authentik-operator¶
This project is fully AI generated
Review it carefully before running it against anything you care about, and use it at your own risk.
Every file in this repository — the operator, its tests, its RBAC, and these docs — was generated by an AI system. Plausible-looking code is not the same as reviewed code. Treat it as unreviewed third-party software, because functionally that is what it is.
A Kubernetes operator that manages objects inside an existing authentik instance — providers, applications and outposts — declaratively, as Kubernetes custom resources. It talks to authentik over its REST API using a token you supply.
What this is not¶
This operator does not deploy or manage authentik itself
The name invites the opposite assumption, so to be blunt: you bring your own authentik — Helm chart, Docker Compose, hosted, whatever — and this operator configures what lives inside it.
If you want authentik running on Kubernetes, use the official authentik Helm chart and then point this operator at the result.
It does not manage the authentik server, worker, PostgreSQL or Redis. It does not back them up, upgrade them, or know anything about how they are deployed.
What it does¶
-
Providers
Reconciles OAuth2/OIDC, SAML and Proxy providers from Kubernetes manifests.
-
Applications
Reconciles authentik applications and binds each to a provider.
-
Outposts
Reconciles outposts and their Kubernetes or Docker service connections.
-
Credentials
Writes generated OAuth2 client IDs and secrets back into Kubernetes
Secrets so your workloads can consume them.
Everything is addressed through a connection object holding the authentik
URL and a reference to a Secret containing an API token. See
Connections.
Implementation status¶
The API group is authentik.k8s.rka.sh and the API version is v1alpha1.
Two CRDs exist today, and no controller reconciles them yet. Everything else on this site describes an intended design so that it can be reviewed before it is built. Pages describing unbuilt features say so at the top.
| Kind | Scope | Status |
|---|---|---|
AuthentikConnection |
Namespaced | Implemented |
ClusterAuthentikConnection |
Cluster | Implemented |
OAuth2Provider |
Namespaced | Implemented |
SAMLProvider |
Namespaced | Implemented |
ProxyProvider |
Namespaced | Implemented |
Application |
Namespaced | Implemented |
Outpost |
Namespaced | Implemented |
KubernetesServiceConnection |
Namespaced | Implemented |
DockerServiceConnection |
Namespaced | Implemented |
v1alpha1 is unstable: expect breaking changes without conversion webhooks
until it reaches v1beta1.
Where to go next¶
- Getting started — prerequisites and the mental model.
- Installation — Helm or raw manifests.
- Creating an API token — the step everyone gets stuck on.
- Your first application — an end-to-end worked example.
- Connections — the two connection kinds and how to choose.
- Conditions — every condition type and reason, with fixes.
- Troubleshooting — symptom, cause, fix.
- Security — the security model and its sharpest edge.
- Decisions — architecture decision records.
Licence¶
Apache License 2.0.