API reference¶

Complete field-level reference for every kind in the authentik.k8s.rka.sh/v1alpha1 API group.

Do not edit this page by hand

Everything between the generated markers below is produced from the Go types in api/v1alpha1/*.go. Hand edits are overwritten by the next run and fail hack/gen-docs.py --check in between.

To change what appears here, edit the doc comments on the Go types and regenerate. A field's documentation is the comment above it; its validation is its +kubebuilder markers.

Regenerating¶

make docs-api

make docs-api does not exist yet

This target is planned and is not in the Makefile today, so the generated block below is empty. It is a stub rather than a stale copy on purpose: a hand-written API reference is wrong within a week of the types changing, and a wrong reference is worse than a missing one.

Until the target lands, read the types directly. They are short, thoroughly commented, and are the actual source of truth:

api/v1alpha1/authentikconnection_types.go
api/v1alpha1/clusterauthentikconnection_types.go
api/v1alpha1/common_types.go

Or ask the cluster, which serves the generated OpenAPI schema:

kubectl explain authentikconnection.spec --recursive
kubectl explain clusterauthentikconnection.spec.tokenSecretRef

What exists today¶

Kind	Scope	Short name	API types
`AuthentikConnection`	Namespaced	`akconn`	Defined
`ClusterAuthentikConnection`	Cluster	`clakconn`	Defined
`OAuth2Provider`	Namespaced	—	Planned
`SAMLProvider`	Namespaced	—	Planned
`ProxyProvider`	Namespaced	—	Planned
`Application`	Namespaced	—	Planned
`Outpost`	Namespaced	—	Planned
`KubernetesServiceConnection`	Namespaced	—	Planned
`DockerServiceConnection`	Namespaced	—	Planned

Shared types used across kinds — ConnectionReference, LocalSecretKeyReference, SecretKeyReference, AdoptionPolicy, DeletionPolicy and ManagedResourceStatus — live in api/v1alpha1/common_types.go. The prose guides describe them: Connections, Providers, Applications, Outposts.

Generated reference¶

Packages¶

authentik.k8s.rka.sh/v1alpha1

authentik.k8s.rka.sh/v1alpha1¶

Package v1alpha1 contains API Schema definitions for the authentik v1alpha1 API group.

AdoptionPolicy¶

Underlying type: string

AdoptionPolicy controls what happens when an authentik object with the same name or slug already exists.

authentik objects are keyed by name/slug rather than by Kubernetes UID, so collisions are routine rather than exceptional. The default refuses to take over an existing object, because silent adoption is how an operator quietly overwrites something a human is maintaining by hand.

Validation: - Enum: [FailOnConflict AdoptExisting]

Appears in: - ApplicationSpec - DockerServiceConnectionSpec - KubernetesServiceConnectionSpec - OAuth2ProviderSpec - OutpostSpec - ProviderCommonSpec - ProxyProviderSpec - SAMLProviderSpec - ServiceConnectionCommonSpec

Field	Description
`FailOnConflict`	AdoptionPolicyFailOnConflict refuses to manage a pre-existing object.
`AdoptExisting`	AdoptionPolicyAdoptExisting takes ownership of a pre-existing object.

Application¶

Application manages an application in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`Application`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ApplicationSpec
`status` ApplicationStatus

ApplicationPolicyEngineMode¶

Underlying type: string

ApplicationPolicyEngineMode selects how several policies bound to one application are combined.

Validation: - Enum: [all any]

Appears in: - ApplicationSpec

ApplicationSpec¶

ApplicationSpec defines an application in authentik.

Appears in: - Application

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this application lives in.
`name` string	Name is the application's display name, shown on the user library page. Defaults to the resource name.		Optional: {}
`slug` string	Slug is the application's internal name, used in its URLs. It is immutable. authentik keys an application by its slug, so changing it cannot be an update: the operator would have to delete the old application and create a new one, which silently discards every policy binding attached to it. Create a new Application instead.		MaxLength: 50 MinLength: 1 Pattern: `^[-a-zA-Z0-9_]+$`
`providerRef` ProviderReference	ProviderRef is the provider that authenticates users for this application. Leave unset for an application that only appears in the user library and is not itself protected.		Optional: {}
`backchannelProviderRefs` ProviderReference array	BackchannelProviderRefs are additional providers attached to this application for back-channel use, such as SCIM provisioning or an LDAP bind, alongside the primary provider that handles the login itself.		Optional: {}
`openInNewTab` boolean	OpenInNewTab opens the launch URL in a new browser tab or window.		Optional: {}
`metaLaunchUrl` string	MetaLaunchURL is the address the library entry links to. Leave unset to let authentik derive it from the provider.		Optional: {}
`metaIcon` string	MetaIcon is the URL of the icon shown on the library entry. Only a URL is accepted. authentik can also serve an icon uploaded to its own media storage, and that is out of scope for this resource: the file would have to travel through the custom resource as base64 and be re-uploaded on every reconcile, which does not belong in etcd. Host the image somewhere and point at it.		Optional: {}
`metaDescription` string	MetaDescription is the short description shown on the library entry.		Optional: {}
`metaPublisher` string	MetaPublisher names the application's publisher on the library entry.		Optional: {}
`metaHide` boolean	MetaHide keeps the application off the user's library page while leaving it usable. Useful for an application reached only by a direct link.		Optional: {}
`group` string	Group names the section the application is filed under on the library page. Applications sharing a group are shown together.		Optional: {}
`policyEngineMode` ApplicationPolicyEngineMode	PolicyEngineMode selects whether every policy bound to this application must pass, or any one of them.	any	Enum: [all any] Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when an application with this slug already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik application when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}

ApplicationStatus¶

ApplicationStatus reports the application's state in authentik.

Appears in: - Application

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`providerID` integer	ProviderID is the numeric primary key the primary provider reference resolved to. It is surfaced so a mis-wired reference can be diagnosed without reading the provider resource as well.	Optional: {}
`backchannelProviderIDs` integer array	BackchannelProviderIDs are the numeric primary keys the back-channel provider references resolved to, in spec order.	Optional: {}
`launchURL` string	LaunchURL is the address authentik currently resolves the library entry to, whether taken from metaLaunchUrl or derived from the provider.	Optional: {}

AuthentikConnection¶

AuthentikConnection describes how to reach one authentik instance, using an API token stored in the same namespace.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`AuthentikConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AuthentikConnectionSpec
`status` AuthentikConnectionStatus

AuthentikConnectionSpec¶

AuthentikConnectionSpec defines a connection to an authentik instance, using credentials held in the same namespace.

Appears in: - AuthentikConnection

Field	Description	Default	Validation
`url` string	URL is the base URL of the authentik instance, for example https://authentik.example.com. Do not include the /api/v3 suffix.		MinLength: 1 Pattern: `^https?://`
`insecureSkipTLSVerify` boolean	InsecureSkipTLSVerify disables verification of the authentik server's TLS certificate. Intended for local testing against a self-signed instance; prefer caBundleSecretRef anywhere else.	false	Optional: {}
`probeInterval` Duration	ProbeInterval is how often the connection is re-checked for reachability.	5m	Pattern: `^([0-9]+(s\\|m\\|h))+$` Type: string Optional: {}
`tokenSecretRef` LocalSecretKeyReference	TokenSecretRef points at a Secret in this object's own namespace holding an authentik API token.
`caBundleSecretRef` LocalSecretKeyReference	CABundleSecretRef optionally points at a Secret in this object's own namespace holding a PEM CA bundle used to verify the authentik server.		Optional: {}

AuthentikConnectionStatus¶

AuthentikConnectionStatus reports reachability and version compatibility.

Appears in: - AuthentikConnection - ClusterAuthentikConnection

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the connection.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`authentikVersion` string	AuthentikVersion is the version reported by the instance, e.g. "2026.8.2".	Optional: {}
`versionSupported` boolean	VersionSupported reports whether AuthentikVersion falls within the range this operator is tested against. When false, dependent resources refuse to reconcile rather than failing obscurely deep inside an API call.	Optional: {}
`lastProbeTime` Time	LastProbeTime is when the instance was last contacted.	Optional: {}

ClusterAuthentikConnection¶

ClusterAuthentikConnection describes how to reach one authentik instance, usable from any namespace.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`ClusterAuthentikConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ClusterAuthentikConnectionSpec
`status` AuthentikConnectionStatus

ClusterAuthentikConnectionSpec¶

ClusterAuthentikConnectionSpec defines a cluster-wide connection to an authentik instance.

SECURITY: because this object is cluster-scoped it must name the namespace holding its credentials explicitly, which means it can reference a Secret anywhere in the cluster. Permission to create or edit one of these is therefore close to a cluster-admin privilege, and RBAC for it should be granted accordingly. See SECURITY.md.

Appears in: - ClusterAuthentikConnection

Field	Description	Default	Validation
`url` string	URL is the base URL of the authentik instance, for example https://authentik.example.com. Do not include the /api/v3 suffix.		MinLength: 1 Pattern: `^https?://`
`insecureSkipTLSVerify` boolean	InsecureSkipTLSVerify disables verification of the authentik server's TLS certificate. Intended for local testing against a self-signed instance; prefer caBundleSecretRef anywhere else.	false	Optional: {}
`probeInterval` Duration	ProbeInterval is how often the connection is re-checked for reachability.	5m	Pattern: `^([0-9]+(s\\|m\\|h))+$` Type: string Optional: {}
`tokenSecretRef` SecretKeyReference	TokenSecretRef points at a Secret holding an authentik API token. The namespace is required and is the only place the token is read from; the namespace of a resource referring to this connection is never consulted.
`caBundleSecretRef` SecretKeyReference	CABundleSecretRef optionally points at a Secret holding a PEM CA bundle used to verify the authentik server.		Optional: {}
`allowedNamespaces` string array	AllowedNamespaces optionally restricts which namespaces may reference this connection. An empty list means every namespace may use it. Without this, any user who can create a resource in any namespace can drive an authentik instance they were never granted access to.		Optional: {}

ConnectionKind¶

Underlying type: string

ConnectionKind selects which connection CRD a ConnectionReference points at.

Validation: - Enum: [AuthentikConnection ClusterAuthentikConnection]

Appears in: - ConnectionReference

Field	Description
`AuthentikConnection`	ConnectionKindNamespaced refers to a namespaced AuthentikConnection.
`ClusterAuthentikConnection`	ConnectionKindCluster refers to a cluster-scoped ClusterAuthentikConnection.

ConnectionReference¶

ConnectionReference points at the authentik instance a resource belongs to.

A namespaced AuthentikConnection is always resolved in the referring resource's own namespace. Cross-namespace references are deliberately not supported: they would let anyone who can create a resource in one namespace borrow credentials from another. Use a ClusterAuthentikConnection when a connection genuinely needs to be shared cluster-wide.

Appears in: - ApplicationSpec - DockerServiceConnectionSpec - KubernetesServiceConnectionSpec - OAuth2ProviderSpec - OutpostSpec - ProviderCommonSpec - ProxyProviderSpec - SAMLProviderSpec - ServiceConnectionCommonSpec

Field	Description	Default	Validation
`kind` ConnectionKind	Kind of connection object being referenced.	AuthentikConnection	Enum: [AuthentikConnection ClusterAuthentikConnection] Optional: {}
`name` string	Name of the connection object.		MinLength: 1

ConnectionSettings¶

ConnectionSettings holds the transport configuration shared by the namespaced and cluster-scoped connection kinds.

Appears in: - AuthentikConnectionSpec - ClusterAuthentikConnectionSpec

Field	Description	Default	Validation
`url` string	URL is the base URL of the authentik instance, for example https://authentik.example.com. Do not include the /api/v3 suffix.		MinLength: 1 Pattern: `^https?://`
`insecureSkipTLSVerify` boolean	InsecureSkipTLSVerify disables verification of the authentik server's TLS certificate. Intended for local testing against a self-signed instance; prefer caBundleSecretRef anywhere else.	false	Optional: {}
`probeInterval` Duration	ProbeInterval is how often the connection is re-checked for reachability.	5m	Pattern: `^([0-9]+(s\\|m\\|h))+$` Type: string Optional: {}

CredentialsSecretRef¶

CredentialsSecretRef says where to write the generated client credentials.

Appears in: - OAuth2ProviderSpec

Field	Description	Default	Validation
`name` string	Name of the Secret to create in this resource's namespace.		MinLength: 1
`clientIDKey` string	ClientIDKey is the Secret key holding the client id.	client-id	Optional: {}
`clientSecretKey` string	ClientSecretKey is the Secret key holding the client secret.	client-secret	Optional: {}
`issuerKey` string	IssuerKey optionally holds the provider's issuer URL, which most OIDC clients need alongside the credentials.	issuer	Optional: {}

DeletionPolicy¶

Underlying type: string

DeletionPolicy controls what happens to the authentik object when the Kubernetes resource that manages it is deleted.

Validation: - Enum: [Delete Orphan]

Appears in: - ApplicationSpec - DockerServiceConnectionSpec - KubernetesServiceConnectionSpec - OAuth2ProviderSpec - OutpostSpec - ProviderCommonSpec - ProxyProviderSpec - SAMLProviderSpec - ServiceConnectionCommonSpec

Field	Description
`Delete`	DeletionPolicyDelete removes the authentik object along with the resource.
`Orphan`	DeletionPolicyOrphan leaves the authentik object in place.

DockerServiceConnection¶

DockerServiceConnection manages a Docker outpost service connection in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`DockerServiceConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` DockerServiceConnectionSpec
`status` DockerServiceConnectionStatus

DockerServiceConnectionSpec¶

DockerServiceConnectionSpec defines a Docker service connection.

Either authentik talks to the Docker socket it is mounted with, in which case local is set, or it dials an explicit URL. Setting both is rejected, because it hides which of the two endpoints is actually in use.

Appears in: - DockerServiceConnection

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this service connection lives in.
`name` string	Name is the service connection's name in authentik. Defaults to the resource name.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a service connection with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik service connection when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}
`local` boolean	Local makes authentik use the Docker socket mounted into its own container instead of dialling a URL.		Optional: {}
`url` string	URL of the Docker daemon, either "unix:///var/run/docker.sock" for a local socket or "https://hostname:2376" for a remote daemon.		Optional: {}
`tlsVerification` string	TLSVerification is the name of the certificate key pair holding the CA the daemon's certificate is checked against. Leave unset for no verification.		Optional: {}
`tlsAuthentication` string	TLSAuthentication is the name of the certificate key pair used as a client certificate when authenticating to the daemon. Leave unset for no client authentication.		Optional: {}

DockerServiceConnectionStatus¶

DockerServiceConnectionStatus reports the connection's state in authentik.

Appears in: - DockerServiceConnection

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`serviceConnectionID` string	ServiceConnectionID is authentik's UUID for this service connection. It is what an Outpost's serviceConnectionRef ultimately resolves to, so it is surfaced separately from the generic RemoteID string.	Optional: {}

KubernetesServiceConnection¶

KubernetesServiceConnection manages a Kubernetes outpost service connection in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`KubernetesServiceConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` KubernetesServiceConnectionSpec
`status` KubernetesServiceConnectionStatus

KubernetesServiceConnectionSpec¶

KubernetesServiceConnectionSpec defines a Kubernetes service connection.

Either authentik runs inside the cluster it should deploy outposts into, in which case local is set and its own service account is used, or it needs a kubeconfig for a remote cluster. Setting both is rejected, because it hides which of the two credentials is actually in use.

Appears in: - KubernetesServiceConnection

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this service connection lives in.
`name` string	Name is the service connection's name in authentik. Defaults to the resource name.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a service connection with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik service connection when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}
`local` boolean	Local makes authentik use the cluster it is itself running in, through its own service account, instead of a kubeconfig.		Optional: {}
`kubeconfigSecretRef` LocalSecretKeyReference	KubeconfigSecretRef reads the kubeconfig for a remote cluster from a Secret in this resource's namespace. A kubeconfig is never accepted inline: it is a cluster credential, and a spec field would store it in plain text in etcd and print it in `kubectl get -o yaml`.		Optional: {}
`verifySSL` boolean	VerifySSL verifies the certificate presented by the Kubernetes API endpoint. Defaults to true in authentik.		Optional: {}

KubernetesServiceConnectionStatus¶

KubernetesServiceConnectionStatus reports the connection's state in authentik.

Appears in: - KubernetesServiceConnection

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`serviceConnectionID` string	ServiceConnectionID is authentik's UUID for this service connection. It is what an Outpost's serviceConnectionRef ultimately resolves to, so it is surfaced separately from the generic RemoteID string.	Optional: {}

LocalSecretKeyReference¶

LocalSecretKeyReference selects one key of a Secret in the same namespace as the referring object.

Appears in: - AuthentikConnectionSpec - KubernetesServiceConnectionSpec - OAuth2ProviderSpec

Field	Description	Default	Validation
`name` string	Name of the Secret.		MinLength: 1
`key` string	Key within the Secret's data.		MinLength: 1

ManagedResourceStatus¶

ManagedResourceStatus is embedded in every authentik-backed resource status.

Appears in: - ApplicationStatus - DockerServiceConnectionStatus - KubernetesServiceConnectionStatus - OAuth2ProviderStatus - OutpostStatus - ProviderStatus - ProxyProviderStatus - SAMLProviderStatus - ServiceConnectionStatus

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}

OAuth2GrantType¶

Underlying type: string

OAuth2GrantType is an OAuth2 grant the provider will issue tokens for.

This is a named type rather than a marker on the slice field because controller-gen applies an enum marker to the array itself in that case, producing a schema that rejects every non-empty list.

The urn: values contain colons, which the marker parser reads as argument separators unless each value is quoted.

Validation: - Enum: [authorization_code implicit hybrid refresh_token client_credentials password urn:ietf:params:oauth:grant-type:device_code urn:ietf:params:oauth:grant-type:token-exchange]

Appears in: - OAuth2ProviderSpec

OAuth2Provider¶

OAuth2Provider manages an OAuth2/OpenID Connect provider in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`OAuth2Provider`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` OAuth2ProviderSpec
`status` OAuth2ProviderStatus

OAuth2ProviderSpec¶

OAuth2ProviderSpec defines an OAuth2/OpenID Connect provider.

Appears in: - OAuth2Provider

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this provider lives in.
`name` string	Name is the provider's name in authentik. Defaults to the resource name.		Optional: {}
`authorizationFlow` string	AuthorizationFlow is the slug of the flow used when authorizing this provider.		MinLength: 1
`invalidationFlow` string	InvalidationFlow is the slug of the flow used when ending a session.		MinLength: 1
`authenticationFlow` string	AuthenticationFlow is the slug of the flow used to authenticate a user who reaches the application unauthenticated. Leave unset to use authentik's default.		Optional: {}
`propertyMappings` string array	PropertyMappings are the names of property mappings to attach.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a provider with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik provider when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}
`clientType` string	ClientType is confidential for clients that can keep a secret, public for those that cannot (SPAs, native apps).	confidential	Enum: [confidential public] Optional: {}
`grantTypes` OAuth2GrantType array	GrantTypes the provider will issue tokens for.		Enum: [authorization_code implicit hybrid refresh_token client_credentials password urn:ietf:params:oauth:grant-type:device_code urn:ietf:params:oauth:grant-type:token-exchange] Optional: {}
`clientID` string	ClientID to use. When empty authentik generates one.		Optional: {}
`clientSecretRef` LocalSecretKeyReference	ClientSecretRef reads a fixed client secret from a Secret in this namespace. When unset, authentik generates a secret. A secret is never accepted inline: putting one in a spec field would store it in plain text in etcd and print it in `kubectl get -o yaml`.		Optional: {}
`writeCredentialsTo` CredentialsSecretRef	WriteCredentialsTo creates a Secret holding the client id and secret, so the workload that needs them can mount it. This is usually the point of creating the provider in the first place.		Optional: {}
`redirectURIs` RedirectURI array	RedirectURIs permitted for this client.		Optional: {}
`accessCodeValidity` string	AccessCodeValidity in authentik duration syntax, e.g. "minutes=1".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`accessTokenValidity` string	AccessTokenValidity in authentik duration syntax, e.g. "hours=1".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`refreshTokenValidity` string	RefreshTokenValidity in authentik duration syntax, e.g. "days=30".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`includeClaimsInIDToken` boolean	IncludeClaimsInIDToken embeds scope claims in the id_token, for clients that never call the userinfo endpoint.		Optional: {}
`signingKey` string	SigningKey is the name of the certificate key pair used to sign tokens.		Optional: {}
`encryptionKey` string	EncryptionKey is the name of the certificate key pair used to encrypt tokens. When set, tokens are returned as JWEs.		Optional: {}
`subMode` string	SubMode selects what the `sub` claim contains.		Enum: [hashed_user_id user_id user_uuid user_username user_email user_upn] Optional: {}
`issuerMode` string	IssuerMode selects how the issuer field is built.		Enum: [global per_provider] Optional: {}
`logoutURI` string	LogoutURI is called on logout.		Optional: {}
`logoutMethod` string	LogoutMethod selects back-channel or front-channel logout.		Enum: [backchannel frontchannel] Optional: {}

OAuth2ProviderStatus¶

OAuth2ProviderStatus reports the provider's state in authentik.

Appears in: - OAuth2Provider

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`providerID` integer	ProviderID is authentik's numeric primary key for this provider. It is what an Application or Outpost must reference, so it is surfaced separately from the generic RemoteID string.	Optional: {}
`clientID` string	ClientID currently configured in authentik. The client id is not a credential on its own, so it is safe to surface; the secret never is.	Optional: {}
`credentialsSecretName` string	CredentialsSecretName is the Secret the credentials were written to.	Optional: {}
`credentialsRotatedAt` Time	CredentialsRotatedAt records the last client secret rotation.	Optional: {}
`observedRotationToken` string	ObservedRotationToken is the value of the rotation annotation that was last acted on. A rotation happens when the annotation differs from this, which makes the trigger idempotent: re-reconciling the same resource cannot rotate the secret again and break running workloads.	Optional: {}

Outpost¶

Outpost manages an authentik outpost and the set of providers it serves.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`Outpost`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` OutpostSpec
`status` OutpostStatus

OutpostSpec¶

OutpostSpec defines an authentik outpost.

Appears in: - Outpost

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this outpost is registered with.
`name` string	Name is the outpost's name in authentik. Defaults to the resource name.		Optional: {}
`type` OutpostType	Type selects which outpost implementation authentik registers.		Enum: [proxy ldap radius rac]
`providerRefs` ProviderReference array	ProviderRefs are the providers this outpost serves. Every reference must resolve before the outpost is registered or updated.		Optional: {}
`serviceConnectionRef` string	ServiceConnectionRef is the name, or UUID, of the service connection authentik should use to deploy this outpost. Leave unset to register the outpost without letting authentik manage its deployment, which is what a self-hosted outpost wants.		Optional: {}
`config` object (keys:string, values:JSON)	Config is passed to authentik verbatim as the outpost's configuration. The schema differs per outpost type and per authentik version, so it is deliberately not modelled here. Well-known keys include: "log_level", "authentik_host", "authentik_host_browser", "authentik_host_insecure", "object_naming_template", "refresh_interval", "kubernetes_replicas", "kubernetes_namespace", "kubernetes_service_type", "kubernetes_ingress_class_name", "kubernetes_ingress_annotations", "kubernetes_ingress_secret_name", "kubernetes_image_pull_secrets", "kubernetes_json_patches", "kubernetes_disabled_components", "docker_network", "docker_map_ports", "docker_labels" and "docker_image". Consult the authentik documentation for the set your version accepts.		Optional: {}
`writeTokenTo` OutpostTokenSecretRef	WriteTokenTo creates a Secret holding the outpost's API token and the authentik base URL, which is what a self-hosted outpost needs in order to connect back. Leave unset when authentik deploys the outpost itself.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when an outpost with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik outpost when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}

OutpostStatus¶

OutpostStatus reports the outpost's state in authentik.

Appears in: - Outpost

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`outpostID` string	OutpostID is authentik's UUID for this outpost.	Optional: {}
`providerIDs` integer array	ProviderIDs are the authentik primary keys every providerRef resolved to, in spec order. It is empty until all of them resolve.	Optional: {}
`serviceConnectionID` string	ServiceConnectionID is the UUID serviceConnectionRef resolved to.	Optional: {}
`tokenIdentifier` string	TokenIdentifier names the authentik token this outpost authenticates with. It is an identifier, not the token itself, which is never placed in status.	Optional: {}
`tokenSecretName` string	TokenSecretName is the Secret the outpost token was written to.	Optional: {}

OutpostTokenSecretRef¶

OutpostTokenSecretRef says where to write the outpost's connection token.

Appears in: - OutpostSpec

Field	Description	Default	Validation
`name` string	Name of the Secret to create in this resource's namespace.		MinLength: 1
`tokenKey` string	TokenKey is the Secret key holding the outpost API token, which a self-hosted outpost passes as AUTHENTIK_TOKEN.	token	Optional: {}
`hostKey` string	HostKey is the Secret key holding the authentik base URL, which a self-hosted outpost passes as AUTHENTIK_HOST.	authentik-host	Optional: {}

OutpostType¶

Underlying type: string

OutpostType selects which authentik outpost implementation to register.

Validation: - Enum: [proxy ldap radius rac]

Appears in: - OutpostSpec

Field	Description
`proxy`	OutpostTypeProxy is a forward-auth / reverse proxy outpost.
`ldap`	OutpostTypeLDAP is an LDAP outpost.
`radius`	OutpostTypeRadius is a RADIUS outpost.
`rac`	OutpostTypeRAC is a Remote Access Control outpost.

ProviderCommonSpec¶

ProviderCommonSpec holds the fields every authentik provider shares.

authentik takes flows, property mappings and certificate key pairs as UUIDs. These fields accept the human-readable slug or name instead and the operator resolves them, because nobody wants to paste UUIDs into version control. A value that already looks like a UUID is passed through unchanged, so either form works.

Appears in: - OAuth2ProviderSpec - ProxyProviderSpec - SAMLProviderSpec

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this provider lives in.
`name` string	Name is the provider's name in authentik. Defaults to the resource name.		Optional: {}
`authorizationFlow` string	AuthorizationFlow is the slug of the flow used when authorizing this provider.		MinLength: 1
`invalidationFlow` string	InvalidationFlow is the slug of the flow used when ending a session.		MinLength: 1
`authenticationFlow` string	AuthenticationFlow is the slug of the flow used to authenticate a user who reaches the application unauthenticated. Leave unset to use authentik's default.		Optional: {}
`propertyMappings` string array	PropertyMappings are the names of property mappings to attach.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a provider with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik provider when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}

ProviderKind¶

Underlying type: string

ProviderKind selects which provider CRD a ProviderReference points at.

Validation: - Enum: [OAuth2Provider SAMLProvider ProxyProvider]

Appears in: - ProviderReference

Field	Description
`OAuth2Provider`	ProviderKindOAuth2 refers to an OAuth2Provider.
`SAMLProvider`	ProviderKindSAML refers to a SAMLProvider.
`ProxyProvider`	ProviderKindProxy refers to a ProxyProvider.

ProviderReference¶

ProviderReference points at a provider resource in the same namespace.

Declared here but shared with Outpost, which references providers the same way. It lives in this file rather than a shared one only because Application was the first consumer.

The reference is resolved through the provider resource's own status.providerID rather than by looking its name up in authentik, so the Kubernetes objects stay the source of truth and renaming a provider inside authentik cannot silently repoint an application at something else.

A namespaced provider is always resolved in the application's own namespace. Cross-namespace references are deliberately not supported: they would let anyone who can create a referring resource in one namespace attach a provider, and therefore credentials, owned by another.

Appears in: - ApplicationSpec - OutpostSpec

Field	Description	Default	Validation
`kind` ProviderKind	Kind of provider resource being referenced.	OAuth2Provider	Enum: [OAuth2Provider SAMLProvider ProxyProvider] Optional: {}
`name` string	Name of the provider resource.		MinLength: 1

ProviderStatus¶

ProviderStatus is the status shared by every provider kind.

Appears in: - OAuth2ProviderStatus - ProxyProviderStatus - SAMLProviderStatus

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`providerID` integer	ProviderID is authentik's numeric primary key for this provider. It is what an Application or Outpost must reference, so it is surfaced separately from the generic RemoteID string.	Optional: {}

ProxyMode¶

Underlying type: string

ProxyMode selects how the outpost serves the application.

Validation: - Enum: [proxy forward_single forward_domain]

Appears in: - ProxyProviderSpec

Field	Description
`proxy`	ProxyModeProxy terminates traffic in the outpost and forwards it to an upstream host.
`forward_single`	ProxyModeForwardSingle authorizes one application behind an existing reverse proxy.
`forward_domain`	ProxyModeForwardDomain authorizes every application on a domain behind an existing reverse proxy.

ProxyProvider¶

ProxyProvider manages a proxy provider in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`ProxyProvider`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ProxyProviderSpec
`status` ProxyProviderStatus

ProxyProviderSpec¶

ProxyProviderSpec defines a proxy provider served by an authentik outpost.

The forwarding modes have no upstream of their own: an existing reverse proxy already holds the connection and only asks authentik whether to allow it. Rejecting the combination here turns a silently ignored field into an error on apply. The emptiness test uses size() rather than a comparison against an empty string literal: a pair of adjacent single quotes inside a comment is rewritten by gofmt into a typographic quote, which silently corrupts the rule.

Appears in: - ProxyProvider

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this provider lives in.
`name` string	Name is the provider's name in authentik. Defaults to the resource name.		Optional: {}
`authorizationFlow` string	AuthorizationFlow is the slug of the flow used when authorizing this provider.		MinLength: 1
`invalidationFlow` string	InvalidationFlow is the slug of the flow used when ending a session.		MinLength: 1
`authenticationFlow` string	AuthenticationFlow is the slug of the flow used to authenticate a user who reaches the application unauthenticated. Leave unset to use authentik's default.		Optional: {}
`propertyMappings` string array	PropertyMappings are the names of property mappings to attach.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a provider with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik provider when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}
`externalHost` string	ExternalHost is the URL the application is reached on by users, for example "https://grafana.example.com". It is what the outpost matches incoming requests against.		MinLength: 1
`internalHost` string	InternalHost is the upstream the outpost forwards traffic to, for example "http://grafana.monitoring.svc.cluster.local:3000". Valid only in proxy mode.		Optional: {}
`internalHostSSLValidation` boolean	InternalHostSSLValidation verifies the upstream's TLS certificate. Disable it only for an upstream using a self-signed certificate.		Optional: {}
`mode` ProxyMode	Mode selects how the outpost serves the application: proxy terminates traffic and forwards it upstream, while the forward modes authorize requests for an existing reverse proxy.	proxy	Enum: [proxy forward_single forward_domain] Optional: {}
`certificate` string	Certificate is the name of the certificate key pair the outpost presents for ExternalHost. Leave unset when TLS is terminated ahead of the outpost.		Optional: {}
`skipPathRegex` string	SkipPathRegex lists paths that bypass authentication, one regular expression per line. Use it for health checks and public assets. Every request matching one of these expressions reaches the application unauthenticated, so keep the expressions anchored and narrow.		Optional: {}
`basicAuthEnabled` boolean	BasicAuthEnabled sends HTTP Basic credentials to the upstream, for applications that cannot read authentication headers.		Optional: {}
`basicAuthUserAttribute` string	BasicAuthUserAttribute is the user attribute holding the username sent as HTTP Basic credentials.		Optional: {}
`basicAuthPasswordAttribute` string	BasicAuthPasswordAttribute is the user attribute holding the password sent as HTTP Basic credentials.		Optional: {}
`interceptHeaderAuth` boolean	InterceptHeaderAuth makes the outpost handle Authorization headers sent by the client instead of passing them through to the application.		Optional: {}
`cookieDomain` string	CookieDomain is the domain the session cookie is issued for. Set it in forward_domain mode so one session covers every application on the domain.		Optional: {}
`accessTokenValidity` string	AccessTokenValidity in authentik duration syntax, e.g. "hours=24".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`refreshTokenValidity` string	RefreshTokenValidity in authentik duration syntax, e.g. "days=30".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}

ProxyProviderStatus¶

ProxyProviderStatus reports the provider's state in authentik.

Appears in: - ProxyProvider

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`providerID` integer	ProviderID is authentik's numeric primary key for this provider. It is what an Application or Outpost must reference, so it is surfaced separately from the generic RemoteID string.	Optional: {}
`outposts` string array	Outposts names the outposts currently serving this provider. A proxy provider that no outpost serves is unreachable, so an empty list is the usual explanation for an application that cannot be opened.	Optional: {}

RedirectURI¶

RedirectURI is one permitted OAuth2 redirect target.

Appears in: - OAuth2ProviderSpec

Field	Description	Default	Validation
`matchingMode` RedirectURIMatchingMode	MatchingMode selects exact or regular-expression matching.	strict	Enum: [strict regex] Optional: {}
`url` string	URL is the redirect URI, or a regular expression matching one.		MinLength: 1

RedirectURIMatchingMode¶

Underlying type: string

RedirectURIMatchingMode controls how a redirect URI is matched.

Validation: - Enum: [strict regex]

Appears in: - RedirectURI

SAMLBinding¶

Underlying type: string

SAMLBinding selects how a SAML message is carried over HTTP.

Validation: - Enum: [redirect post]

Appears in: - SAMLProviderSpec

SAMLDigestAlgorithm¶

Underlying type: string

SAMLDigestAlgorithm identifies the XML digest algorithm by its W3C URI.

SAML carries algorithms as URIs on the wire, so the URI is what this field takes; there is no short form.

The values contain colons, which the marker parser reads as argument separators unless each value is quoted.

Validation: - Enum: [http://www.w3.org/2000/09/xmldsig#sha1 http://www.w3.org/2001/04/xmlenc#sha256 http://www.w3.org/2001/04/xmldsig-more#sha384 http://www.w3.org/2001/04/xmlenc#sha512]

Appears in: - SAMLProviderSpec

SAMLLogoutMethod¶

Underlying type: string

SAMLLogoutMethod selects how single logout is delivered.

Validation: - Enum: [frontchannel_iframe frontchannel_native backchannel]

Appears in: - SAMLProviderSpec

SAMLNameIDPolicy¶

Underlying type: string

SAMLNameIDPolicy is the NameID format requested when a service provider does not ask for one itself.

Validation: - Enum: [urn:oasis:namesSAML:1.1:nameid-format:emailAddress urn:oasis:namesSAML:2.0:nameid-format:persistent urn:oasis:namesSAML:1.1:nameid-format:X509SubjectName urn:oasis:namesSAML:2.0:nameid-format:WindowsDomainQualifiedName urn:oasis:namesSAML:2.0:nameid-format:transient urn:oasis:namesSAML:1.1:nameid-format:unspecified]

Appears in: - SAMLProviderSpec

SAMLProvider¶

SAMLProvider manages a SAML 2.0 provider in authentik.

Field	Description	Default	Validation
`apiVersion` string	`authentik.k8s.rka.sh/v1alpha1`
`kind` string	`SAMLProvider`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` SAMLProviderSpec
`status` SAMLProviderStatus

SAMLProviderSpec¶

SAMLProviderSpec defines a SAML 2.0 identity provider.

Appears in: - SAMLProvider

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this provider lives in.
`name` string	Name is the provider's name in authentik. Defaults to the resource name.		Optional: {}
`authorizationFlow` string	AuthorizationFlow is the slug of the flow used when authorizing this provider.		MinLength: 1
`invalidationFlow` string	InvalidationFlow is the slug of the flow used when ending a session.		MinLength: 1
`authenticationFlow` string	AuthenticationFlow is the slug of the flow used to authenticate a user who reaches the application unauthenticated. Leave unset to use authentik's default.		Optional: {}
`propertyMappings` string array	PropertyMappings are the names of property mappings to attach.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a provider with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik provider when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}
`acsURL` string	ACSURL is the service provider's Assertion Consumer Service endpoint, where authentik posts the SAML response.		MinLength: 1
`slsURL` string	SLSURL is the service provider's Single Logout Service endpoint. Leave unset to disable single logout.		Optional: {}
`audience` string	Audience is the intended recipient of the assertion, sent as the AudienceRestriction. Most service providers require it to match their own entity ID.		Optional: {}
`issuerOverride` string	IssuerOverride replaces the issuer sent in the assertion. Set it when a service provider expects an entity ID other than the one authentik derives from the provider.		Optional: {}
`assertionValidNotBefore` string	AssertionValidNotBefore is how far in the past an assertion becomes valid, in authentik duration syntax, e.g. "minutes=-5". A negative window absorbs clock skew between authentik and the service provider.		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`assertionValidNotOnOrAfter` string	AssertionValidNotOnOrAfter is how long an assertion stays valid, in authentik duration syntax, e.g. "minutes=5".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`sessionValidNotOnOrAfter` string	SessionValidNotOnOrAfter is how long the session the assertion establishes stays valid, in authentik duration syntax, e.g. "hours=8".		Pattern: `^(((microseconds\\|milliseconds\\|seconds\\|minutes\\|hours\\|days\\|weeks)=-?\d+);?)+$` Optional: {}
`nameIDMapping` string	NameIDMapping is the name of the property mapping that produces the NameID. Leave unset to let the requested NameID policy decide.		Optional: {}
`authnContextClassRefMapping` string	AuthnContextClassRefMapping is the name of the property mapping that produces the AuthnContextClassRef sent in the assertion.		Optional: {}
`digestAlgorithm` SAMLDigestAlgorithm	DigestAlgorithm used when signing assertions and responses.		Enum: [http://www.w3.org/2000/09/xmldsig#sha1 http://www.w3.org/2001/04/xmlenc#sha256 http://www.w3.org/2001/04/xmldsig-more#sha384 http://www.w3.org/2001/04/xmlenc#sha512] Optional: {}
`signatureAlgorithm` SAMLSignatureAlgorithm	SignatureAlgorithm used when signing assertions and responses. It must match the key type of the signing certificate key pair.		Enum: [http://www.w3.org/2000/09/xmldsig#rsa-sha1 http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512 http://www.w3.org/2000/09/xmldsig#dsa-sha1] Optional: {}
`signingKeyPair` string	SigningKeyPair is the name of the certificate key pair used to sign assertions and responses. Required for the sign* options to take effect.		Optional: {}
`verificationKeyPair` string	VerificationKeyPair is the name of the certificate key pair whose public certificate verifies signed AuthnRequests from the service provider. When set, unsigned requests are rejected.		Optional: {}
`encryptionKeyPair` string	EncryptionKeyPair is the name of the certificate key pair used to encrypt assertions. When set, assertions are sent encrypted.		Optional: {}
`signAssertion` boolean	SignAssertion signs the assertion element itself.		Optional: {}
`signResponse` boolean	SignResponse signs the enclosing SAML response element.		Optional: {}
`signLogoutRequest` boolean	SignLogoutRequest signs logout requests sent to the service provider.		Optional: {}
`signLogoutResponse` boolean	SignLogoutResponse signs logout responses sent to the service provider.		Optional: {}
`spBinding` SAMLBinding	SPBinding is the binding used to deliver the response to the service provider's ACS endpoint.		Enum: [redirect post] Optional: {}
`slsBinding` SAMLBinding	SLSBinding is the binding used to deliver logout messages to the service provider's SLS endpoint.		Enum: [redirect post] Optional: {}
`logoutMethod` SAMLLogoutMethod	LogoutMethod selects how single logout is delivered.		Enum: [frontchannel_iframe frontchannel_native backchannel] Optional: {}
`defaultRelayState` string	DefaultRelayState is sent as RelayState when authentik starts the login itself, for service providers that use it to pick a landing page.		Optional: {}
`defaultNameIDPolicy` SAMLNameIDPolicy	DefaultNameIDPolicy is the NameID format used when the service provider does not request one.		Enum: [urn:oasis:namesSAML:1.1:nameid-format:emailAddress urn:oasis:namesSAML:2.0:nameid-format:persistent urn:oasis:namesSAML:1.1:nameid-format:X509SubjectName urn:oasis:namesSAML:2.0:nameid-format:WindowsDomainQualifiedName urn:oasis:namesSAML:2.0:nameid-format:transient urn:oasis:namesSAML:1.1:nameid-format:unspecified] Optional: {}

SAMLProviderStatus¶

SAMLProviderStatus reports the provider's state in authentik.

Appears in: - SAMLProvider

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`providerID` integer	ProviderID is authentik's numeric primary key for this provider. It is what an Application or Outpost must reference, so it is surfaced separately from the generic RemoteID string.	Optional: {}
`metadataURL` string	MetadataURL serves the provider's SAML metadata document, which most service providers can consume directly instead of being configured field by field.	Optional: {}
`issuerURL` string	IssuerURL is the entity ID authentik presents as the issuer.	Optional: {}

SAMLSignatureAlgorithm¶

Underlying type: string

SAMLSignatureAlgorithm identifies the XML signature algorithm by its W3C URI.

Validation: - Enum: [http://www.w3.org/2000/09/xmldsig#rsa-sha1 http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384 http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512 http://www.w3.org/2000/09/xmldsig#dsa-sha1]

Appears in: - SAMLProviderSpec

SecretKeyReference¶

SecretKeyReference selects one key of a Secret in an explicitly named namespace. Used by cluster-scoped objects, which have no namespace of their own to default to.

Appears in: - ClusterAuthentikConnectionSpec

Field	Description	Validation
`name` string	Name of the Secret.	MinLength: 1
`namespace` string	Namespace holding the Secret.	MinLength: 1
`key` string	Key within the Secret's data.	MinLength: 1

ServiceConnectionCommonSpec¶

ServiceConnectionCommonSpec holds the fields every outpost service connection shares.

A service connection is what authentik uses to deploy and manage an outpost on the caller's behalf. It is not a provider, so it carries none of the flow references providers need; only identity and lifecycle policy are shared.

Appears in: - DockerServiceConnectionSpec - KubernetesServiceConnectionSpec

Field	Description	Default	Validation
`connectionRef` ConnectionReference	ConnectionRef selects the authentik instance this service connection lives in.
`name` string	Name is the service connection's name in authentik. Defaults to the resource name.		Optional: {}
`adoptionPolicy` AdoptionPolicy	AdoptionPolicy controls what happens when a service connection with this name already exists in authentik.	FailOnConflict	Enum: [FailOnConflict AdoptExisting] Optional: {}
`deletionPolicy` DeletionPolicy	DeletionPolicy controls what happens to the authentik service connection when this resource is deleted.	Delete	Enum: [Delete Orphan] Optional: {}

ServiceConnectionStatus¶

ServiceConnectionStatus is the status shared by every service connection kind.

Appears in: - DockerServiceConnectionStatus - KubernetesServiceConnectionStatus

Field	Description	Validation
`conditions` Condition array	Conditions describe the current state of the resource.	Optional: {}
`observedGeneration` integer	ObservedGeneration is the .metadata.generation this status reflects.	Optional: {}
`remoteID` string	RemoteID is authentik's own identifier for the managed object: a numeric primary key for providers and applications, a UUID elsewhere. Once set this is the authoritative handle for the object. Lookups prefer it over the name, so that renaming the object on either side does not cause the operator to lose track of it and create a duplicate.	Optional: {}
`remoteName` string	RemoteName is the name or slug last observed in authentik. Informational.	Optional: {}
`adopted` boolean	Adopted records that this resource took over a pre-existing authentik object rather than creating it.	Optional: {}
`lastSyncedTime` Time	LastSyncedTime is when the resource last reconciled successfully.	Optional: {}
`serviceConnectionID` string	ServiceConnectionID is authentik's UUID for this service connection. It is what an Outpost's serviceConnectionRef ultimately resolves to, so it is surfaced separately from the generic RemoteID string.	Optional: {}