This is a quick guide on how to deploy Authentik, an open source, self-hosted identity provider (IdP) on the same underlying Kubernetes cluster that is running the Octelium Cluster and use it as an OpenID Connect IdentityProvider (read more about IdentityProviders here) to be able to login to the Cluster.

In this guide we use Helm to install Authentik. First, we need to create a values.yaml YAML file for the Authentik Helm chart (see the chart here) as follows:

1
authentik:
2
  secret_key: <SECRET_KEY>
3
  postgresql:
4
    password: <POSTGRES_PASSWORD>
5

6
global:
7
  env:
8
    - name: AUTHENTIK_BOOTSTRAP_PASSWORD
9
      value: <BOOTSTRAP_LOGIN_PASSWORD>
10
server:
11
  ingress:
12
    enabled: false
13
postgresql:
14
  enabled: true
15
  auth:
16
    password: <POSTGRES_PASSWORD>
17
redis:
18
  enabled: true

python -c "import random, string; print(''.join(random.choices(string.ascii_letters + string.digits, k=16)))"

Now deploy Authentik on the Kubernetes cluster using our values.yaml file as follows:

helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik --namespace authentik --create-namespace -f </PATH/TO/VALUES.YAML>

Now create an Octelium Service for the Authentik web server as follows:

1
kind: Service
2
metadata:
3
  name: idp
4
spec:
5
  mode: HTTP
6
  config:
7
    upstream:
8
      url: http://authentik-server.authentik.svc
9
    http:
10
      header:
11
        forwardedMode: TRANSPARENT
12
        host:
13
          preserve: true
14
  isPublic: true
15
  isAnonymous: true

Now you can apply the creation of the Service via the octeliumctl apply command (read more here) as follows:

octeliumctl apply /PATH/TO/SERVICE.YAML

Now we visit the Service via the web browser at the URL https://idp.<DOMAIN> and use the user akadmin and the password <BOOTSTRAP_LOGIN_PASSWORD> set in the Helm values.yaml set above to login.

Now that you are logged in and inside the Authentik dashboard, you can create an OpenID Connect client application and use it to create an IdentityProvider in Octelium as follows:

1. Go to Applications > Applications > Create with Provider.

2. Select OAuth2/OpenID Provider and press Next.

3. Set the application details as follows:

   1. Set a Provider Name (e.g. octelium)
   2. Set Authorization Flow to default-provider-authorization-explicit-consent (Authorize Application)
   3. Copy the application's client ID and client secret in order to be used in our IdentityProvider as shown below.
   4. Set Redirect URIs/Origins to Strict with the URL https://<DOMAIN>/callback

4. Now go back to the list in Applications > Applications and visit the page of the Application you just created.

5. Click on Provider for <YOUR_APP> (OAuth2/OpenID Provider).

6. Copy the value OpenID Configuration Issuer as we are going to use it later to define our IdentityProvider in the issuerURL field as shown below.

Now create an a Secret for the application's client secret as follows:

octeliumctl create secret authentik

Now create an OpenID Connect IdentityProvider using the application's client id, the client secret's Secret and the issuer URL as follows:

1
kind: IdentityProvider
2
metadata:
3
  name: authentik
4
spec:
5
  displayName: Login with Authentik
6
  oidc:
7
    clientID: <CLIENT_ID>
8
    clientSecret:
9
      fromSecret: authentik
10
    issuerURL: <YOUR_OPENID_ISSUER_URL>

Now you can apply the creation of the IdentityProvider via the octeliumctl apply command as follows:

octeliumctl apply /PATH/TO/IDENTITY_PROVIDER.YAML