|
||||
|
||||
Here are some reasons you might need to rebalance your cluster:
|
||||
|
||||
* Some nodes are under or over utilized.
|
||||
* The original scheduling decision does not hold true any more, as taints or labels are added to or removed from nodes, pod/node affinity requirements are not satisfied any more.
|
||||
* Some nodes failed and their pods moved to other nodes.
|
||||
* New nodes are added to clusters.
|
||||
|
||||
Descheduler works by "kicking out" (evicting) certain nodes based on a policy you feed it, depending what you want to achieve. (*You may want to converge as many pods as possible on as few nodes as possible, or more evenly distribute load across a static set of nodes*)
|
||||
|
||||
## {{ page.meta.slug }} requirements
|
||||
|
||||
!!! summary "Ingredients"
|
||||
|
||||
Already deployed:
|
||||
|
||||
* [x] A [Kubernetes cluster](/kubernetes/cluster/)
|
||||
* [x] [Flux deployment process](/kubernetes/deployment/flux/) bootstrapped
|
||||
|
||||
{% include 'kubernetes-flux-namespace.md' %}
|
||||
{% include 'kubernetes-flux-helmrepository.md' %}
|
||||
{% include 'kubernetes-flux-kustomization.md' %}
|
||||
{% include 'kubernetes-flux-helmrelease.md' %}
|
||||
{% include 'kubernetes-flux-check.md' %}
|
||||
|
||||
## Configure descheduler Helm Chart
|
||||
|
||||
The following sections detail suggested changes to the values pasted into `/{{ page.meta.helmrelease_namespace }}/helmrelease-{{ page.meta.helmrelease_name }}.yaml` from the {{ page.meta.slug }} helm chart's [values.yaml]({{ page.meta.values_yaml_url }}). The values are already indented correctly to be copied, pasted into the HelmRelease, and adjusted as necessary.
|
||||
|
||||
!!! tip
|
||||
Confusingly, the descheduler helm chart defaults to having the bundled redis and postgresql **disabled**, but the [descheduler Kubernetes install](https://godescheduler.io/docs/installation/kubernetes/) docs require that they be enabled. Take care to change the respective `enabled: false` values to `enabled: true` below.
|
||||
|
||||
### Set descheduler secret key
|
||||
|
||||
## Create your admin user
|
||||
|
||||
## Summary
|
||||
|
||||
What have we achieved? We've got descheduler running and accessible, we've created a superuser account, and we're ready to flex :muscle: the power of descheduler to deploy an OIDC provider for Kubernetes, or simply secure unprotected UIs with proxy outposts!
|
||||
|
||||
!!! summary "Summary"
|
||||
Created:
|
||||
|
||||
* [X] descheduler running and ready to "deschedulerate" :lock: !
|
||||
|
||||
Next:
|
||||
|
||||
* [ ] Configure [Kubernetes OIDC authentication](/kubernetes/oidc-authentication/), unlocking production readiness as well as the [Kubernetes Dashboard][k8s/dashboard] and Weave GitOps UIs (*coming soon*)
|
||||
|
||||
{% include 'recipe-footer.md' %}
|
||||
|
||||
[^1]: Yes, the lower-case thing bothers me too. That's how the official docs do it though, so I'm following suit.
|
||||
202
docs/recipes/kubernetes/loki.md
Normal file
202
docs/recipes/kubernetes/loki.md
Normal file
@@ -0,0 +1,202 @@
|
||||
---
|
||||
title: How to deploy promtail on Kubernetes
|
||||
description: Deploy promtail on Kubernetes to provide SSO to your cluster and workloads
|
||||
values_yaml_url: https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml
|
||||
helm_chart_version: 5.36.x
|
||||
helm_chart_name: grafana
|
||||
helm_chart_repo_name: grafana
|
||||
helm_chart_repo_url: https://grafana.github.io/helm-charts
|
||||
helmrelease_name: promtail
|
||||
helmrelease_namespace: promtail
|
||||
kustomization_name: promtail
|
||||
slug: Promtail
|
||||
status: new
|
||||
upstream: https://grafana.com/docs/loki/latest/send-data/promtail/
|
||||
links:
|
||||
- name: GitHub Repo
|
||||
uri: https://github.com/grafana/loki
|
||||
---
|
||||
|
||||
# promtail on Kubernetes
|
||||
|
||||
authentik[^1] is an open-source Identity Provider, focused on flexibility and versatility. With authentik, site administrators, application developers, and security engineers have a dependable and secure solution for authentication in almost any type of environment.
|
||||
|
||||
{ loading=lazy }
|
||||
|
||||
There are robust recovery actions available for the users and applications, including user profile and password management. You can quickly edit, deactivate, or even impersonate a user profile, and set a new password for new users or reset an existing password.
|
||||
|
||||
You can use authentik in an existing environment to add support for new protocols, so introducing authentik to your current tech stack doesn't present re-architecting challenges. We already support all of the major providers, such as OAuth2, SAML, [LDAP][openldap] :t_rex:, and SCIM, so you can pick the protocol that you need for each application.
|
||||
|
||||
See a comparison with other IDPs [here](https://goauthentik.io/#comparison).
|
||||
|
||||
## {{ page.meta.slug }} requirements
|
||||
|
||||
!!! summary "Ingredients"
|
||||
|
||||
Already deployed:
|
||||
|
||||
* [x] A [Kubernetes cluster](/kubernetes/cluster/)
|
||||
* [x] [Flux deployment process](/kubernetes/deployment/flux/) bootstrapped
|
||||
* [x] An [Ingress controller](/kubernetes/ingress/) to route incoming traffic to services
|
||||
* [x] [Persistent storage](/kubernetes/persistence/) to store persistent stuff
|
||||
|
||||
Optional:
|
||||
|
||||
* [ ] [External DNS](/kubernetes/external-dns/) to create an DNS entry the "flux" way
|
||||
|
||||
{% include 'kubernetes-flux-namespace.md' %}
|
||||
{% include 'kubernetes-flux-helmrepository.md' %}
|
||||
{% include 'kubernetes-flux-kustomization.md' %}
|
||||
{% include 'kubernetes-flux-dnsendpoint.md' %}
|
||||
{% include 'kubernetes-flux-helmrelease.md' %}
|
||||
|
||||
## Configure authentik Helm Chart
|
||||
|
||||
The following sections detail suggested changes to the values pasted into `/{{ page.meta.helmrelease_namespace }}/helmrelease-{{ page.meta.helmrelease_name }}.yaml` from the {{ page.meta.slug }} helm chart's [values.yaml]({{ page.meta.values_yaml_url }}). The values are already indented correctly to be copied, pasted into the HelmRelease, and adjusted as necessary.
|
||||
|
||||
!!! tip
|
||||
Confusingly, the authentik helm chart defaults to having the bundled redis and postgresql **disabled**, but the [authentik Kubernetes install](https://goauthentik.io/docs/installation/kubernetes/) docs require that they be enabled. Take care to change the respective `enabled: false` values to `enabled: true` below.
|
||||
|
||||
### Set authentik secret key
|
||||
|
||||
Authentik needs a secret key for signing cookies (*not singing for cookies! :cookie:*), so set it below, and don't change it later (*or feed it after midnight!*):
|
||||
|
||||
```yaml hl_lines="6" title="Set mandatory secret key"
|
||||
authentik:
|
||||
# -- Log level for server and worker
|
||||
log_level: info
|
||||
# -- Secret key used for cookie singing and unique user IDs,
|
||||
# don't change this after the first install
|
||||
secret_key: "ilovesingingcookies"
|
||||
```
|
||||
|
||||
### Set bootstrap credentials
|
||||
|
||||
By default, when you install the authentik helm chart, you'll get to set your admin user's (`akadmin`) when you first login. You can pre-configure this password by setting the `AUTHENTIK_BOOTSTRAP_PASSWORD` env var as illustrated below.
|
||||
|
||||
If you're after a more hands-off implementation, you can also pre-set a "bootstrap token", which can be used to interact with the authentik API programatically (*see example below*):
|
||||
|
||||
```yaml hl_lines="2-3" title="Optionally pre-configure your bootstrap secrets"
|
||||
env:
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: "iamusedbyhumanz"
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: "iamusedbymachinez"
|
||||
```
|
||||
|
||||
### Configure Redis for authentik
|
||||
|
||||
authentik uses Redis as the broker for [Celery](https://docs.celeryq.dev/en/stable/) background tasks. The authentik helm chart defaults to provisioning an 8Gi PVC for redis, which seems like overkill for a simple broker. You can tweak the size of the Redis PVC by setting:
|
||||
|
||||
```yaml hl_lines="4" title="1Gi should be fine for redis"
|
||||
redis:
|
||||
master:
|
||||
persistence:
|
||||
size: 1Gi
|
||||
```
|
||||
|
||||
### Configure PostgreSQL for authentik
|
||||
|
||||
Although technically you **can** leave the PostgreSQL password blank, authentik-server will just error with an error like `fe_sendauth: no password supplied`, so ensure you set the password, both in `authentik.postgresql.password` and in `postgresql.postgresqlPassword`:
|
||||
|
||||
At the very least, you'll want to set the following
|
||||
|
||||
```yaml hl_lines="3 6" title="Set a secure Postgresql password"
|
||||
authentik:
|
||||
postgresql:
|
||||
password: "Iamaverysecretpassword"
|
||||
|
||||
postgresql:
|
||||
postgresqlPassword: "Iamaverysecretpassword"
|
||||
```
|
||||
|
||||
As with Redis above, you may feel (*like I do*) that provisioning an 8Gi PVC for a database containing 1 user and a handful of app configs is overkill. You can adjust the size of the PostgreSQL PVC by setting:
|
||||
|
||||
```yaml hl_lines="3" title="1Gi is fine for a small database"
|
||||
postgresql:
|
||||
persistence:
|
||||
size: 1Gi
|
||||
```
|
||||
|
||||
### Ingress
|
||||
|
||||
Setup your ingress for the authentik UI. If you plan to add outposts to proxy other un-authenticated endpoints later, this is where you'll add them:
|
||||
|
||||
```yaml hl_lines="3 7" title="Configure your ingress"
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: "nginx" # (1)!
|
||||
annotations: {}
|
||||
labels: {}
|
||||
hosts:
|
||||
- host: authentik.example.com
|
||||
paths:
|
||||
- path: "/"
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
```
|
||||
|
||||
1. Either leave blank to accept the default ingressClassName, or set to whichever [ingress controller](/kubernetes/ingress/) you want to use.
|
||||
|
||||
## Install {{ page.meta.slug }}!
|
||||
|
||||
Commit the changes to your flux repository, and either wait for the reconciliation interval, or force a reconcilliation using `flux reconcile source git flux-system`. You should see the kustomization appear...
|
||||
|
||||
```bash
|
||||
~ ❯ flux get kustomizations {{ page.meta.kustomization_name }}
|
||||
NAME READY MESSAGE REVISION SUSPENDED
|
||||
{{ page.meta.kustomization_name }} True Applied revision: main/70da637 main/70da637 False
|
||||
~ ❯
|
||||
```
|
||||
|
||||
The helmrelease should be reconciled...
|
||||
|
||||
```bash
|
||||
~ ❯ flux get helmreleases -n {{ page.meta.helmrelease_namespace }} {{ page.meta.helmrelease_name }}
|
||||
NAME READY MESSAGE REVISION SUSPENDED
|
||||
{{ page.meta.helmrelease_name }} True Release reconciliation succeeded v{{ page.meta.helm_chart_version }} False
|
||||
~ ❯
|
||||
```
|
||||
|
||||
And you should have happy pods in the {{ page.meta.helmrelease_namespace }} namespace:
|
||||
|
||||
```bash
|
||||
~ ❯ k get pods -n authentik
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
authentik-redis-master-0 1/1 Running 1 (3d17h ago) 26d
|
||||
authentik-server-548c6d4d5f-ljqft 1/1 Running 1 (3d17h ago) 20d
|
||||
authentik-postgresql-0 1/1 Running 1 (3d17h ago) 26d
|
||||
authentik-worker-7bb8f55bcb-5jwrr 1/1 Running 0 23h
|
||||
~ ❯
|
||||
```
|
||||
|
||||
Browse to the URL you configured in your ingress above, and confirm that the authentik UI is displayed.
|
||||
|
||||
## Create your admin user
|
||||
|
||||
You may be a little confused re how to login for the first time. If you didn't use a bootstrap password as above, you'll want to go to `https://<ingress-host-name>/if/flow/initial-setup/`, and set an initial password for your `akadmin` user.
|
||||
|
||||
Now store the `akadmin` password somewhere safely, and proceed to create your own user account (*you'll presumably want to use your own username and email address*).
|
||||
|
||||
Navigate to **Admin Interface** --> **Directory** --> **Users**, and create your new user. Edit your user and manually set your password.
|
||||
|
||||
Next, navigate to **Directory** --> **Groups**, and edit the **authentik Admins** group. Within the group, click the **Users** tab to add your new user to the **authentik Admins** group.
|
||||
|
||||
Eureka! :tada:
|
||||
|
||||
Your user is now an authentik superuser. Confirm this by logging out as **akadmin**, and logging back in with your own credentials.
|
||||
|
||||
## Summary
|
||||
|
||||
What have we achieved? We've got authentik running and accessible, we've created a superuser account, and we're ready to flex :muscle: the power of authentik to deploy an OIDC provider for Kubernetes, or simply secure unprotected UIs with proxy outposts!
|
||||
|
||||
!!! summary "Summary"
|
||||
Created:
|
||||
|
||||
* [X] authentik running and ready to "authentikate" :lock: !
|
||||
|
||||
Next:
|
||||
|
||||
* [ ] Configure [Kubernetes OIDC authentication](/kubernetes/oidc-authentication/), unlocking production readiness as well as the [Kubernetes Dashboard][k8s/dashboard] and Weave GitOps UIs (*coming soon*)
|
||||
|
||||
{% include 'recipe-footer.md' %}
|
||||
|
||||
[^1]: Yes, the lower-case thing bothers me too. That's how the official docs do it though, so I'm following suit.
|
||||
202
docs/recipes/kubernetes/promtail.md
Normal file
202
docs/recipes/kubernetes/promtail.md
Normal file
@@ -0,0 +1,202 @@
|
||||
---
|
||||
title: How to deploy promtail on Kubernetes
|
||||
description: Deploy promtail on Kubernetes to provide SSO to your cluster and workloads
|
||||
values_yaml_url: https://github.com/grafana/helm-charts/blob/main/charts/promtail/values.yaml
|
||||
helm_chart_version: 6.15.x
|
||||
helm_chart_name: grafana
|
||||
helm_chart_repo_name: grafana
|
||||
helm_chart_repo_url: https://grafana.github.io/helm-charts
|
||||
helmrelease_name: promtail
|
||||
helmrelease_namespace: promtail
|
||||
kustomization_name: promtail
|
||||
slug: Promtail
|
||||
status: new
|
||||
upstream: https://grafana.com/docs/loki/latest/send-data/promtail/
|
||||
links:
|
||||
- name: GitHub Repo
|
||||
uri: https://github.com/grafana/loki
|
||||
---
|
||||
|
||||
# promtail on Kubernetes
|
||||
|
||||
authentik[^1] is an open-source Identity Provider, focused on flexibility and versatility. With authentik, site administrators, application developers, and security engineers have a dependable and secure solution for authentication in almost any type of environment.
|
||||
|
||||
{ loading=lazy }
|
||||
|
||||
There are robust recovery actions available for the users and applications, including user profile and password management. You can quickly edit, deactivate, or even impersonate a user profile, and set a new password for new users or reset an existing password.
|
||||
|
||||
You can use authentik in an existing environment to add support for new protocols, so introducing authentik to your current tech stack doesn't present re-architecting challenges. We already support all of the major providers, such as OAuth2, SAML, [LDAP][openldap] :t_rex:, and SCIM, so you can pick the protocol that you need for each application.
|
||||
|
||||
See a comparison with other IDPs [here](https://goauthentik.io/#comparison).
|
||||
|
||||
## {{ page.meta.slug }} requirements
|
||||
|
||||
!!! summary "Ingredients"
|
||||
|
||||
Already deployed:
|
||||
|
||||
* [x] A [Kubernetes cluster](/kubernetes/cluster/)
|
||||
* [x] [Flux deployment process](/kubernetes/deployment/flux/) bootstrapped
|
||||
* [x] An [Ingress controller](/kubernetes/ingress/) to route incoming traffic to services
|
||||
* [x] [Persistent storage](/kubernetes/persistence/) to store persistent stuff
|
||||
|
||||
Optional:
|
||||
|
||||
* [ ] [External DNS](/kubernetes/external-dns/) to create an DNS entry the "flux" way
|
||||
|
||||
{% include 'kubernetes-flux-namespace.md' %}
|
||||
{% include 'kubernetes-flux-helmrepository.md' %}
|
||||
{% include 'kubernetes-flux-kustomization.md' %}
|
||||
{% include 'kubernetes-flux-dnsendpoint.md' %}
|
||||
{% include 'kubernetes-flux-helmrelease.md' %}
|
||||
|
||||
## Configure authentik Helm Chart
|
||||
|
||||
The following sections detail suggested changes to the values pasted into `/{{ page.meta.helmrelease_namespace }}/helmrelease-{{ page.meta.helmrelease_name }}.yaml` from the {{ page.meta.slug }} helm chart's [values.yaml]({{ page.meta.values_yaml_url }}). The values are already indented correctly to be copied, pasted into the HelmRelease, and adjusted as necessary.
|
||||
|
||||
!!! tip
|
||||
Confusingly, the authentik helm chart defaults to having the bundled redis and postgresql **disabled**, but the [authentik Kubernetes install](https://goauthentik.io/docs/installation/kubernetes/) docs require that they be enabled. Take care to change the respective `enabled: false` values to `enabled: true` below.
|
||||
|
||||
### Set authentik secret key
|
||||
|
||||
Authentik needs a secret key for signing cookies (*not singing for cookies! :cookie:*), so set it below, and don't change it later (*or feed it after midnight!*):
|
||||
|
||||
```yaml hl_lines="6" title="Set mandatory secret key"
|
||||
authentik:
|
||||
# -- Log level for server and worker
|
||||
log_level: info
|
||||
# -- Secret key used for cookie singing and unique user IDs,
|
||||
# don't change this after the first install
|
||||
secret_key: "ilovesingingcookies"
|
||||
```
|
||||
|
||||
### Set bootstrap credentials
|
||||
|
||||
By default, when you install the authentik helm chart, you'll get to set your admin user's (`akadmin`) when you first login. You can pre-configure this password by setting the `AUTHENTIK_BOOTSTRAP_PASSWORD` env var as illustrated below.
|
||||
|
||||
If you're after a more hands-off implementation, you can also pre-set a "bootstrap token", which can be used to interact with the authentik API programatically (*see example below*):
|
||||
|
||||
```yaml hl_lines="2-3" title="Optionally pre-configure your bootstrap secrets"
|
||||
env:
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: "iamusedbyhumanz"
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: "iamusedbymachinez"
|
||||
```
|
||||
|
||||
### Configure Redis for authentik
|
||||
|
||||
authentik uses Redis as the broker for [Celery](https://docs.celeryq.dev/en/stable/) background tasks. The authentik helm chart defaults to provisioning an 8Gi PVC for redis, which seems like overkill for a simple broker. You can tweak the size of the Redis PVC by setting:
|
||||
|
||||
```yaml hl_lines="4" title="1Gi should be fine for redis"
|
||||
redis:
|
||||
master:
|
||||
persistence:
|
||||
size: 1Gi
|
||||
```
|
||||
|
||||
### Configure PostgreSQL for authentik
|
||||
|
||||
Although technically you **can** leave the PostgreSQL password blank, authentik-server will just error with an error like `fe_sendauth: no password supplied`, so ensure you set the password, both in `authentik.postgresql.password` and in `postgresql.postgresqlPassword`:
|
||||
|
||||
At the very least, you'll want to set the following
|
||||
|
||||
```yaml hl_lines="3 6" title="Set a secure Postgresql password"
|
||||
authentik:
|
||||
postgresql:
|
||||
password: "Iamaverysecretpassword"
|
||||
|
||||
postgresql:
|
||||
postgresqlPassword: "Iamaverysecretpassword"
|
||||
```
|
||||
|
||||
As with Redis above, you may feel (*like I do*) that provisioning an 8Gi PVC for a database containing 1 user and a handful of app configs is overkill. You can adjust the size of the PostgreSQL PVC by setting:
|
||||
|
||||
```yaml hl_lines="3" title="1Gi is fine for a small database"
|
||||
postgresql:
|
||||
persistence:
|
||||
size: 1Gi
|
||||
```
|
||||
|
||||
### Ingress
|
||||
|
||||
Setup your ingress for the authentik UI. If you plan to add outposts to proxy other un-authenticated endpoints later, this is where you'll add them:
|
||||
|
||||
```yaml hl_lines="3 7" title="Configure your ingress"
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: "nginx" # (1)!
|
||||
annotations: {}
|
||||
labels: {}
|
||||
hosts:
|
||||
- host: authentik.example.com
|
||||
paths:
|
||||
- path: "/"
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
```
|
||||
|
||||
1. Either leave blank to accept the default ingressClassName, or set to whichever [ingress controller](/kubernetes/ingress/) you want to use.
|
||||
|
||||
## Install {{ page.meta.slug }}!
|
||||
|
||||
Commit the changes to your flux repository, and either wait for the reconciliation interval, or force a reconcilliation using `flux reconcile source git flux-system`. You should see the kustomization appear...
|
||||
|
||||
```bash
|
||||
~ ❯ flux get kustomizations {{ page.meta.kustomization_name }}
|
||||
NAME READY MESSAGE REVISION SUSPENDED
|
||||
{{ page.meta.kustomization_name }} True Applied revision: main/70da637 main/70da637 False
|
||||
~ ❯
|
||||
```
|
||||
|
||||
The helmrelease should be reconciled...
|
||||
|
||||
```bash
|
||||
~ ❯ flux get helmreleases -n {{ page.meta.helmrelease_namespace }} {{ page.meta.helmrelease_name }}
|
||||
NAME READY MESSAGE REVISION SUSPENDED
|
||||
{{ page.meta.helmrelease_name }} True Release reconciliation succeeded v{{ page.meta.helm_chart_version }} False
|
||||
~ ❯
|
||||
```
|
||||
|
||||
And you should have happy pods in the {{ page.meta.helmrelease_namespace }} namespace:
|
||||
|
||||
```bash
|
||||
~ ❯ k get pods -n authentik
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
authentik-redis-master-0 1/1 Running 1 (3d17h ago) 26d
|
||||
authentik-server-548c6d4d5f-ljqft 1/1 Running 1 (3d17h ago) 20d
|
||||
authentik-postgresql-0 1/1 Running 1 (3d17h ago) 26d
|
||||
authentik-worker-7bb8f55bcb-5jwrr 1/1 Running 0 23h
|
||||
~ ❯
|
||||
```
|
||||
|
||||
Browse to the URL you configured in your ingress above, and confirm that the authentik UI is displayed.
|
||||
|
||||
## Create your admin user
|
||||
|
||||
You may be a little confused re how to login for the first time. If you didn't use a bootstrap password as above, you'll want to go to `https://<ingress-host-name>/if/flow/initial-setup/`, and set an initial password for your `akadmin` user.
|
||||
|
||||
Now store the `akadmin` password somewhere safely, and proceed to create your own user account (*you'll presumably want to use your own username and email address*).
|
||||
|
||||
Navigate to **Admin Interface** --> **Directory** --> **Users**, and create your new user. Edit your user and manually set your password.
|
||||
|
||||
Next, navigate to **Directory** --> **Groups**, and edit the **authentik Admins** group. Within the group, click the **Users** tab to add your new user to the **authentik Admins** group.
|
||||
|
||||
Eureka! :tada:
|
||||
|
||||
Your user is now an authentik superuser. Confirm this by logging out as **akadmin**, and logging back in with your own credentials.
|
||||
|
||||
## Summary
|
||||
|
||||
What have we achieved? We've got authentik running and accessible, we've created a superuser account, and we're ready to flex :muscle: the power of authentik to deploy an OIDC provider for Kubernetes, or simply secure unprotected UIs with proxy outposts!
|
||||
|
||||
!!! summary "Summary"
|
||||
Created:
|
||||
|
||||
* [X] authentik running and ready to "authentikate" :lock: !
|
||||
|
||||
Next:
|
||||
|
||||
* [ ] Configure [Kubernetes OIDC authentication](/kubernetes/oidc-authentication/), unlocking production readiness as well as the [Kubernetes Dashboard][k8s/dashboard] and Weave GitOps UIs (*coming soon*)
|
||||
|
||||
{% include 'recipe-footer.md' %}
|
||||
|
||||
[^1]: Yes, the lower-case thing bothers me too. That's how the official docs do it though, so I'm following suit.
|
||||
Reference in New Issue
Block a user