mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2025-12-12 17:26:19 +00:00
202 lines
9.1 KiB
Markdown
202 lines
9.1 KiB
Markdown
---
|
||
title: How to deploy promtail on Kubernetes
|
||
description: Deploy promtail on Kubernetes to provide SSO to your cluster and workloads
|
||
values_yaml_url: https://github.com/grafana/helm-charts/blob/main/charts/promtail/values.yaml
|
||
helm_chart_version: 6.15.x
|
||
helm_chart_name: grafana
|
||
helm_chart_repo_name: grafana
|
||
helm_chart_repo_url: https://grafana.github.io/helm-charts
|
||
helmrelease_name: promtail
|
||
helmrelease_namespace: promtail
|
||
kustomization_name: promtail
|
||
slug: Promtail
|
||
status: new
|
||
upstream: https://grafana.com/docs/loki/latest/send-data/promtail/
|
||
links:
|
||
- name: GitHub Repo
|
||
uri: https://github.com/grafana/loki
|
||
---
|
||
|
||
# promtail on Kubernetes
|
||
|
||
authentik[^1] is an open-source Identity Provider, focused on flexibility and versatility. With authentik, site administrators, application developers, and security engineers have a dependable and secure solution for authentication in almost any type of environment.
|
||
|
||
{ loading=lazy }
|
||
|
||
There are robust recovery actions available for the users and applications, including user profile and password management. You can quickly edit, deactivate, or even impersonate a user profile, and set a new password for new users or reset an existing password.
|
||
|
||
You can use authentik in an existing environment to add support for new protocols, so introducing authentik to your current tech stack doesn't present re-architecting challenges. We already support all of the major providers, such as OAuth2, SAML, [LDAP][openldap] :t_rex:, and SCIM, so you can pick the protocol that you need for each application.
|
||
|
||
See a comparison with other IDPs [here](https://goauthentik.io/#comparison).
|
||
|
||
## {{ page.meta.slug }} requirements
|
||
|
||
!!! summary "Ingredients"
|
||
|
||
Already deployed:
|
||
|
||
* [x] A [Kubernetes cluster](/kubernetes/cluster/)
|
||
* [x] [Flux deployment process](/kubernetes/deployment/flux/) bootstrapped
|
||
* [x] An [Ingress controller](/kubernetes/ingress/) to route incoming traffic to services
|
||
* [x] [Persistent storage](/kubernetes/persistence/) to store persistent stuff
|
||
|
||
Optional:
|
||
|
||
* [ ] [External DNS](/kubernetes/external-dns/) to create an DNS entry the "flux" way
|
||
|
||
{% include 'kubernetes-flux-namespace.md' %}
|
||
{% include 'kubernetes-flux-helmrepository.md' %}
|
||
{% include 'kubernetes-flux-kustomization.md' %}
|
||
{% include 'kubernetes-flux-dnsendpoint.md' %}
|
||
{% include 'kubernetes-flux-helmrelease.md' %}
|
||
|
||
## Configure authentik Helm Chart
|
||
|
||
The following sections detail suggested changes to the values pasted into `/{{ page.meta.helmrelease_namespace }}/helmrelease-{{ page.meta.helmrelease_name }}.yaml` from the {{ page.meta.slug }} helm chart's [values.yaml]({{ page.meta.values_yaml_url }}). The values are already indented correctly to be copied, pasted into the HelmRelease, and adjusted as necessary.
|
||
|
||
!!! tip
|
||
Confusingly, the authentik helm chart defaults to having the bundled redis and postgresql **disabled**, but the [authentik Kubernetes install](https://goauthentik.io/docs/installation/kubernetes/) docs require that they be enabled. Take care to change the respective `enabled: false` values to `enabled: true` below.
|
||
|
||
### Set authentik secret key
|
||
|
||
Authentik needs a secret key for signing cookies (*not singing for cookies! :cookie:*), so set it below, and don't change it later (*or feed it after midnight!*):
|
||
|
||
```yaml hl_lines="6" title="Set mandatory secret key"
|
||
authentik:
|
||
# -- Log level for server and worker
|
||
log_level: info
|
||
# -- Secret key used for cookie singing and unique user IDs,
|
||
# don't change this after the first install
|
||
secret_key: "ilovesingingcookies"
|
||
```
|
||
|
||
### Set bootstrap credentials
|
||
|
||
By default, when you install the authentik helm chart, you'll get to set your admin user's (`akadmin`) when you first login. You can pre-configure this password by setting the `AUTHENTIK_BOOTSTRAP_PASSWORD` env var as illustrated below.
|
||
|
||
If you're after a more hands-off implementation, you can also pre-set a "bootstrap token", which can be used to interact with the authentik API programatically (*see example below*):
|
||
|
||
```yaml hl_lines="2-3" title="Optionally pre-configure your bootstrap secrets"
|
||
env:
|
||
AUTHENTIK_BOOTSTRAP_PASSWORD: "iamusedbyhumanz"
|
||
AUTHENTIK_BOOTSTRAP_TOKEN: "iamusedbymachinez"
|
||
```
|
||
|
||
### Configure Redis for authentik
|
||
|
||
authentik uses Redis as the broker for [Celery](https://docs.celeryq.dev/en/stable/) background tasks. The authentik helm chart defaults to provisioning an 8Gi PVC for redis, which seems like overkill for a simple broker. You can tweak the size of the Redis PVC by setting:
|
||
|
||
```yaml hl_lines="4" title="1Gi should be fine for redis"
|
||
redis:
|
||
master:
|
||
persistence:
|
||
size: 1Gi
|
||
```
|
||
|
||
### Configure PostgreSQL for authentik
|
||
|
||
Although technically you **can** leave the PostgreSQL password blank, authentik-server will just error with an error like `fe_sendauth: no password supplied`, so ensure you set the password, both in `authentik.postgresql.password` and in `postgresql.postgresqlPassword`:
|
||
|
||
At the very least, you'll want to set the following
|
||
|
||
```yaml hl_lines="3 6" title="Set a secure Postgresql password"
|
||
authentik:
|
||
postgresql:
|
||
password: "Iamaverysecretpassword"
|
||
|
||
postgresql:
|
||
postgresqlPassword: "Iamaverysecretpassword"
|
||
```
|
||
|
||
As with Redis above, you may feel (*like I do*) that provisioning an 8Gi PVC for a database containing 1 user and a handful of app configs is overkill. You can adjust the size of the PostgreSQL PVC by setting:
|
||
|
||
```yaml hl_lines="3" title="1Gi is fine for a small database"
|
||
postgresql:
|
||
persistence:
|
||
size: 1Gi
|
||
```
|
||
|
||
### Ingress
|
||
|
||
Setup your ingress for the authentik UI. If you plan to add outposts to proxy other un-authenticated endpoints later, this is where you'll add them:
|
||
|
||
```yaml hl_lines="3 7" title="Configure your ingress"
|
||
ingress:
|
||
enabled: true
|
||
ingressClassName: "nginx" # (1)!
|
||
annotations: {}
|
||
labels: {}
|
||
hosts:
|
||
- host: authentik.example.com
|
||
paths:
|
||
- path: "/"
|
||
pathType: Prefix
|
||
tls: []
|
||
```
|
||
|
||
1. Either leave blank to accept the default ingressClassName, or set to whichever [ingress controller](/kubernetes/ingress/) you want to use.
|
||
|
||
## Install {{ page.meta.slug }}!
|
||
|
||
Commit the changes to your flux repository, and either wait for the reconciliation interval, or force a reconcilliation using `flux reconcile source git flux-system`. You should see the kustomization appear...
|
||
|
||
```bash
|
||
~ ❯ flux get kustomizations {{ page.meta.kustomization_name }}
|
||
NAME READY MESSAGE REVISION SUSPENDED
|
||
{{ page.meta.kustomization_name }} True Applied revision: main/70da637 main/70da637 False
|
||
~ ❯
|
||
```
|
||
|
||
The helmrelease should be reconciled...
|
||
|
||
```bash
|
||
~ ❯ flux get helmreleases -n {{ page.meta.helmrelease_namespace }} {{ page.meta.helmrelease_name }}
|
||
NAME READY MESSAGE REVISION SUSPENDED
|
||
{{ page.meta.helmrelease_name }} True Release reconciliation succeeded v{{ page.meta.helm_chart_version }} False
|
||
~ ❯
|
||
```
|
||
|
||
And you should have happy pods in the {{ page.meta.helmrelease_namespace }} namespace:
|
||
|
||
```bash
|
||
~ ❯ k get pods -n authentik
|
||
NAME READY STATUS RESTARTS AGE
|
||
authentik-redis-master-0 1/1 Running 1 (3d17h ago) 26d
|
||
authentik-server-548c6d4d5f-ljqft 1/1 Running 1 (3d17h ago) 20d
|
||
authentik-postgresql-0 1/1 Running 1 (3d17h ago) 26d
|
||
authentik-worker-7bb8f55bcb-5jwrr 1/1 Running 0 23h
|
||
~ ❯
|
||
```
|
||
|
||
Browse to the URL you configured in your ingress above, and confirm that the authentik UI is displayed.
|
||
|
||
## Create your admin user
|
||
|
||
You may be a little confused re how to login for the first time. If you didn't use a bootstrap password as above, you'll want to go to `https://<ingress-host-name>/if/flow/initial-setup/`, and set an initial password for your `akadmin` user.
|
||
|
||
Now store the `akadmin` password somewhere safely, and proceed to create your own user account (*you'll presumably want to use your own username and email address*).
|
||
|
||
Navigate to **Admin Interface** --> **Directory** --> **Users**, and create your new user. Edit your user and manually set your password.
|
||
|
||
Next, navigate to **Directory** --> **Groups**, and edit the **authentik Admins** group. Within the group, click the **Users** tab to add your new user to the **authentik Admins** group.
|
||
|
||
Eureka! :tada:
|
||
|
||
Your user is now an authentik superuser. Confirm this by logging out as **akadmin**, and logging back in with your own credentials.
|
||
|
||
## Summary
|
||
|
||
What have we achieved? We've got authentik running and accessible, we've created a superuser account, and we're ready to flex :muscle: the power of authentik to deploy an OIDC provider for Kubernetes, or simply secure unprotected UIs with proxy outposts!
|
||
|
||
!!! summary "Summary"
|
||
Created:
|
||
|
||
* [X] authentik running and ready to "authentikate" :lock: !
|
||
|
||
Next:
|
||
|
||
* [ ] Configure [Kubernetes OIDC authentication](/kubernetes/oidc-authentication/), unlocking production readiness as well as the [Kubernetes Dashboard][k8s/dashboard] and Weave GitOps UIs (*coming soon*)
|
||
|
||
{% include 'recipe-footer.md' %}
|
||
|
||
[^1]: Yes, the lower-case thing bothers me too. That's how the official docs do it though, so I'm following suit. |