authentik helm release

Key	Types
server.ingress.enabled (28) `true`	boolean
server.ingress.hosts[] (24) `- auth.${SECRET_DOMAIN}`	string
server.ingress.ingressClassName (21) `external`	string
server.ingress.tls[].hosts[] (20) `- auth.${SECRET_DOMAIN}`	string
server.ingress.tls[].secretName (12) `authentik-tls`	string
server.ingress.annotations."external-dns.alpha.kubernetes.io/target" (12) `external.${SECRET_DOMAIN}`	string
server.ingress.annotations."cert-manager.io/cluster-issuer" (8) `letsencrypt-production`	string
server.ingress.annotations."hajimari.io/icon" (6) `shield-lock`	string
server.ingress.annotations."hajimari.io/enable" (5) `true`	string
server.ingress.annotations."hajimari.io/group" (3) `Home/Web`	string
server.ingress.annotations."traefik.ingress.kubernetes.io/router.entrypoints" (3) `websecure`	string
server.ingress.annotations."traefik.ingress.kubernetes.io/router.middlewares" (3) `networking-chain-no-auth@kubernetescrd`	string
server.ingress.annotations."external-dns.home.arpa/enabled" (2) `true`	string
server.ingress.annotations."gatus.io/enabled" (2) `true`	string
server.ingress.annotations."gethomepage.dev/enabled" (2) `true`	string
server.ingress.annotations."gethomepage.dev/group" (2) `Networking`	string
server.ingress.annotations."gethomepage.dev/icon" (2) `authentik.png`	string
server.ingress.annotations."gethomepage.dev/name" (2) `Authentik`	string
server.ingress.annotations."gethomepage.dev/pod-selector" (2) `app.kubernetes.io/name=authentik`	string
server.ingress.annotations."gethomepage.dev/siteMonitor" (2) `http://authentik-server.networking.svc.cluster.local:80`	string
server.ingress.annotations."kubernetes.io/ingress.class" (2) `nginx`	string
server.ingress.annotations."nginx.ingress.kubernetes.io/enable-global-auth" (2) `false`	string
server.ingress.annotations."nginx.ingress.kubernetes.io/proxy-read-timeout" (2) `3600`	string
server.ingress.annotations."nginx.ingress.kubernetes.io/proxy-send-timeout" (2) `3600`	string
server.ingress.annotations."coredns.io/hostname" (1) `auth.${XYZ_DOMAIN}`	string
server.ingress.annotations.external-dns/is-public (1) `true`	string
server.ingress.annotations."external-dns.target/enabled" (1) `true`	string
server.ingress.annotations."gethomepage.dev/description" (1) `Identity Provider`	string
server.ingress.annotations."gethomepage.dev/widget.key" (1) `{{HOMEPAGE_VAR_AUTHENTIK_TOKEN}}`	string
server.ingress.annotations."gethomepage.dev/widget.type" (1) `authentik`	string
server.ingress.annotations."gethomepage.dev/widget.url" (1) `http://authentik-server.networking.svc.cluster.local:80`	string
server.ingress.annotations."hajimari.io/appName" (1) `Login Settings`	string
server.ingress.annotations."hajimari.io/instance" (1) `bloop-xyz,bloop-quarky`	string
server.ingress.annotations."hajimari.io/url" (1) `https://auth.${XYZ_DOMAIN}`	string
server.ingress.annotations."haproxy.org/allow-list" (1) `${HAPROXY_WHITELIST}`	string
server.ingress.annotations."haproxy.org/response-set-header" (1) `Strict-Transport-Security "max-age=31536000" X-Frame-Options "DENY" X-Content-Type-Options "nosniff" Referrer-Policy "strict-origin-when-cross-origin"`	string
server.ingress.annotations."haproxy.org/ssl-redirect-port" (1) `443`	string
server.ingress.annotations."nginx.org/websocket-services" (1) `authentik`	string
server.ingress.paths[] (6) `- /`	string
server.ingress.pathType (2) `Prefix`	string
server.ingress.https (1) `false`	boolean
server.metrics.serviceMonitor.enabled (23) `true`	boolean, string
server.metrics.serviceMonitor.create (1) `true`	boolean
server.metrics.enabled (18) `true`	boolean
server.metrics.prometheus.serviceMonitor.enabled (4) `true`	boolean
server.metrics.prometheus.serviceMonitor.namespace (1) `security`	string
server.metrics.metrics.enabled (1) `true`	boolean
server.replicas (18) `1`	number
server.resources.requests.cpu (18) `50m`	string
server.resources.requests.memory (16) `512Mi`	string
server.resources.limits.memory (15) `800Mi`	string
server.resources.limits.cpu (3) `2`	string
server.initContainers[].image (14) `ghcr.io/onedr0p/postgres-init:16.8`	string
server.initContainers[].name (14) `init-db`	string
server.initContainers[].envFrom[].secretRef.name (13) `authentik-secret`	string
server.initContainers[].imagePullPolicy (2) `IfNotPresent`	string
server.initContainers[].env[].name (1) `INIT_POSTGRES_HOST INIT_POSTGRES_DBNAME INIT_POSTGRES_SUPER_PASS INIT_POSTGRES_SUPER_USER INIT_POSTGRES_USER INIT_POSTGRES_PASS`	string
server.initContainers[].env[].value (1) `postgres-rw.databases.svc.cluster.local. authentik authentik ${AUTHENTIK_DB_PASS}`	string
server.initContainers[].env[].valueFrom.secretKeyRef.key (1) `password username`	string
server.initContainers[].env[].valueFrom.secretKeyRef.name (1) `postgres-superuser postgres-superuser`	string
server.initContainers[].limits.memory (1) `1Gi`	string
server.initContainers[].requests.cpu (1) `100m`	string
server.initContainers[].requests.memory (1) `100Mi`	string
server.autoscaling.enabled (5) `true`	boolean
server.autoscaling.minReplicas (5) `1`	number
server.autoscaling.maxReplicas (3) `3`	number
server.autoscaling.targetCPUUtilizationPercentage (1) `50`	number
server.pdb.enabled (5) `true`	boolean
server.pdb.maxUnavailable (4) `1`	number
server.pdb.minAvailable (4) `1`	number
server.volumeMounts[].mountPath (5) `/media/public/custom`	string
server.volumeMounts[].name (5) `authentik-branding`	string
server.volumeMounts[].subPath (1) `groovie-melting.png groovie-background.jpg custom.css`	string
server.route.main.enabled (4) `true`	boolean
server.route.main.hostnames[] (4) `- sso.${SECRET_DOMAIN}`	string
server.route.main.parentRefs[].name (4) `external`	string
server.route.main.parentRefs[].namespace (4) `network`	string
server.route.main.parentRefs[].kind (3) `Gateway`	string
server.route.main.parentRefs[].group (2) `gateway.networking.k8s.io`	string
server.route.main.parentRefs[].sectionName (2) `https`	string
server.route.main.annotations."external-dns.alpha.kubernetes.io/target" (2) `external.${SECRET_DOMAIN}`	string
server.volumes[].name (4) `authentik-branding`	string
server.volumes[].configMap.name (2) `authentik-theme`	string
server.volumes[].persistentVolumeClaim.claimName (2) `authentik-branding`	string
server.containerSecurityContext.allowPrivilegeEscalation (2) `false`	boolean
server.containerSecurityContext.capabilities.drop[] (2) `- ALL`	string
server.containerSecurityContext.runAsNonRoot (2) `true`	boolean
server.containerSecurityContext.seccompProfile.type (2) `RuntimeDefault`	string
server.containerSecurityContext.readOnlyRootFilesystem (1) `true`	boolean
server.startupProbe.initialDelaySeconds (2) `120`	number
server.startupProbe.timeoutSeconds (1) `10`	number
server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels."app.kubernetes.io/component" (1) `server`	string
server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels."app.kubernetes.io/name" (1) `authentik`	string
server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey (1) `kubernetes.io/hostname`	string
server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1) `100`	number
server.annotations."secret.reloader.stakater.com/reload" (1) `authentik-secret`	string
server.dnsConfig.options[].name (1) `ndots`	string
server.dnsConfig.options[].value (1) `2`	string
server.env[].name (1) `OTEL_SERVICE_NAME AUTHENTIK_TRACING__ENABLED AUTHENTIK_TRACING__EXPORTER OTEL_EXPORTER_OTLP_ENDPOINT OTEL_EXPORTER_OTLP_PROTOCOL OTEL_TRACES_EXPORTER OTEL_PROPAGATORS OTEL_TRACES_SAMPLER OTEL_RESOURCE_ATTRIBUTES`	string
server.env[].value (1) `authentik true otlp http://tempo-distributor.observability.svc.cluster.local:4318 http/protobuf otlp tracecontext,baggage parentbased_always_on service.name=authentik,service.namespace=security,app.type=identity-provider`	string
server.initContainers.init-db.envFrom[].secretRef.name (1) `authentik-secret`	string
server.initContainers.init-db.image.repository (1) `ghcr.io/onedr0p/postgres-init`	string
server.initContainers.init-db.image.tag (1) `16`	number
server.livenessProbe.failureThreshold (1) `5`	number
server.livenessProbe.initialDelaySeconds (1) `30`	number
server.livenessProbe.timeoutSeconds (1) `10`	number
server.name (1) `server`	string
server.podLabels."endpoints.netpols.home.arpa/external-ingress-enabled" (1) `true`	string
server.podSecurityContext.fsGroup (1) `150`	number
server.probes.readiness.enabled (1) `true`	boolean
server.probes.readiness.spec.failureThreshold (1) `3`	number
server.probes.readiness.spec.initialDelaySeconds (1) `30`	number
server.probes.readiness.spec.periodSeconds (1) `10`	number
server.probes.readiness.spec.timeoutSeconds (1) `5`	number
server.readinessProbe.failureThreshold (1) `5`	number
server.readinessProbe.initialDelaySeconds (1) `30`	number
server.readinessProbe.timeoutSeconds (1) `10`	number
server.revisionHistoryLimit (1) `3`	number
server.securityContext.runAsGroup (1) `150`	number
server.securityContext.runAsUser (1) `1000`	number
server.serviceAccountName (1) `authentik`	string
server.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (1) `server`	string
server.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1) `authentik`	string
server.topologySpreadConstraints[].maxSkew (1) `1`	number
server.topologySpreadConstraints[].topologyKey (1) `kubernetes.io/hostname`	string
server.topologySpreadConstraints[].whenUnsatisfiable (1) `DoNotSchedule`	string
redis.enabled (24) `true`	boolean
redis.master.persistence.enabled (4) `true`	boolean
redis.master.persistence.size (2) `8Gi`	string
redis.master.persistence.storageClass (1) `ceph-block-internal`	string
redis.master.resourcesPreset (1) `medium`	string
redis.master.securityContext.enabled (1) `true`	boolean
redis.auth.enabled (2) `true`	boolean
redis.auth.password (1) `${AUTHENTIK_REDIS_PASSWORD}`	string
redis.global.defaultStorageClass (2) `longhorn`	string
redis.global.storageClass (1) `zfs-iscsi`	string
redis.metrics.enabled (2) `true`	boolean
redis.metrics.serviceMonitor.enabled (2) `true`	boolean
redis.persistence.enabled (2) `false`	boolean
redis.commonConfiguration (1) `appendonly no save ""`	string
redis.redis.useAOFPersistence (1) `no`	string
global.envFrom[].secretRef.name (23) `authentik-secret`	string
global.envFrom[].configMapRef.name (1) `authentik-media`	string
global.volumes[].name (12) `authentik-templates`	string
global.volumes[].configMap.name (8) `authentik-templates`	string
global.volumes[].configMap.defaultMode (1) `440 440`	number
global.volumes[].secret.secretName (3) `authentik-sub-secrets authentik-sub-secrets`	string
global.volumes[].secret.items[].key (2) `tls.crt tls.key`	string
global.volumes[].secret.items[].path (2) `fullchain.pem privkey.pem`	string
global.volumes[].secret.defaultMode (1) `440 440 440`	number
global.volumes[].secret.optional (1) `false`	boolean
global.volumes[].emptyDir.medium (1) `Memory`	string
global.volumes[].emptyDir.sizeLimit (1) `64Mi`	string
global.volumes[].persistentVolumeClaim.claimName (1) `authentik-media-cephfs`	string
global.volumes[].projected.defaultMode (1) `775`	number
global.volumes[].projected.sources[].configMap.items[].key (1) `sound_wave.svg`	string
global.volumes[].projected.sources[].configMap.items[].path (1) `sound_wave.svg`	string
global.volumes[].projected.sources[].configMap.name (1) `background-image-1`	string
global.env[].name (11) `AUTHENTIK_SESSION_STORAGE`	string
global.env[].value (6) `db`	string
global.env[].valueFrom.secretKeyRef.key (5) `secret_key password`	string
global.env[].valueFrom.secretKeyRef.name (5) `authentik-configsecrets authentik-postgresql`	string
global.volumeMounts[].mountPath (11) `/templates`	string
global.volumeMounts[].name (11) `authentik-templates`	string
global.volumeMounts[].subPath (4) `custom.css`	string
global.volumeMounts[].readOnly (2) `true true true true true true true true true`	boolean
global.deploymentStrategy.type (10) `RollingUpdate`	string
global.deploymentStrategy.rollingUpdate.maxSurge (1) `0`	number
global.deploymentStrategy.rollingUpdate.maxUnavailable (1) `1`	number
global.deploymentAnnotations."secret.reloader.stakater.com/reload" (8) `authentik-secret`	string
global.image.repository (7) `ghcr.io/goauthentik/server`	string
global.image.tag (6) `gh-version-2025.12`	string
global.image.pullPolicy (1) `IfNotPresent`	string
global.podAnnotations."reloader.stakater.com/auto" (5) `true`	string
global.podAnnotations."secret.reloader.stakater.com/reload" (3) `authentik-secret`	string
global.addPrometheusAnnotations (3) `true`	boolean, string
global.fullnameOverride (3) `authentik`	string
global.securityContext.fsGroup (2) `1000`	number
global.securityContext.fsGroupChangePolicy (1) `OnRootMismatch`	string
global.securityContext.runAsGroup (1) `1000`	number
global.securityContext.runAsUser (1) `1000`	number
global.storageClass (2) `ceph-block`	string
global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1) `kubernetes.io/arch`	string
global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1) `In`	string
global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1) `- amd64 - i386 - i686 - x86`	string
global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1) `60`	number
global.podLabels."endpoints.netpols.home.arpa/email-sender" (1) `true`	string
global.podLabels."spiffe.bloopysphere.arpa/enabled" (1) `true`	string
global.postgresql.host (1) `enterprise-postgres-rw.databases.svc.cluster.local`	string
global.postgresql.port (1) `5432`	number
global.postgresql.read_replicas.0.host (1) `enterprise-postgres-r.databases.svc.cluster.local`	string
global.postgresql.read_replicas.0.port (1) `5432`	number
global.priorityClassName (1) `security-critical`	string
global.redis.host (1) `{{ .Release.Name }}-redis-master`	string
global.redis.password (1)	string
global.revisionHistoryLimit (1) `3`	number
global.topologySpreadConstraints[].maxSkew (1) `1`	number
global.topologySpreadConstraints[].topologyKey (1) `kubernetes.io/hostname`	string
global.topologySpreadConstraints[].whenUnsatisfiable (1) `DoNotSchedule`	string
authentik.log_level (22) `info`	string
authentik.error_reporting.enabled (20) `false`	boolean
authentik.error_reporting.send_pii (10) `false`	boolean
authentik.error_reporting.enable (5) `false`	boolean
authentik.error_reporting.environment (4) `beryjuio-test`	string
authentik.error_reporting.sample_rate (2) `0.5`	number
authentik.error_reporting.sentry_dsn (2) `https://7f785644f04047ea8202df0320bb671d@sentry.beryju.io/3`	string
authentik.redis.host (18) `dragonfly.database.svc.cluster.local`	string
authentik.redis.db (3) `1`	number
authentik.redis.password (2) `${AUTHENTIK_REDIS_PASSWORD}`	string
authentik.redis.port (1) `6379`	number
authentik.email.port (16) `25`	number, string
authentik.email.from (15) `Authentik <mail@${SECRET_DOMAIN}>`	string
authentik.email.host (14) `smtp-relay.default.svc.cluster.local`	string
authentik.email.use_tls (13) `false`	boolean, string
authentik.email.use_ssl (7) `false`	string, boolean
authentik.email.timeout (5) `30`	string, number
authentik.email.password (2) `${AUTHENTIK_EMAIL_PASSWORD}`	string
authentik.email.username (2) `${AUTHENTIK_EMAIL_USERNAME}`	string
authentik.postgresql.name (14) `authentik`	string
authentik.postgresql.user (12) `authentik`	string
authentik.postgresql.host (11) `postgresql.database.svc.cluster.local`	string
authentik.postgresql.password (9)	string
authentik.postgresql.port (7) `5432`	number
authentik.postgresql.enabled (3) `true`	boolean
authentik.postgresql.read_replicas.0.host (1) `postgres16-r.database.svc.cluster.local`	string
authentik.postgresql.read_replicas.0.port (1) `5432`	number
authentik.postgresql.s3_backup.access_key (1) `${AUTHENTIK_S3_ACCESS_KEY}`	string
authentik.postgresql.s3_backup.bucket (1) `authentik-postgresql-backup`	string
authentik.postgresql.s3_backup.host (1) `http://s3.minio.storage`	string
authentik.postgresql.s3_backup.secret_key (1) `${AUTHENTIK_S3_SECRET}`	string
authentik.postgresql.sslmode (1) `disable`	string
authentik.avatars (7) `gravatar,initials`	string
authentik.secret_key (7) `${SECRET_AUTHENTIK_SECRET_KEY}`	string
authentik.outposts.container_image_base (6) `ghcr.io/goauthentik/%(type)s:%(version)s`	string
authentik.outposts.docker_image_base (3) `ghcr.io/goauthentik/%(type)s:%(version)s`	string
authentik.compliance.fips.enabled (2) `true`	boolean
authentik.disable_startup_analytics (2) `true`	boolean
authentik.blueprints[].configMapRef.name (1) `authentik-discord-blueprint authentik-base-blueprints`	string
authentik.blueprints[].path (1) `/blueprints/sidecar`	string
authentik.footer_links (1) `[]`	string
authentik.security_key (1)	string
postgresql.enabled (21) `false`	boolean
postgresql.image.tag (4) `15.14-bookworm`	string
postgresql.image.registry (2) `docker.io`	string
postgresql.image.repository (2) `bitnami/postgresql`	string
postgresql.metrics.enabled (3) `true`	boolean
postgresql.metrics.serviceMonitor.enabled (3) `true`	boolean
postgresql.metrics.image.repository (2) `prometheuscommunity/postgres-exporter`	string
postgresql.metrics.image.tag (2) `v0.19.0`	string
postgresql.auth.existingSecret (2) `authentik-postgres-secrets`	string
postgresql.auth.secretKeys.userPasswordKey (1) `postgres-password`	string
postgresql.global.imageRegistry (2) `proxy.registry.beryju.io`	string
postgresql.global.defaultStorageClass (1) `openebs-hostpath`	string
postgresql.postgresqlPassword (2) `${AUTH_AUTHENTIK_POSTGRESQL_PASSWORD}`	string
postgresql.primary.networkPolicy.extraIngress[].ports[].port (2) `15020`	number
postgresql.primary.networkPolicy.extraIngress[].ports[].protocol (2) `TCP`	string
postgresql.primary.persistence.enabled (2) `true`	boolean
postgresql.primary.persistence.size (2) `8Gi`	string
postgresql.primary.persistence.storageClass (1) `ceph-block-internal`	string
postgresql.persistence.enabled (1) `true`	boolean
postgresql.persistence.existingClaim (1) `authentik-postgresql-v1`	string
postgresql.postgresqlDatabase (1) `authentik`	string
postgresql.postgresqlUsername (1) `authentik`	string
prometheus.rules.enabled (20) `true`	boolean, string
prometheus.rules.create (1) `true`	boolean
prometheus.serviceMonitor.create (1) `true`	boolean
prometheus.serviceMonitor.interval (1) `60s`	string
prometheus.serviceMonitor.scrapeTimeout (1) `30s`	string
worker.replicas (19) `1`	number
worker.resources.requests.cpu (15) `50m`	string
worker.resources.requests.memory (15) `512Mi`	string
worker.resources.limits.memory (14) `1200Mi`	string
worker.resources.limits.cpu (2) `300m`	string
worker.autoscaling.enabled (4) `true`	boolean
worker.autoscaling.maxReplicas (4) `3`	number
worker.autoscaling.minReplicas (4) `1`	number
worker.autoscaling.targetCPUUtilizationPercentage (2) `70`	number
worker.metrics.enabled (4) `true`	boolean
worker.metrics.serviceMonitor.enabled (4) `true`	boolean
worker.metrics.prometheus.serviceMonitor.enabled (2) `true`	boolean
worker.volumeMounts[].mountPath (4) `/blueprints/sidecar`	string
worker.volumeMounts[].name (4) `sidecar-blueprints`	string
worker.volumes[].name (4) `sidecar-blueprints`	string
worker.volumes[].configMap.name (1) `authentik-blueprints`	string
worker.volumes[].emptyDir.medium (1) `Memory`	string
worker.pdb.enabled (3) `true`	boolean
worker.pdb.minAvailable (3) `1`	number
worker.pdb.maxUnavailable (2) `1`	number
worker.startupProbe.initialDelaySeconds (3) `30`	number
worker.startupProbe.timeoutSeconds (2) `30`	number
worker.startupProbe.failureThreshold (1) `30`	number
worker.startupProbe.periodSeconds (1) `10`	number
worker.containerSecurityContext.allowPrivilegeEscalation (2) `false`	boolean
worker.containerSecurityContext.capabilities.drop[] (2) `- ALL`	string
worker.containerSecurityContext.runAsNonRoot (2) `true`	boolean
worker.containerSecurityContext.seccompProfile.type (2) `RuntimeDefault`	string
worker.containerSecurityContext.readOnlyRootFilesystem (1) `true`	boolean
worker.extraContainers[].env[].name (2) `FOLDER LABEL LABEL_VALUE NAMESPACE RESOURCE UNIQUE_FILENAMES`	string
worker.extraContainers[].env[].value (2) `/blueprints/sidecar goauthentik_blueprint 1 ALL both true`	string
worker.extraContainers[].image (2) `ghcr.io/kiwigrid/k8s-sidecar:2.5.0`	string
worker.extraContainers[].name (2) `sidecar-blueprints`	string
worker.extraContainers[].volumeMounts[].mountPath (2) `/blueprints/sidecar`	string
worker.extraContainers[].volumeMounts[].name (2) `sidecar-blueprints`	string
worker.extraContainers[].imagePullPolicy (1) `IfNotPresent`	string
worker.extraContainers[].resources.limits.memory (1) `512Mi`	string
worker.extraContainers[].resources.requests.cpu (1) `11m`	string
worker.extraContainers[].resources.requests.memory (1) `352Mi`	string
worker.livenessProbe.failureThreshold (2) `5`	number
worker.livenessProbe.initialDelaySeconds (2) `120`	number
worker.livenessProbe.timeoutSeconds (2) `30`	number
worker.livenessProbe.periodSeconds (1) `30`	number
worker.name (2) `worker`	string
worker.readinessProbe.failureThreshold (2) `5`	number
worker.readinessProbe.initialDelaySeconds (2) `120`	number
worker.readinessProbe.timeoutSeconds (2) `30`	number
worker.readinessProbe.periodSeconds (1) `30`	number
worker.serviceAccount.create (2) `true`	boolean
worker.annotations."secret.reloader.stakater.com/reload" (1) `authentik-secret`	string
worker.env[].name (1) `OTEL_SERVICE_NAME AUTHENTIK_TRACING__ENABLED AUTHENTIK_TRACING__EXPORTER OTEL_EXPORTER_OTLP_ENDPOINT OTEL_EXPORTER_OTLP_PROTOCOL OTEL_TRACES_EXPORTER OTEL_PROPAGATORS OTEL_TRACES_SAMPLER OTEL_RESOURCE_ATTRIBUTES`	string
worker.env[].value (1) `authentik-worker true otlp http://tempo-distributor.observability.svc.cluster.local:4318 http/protobuf otlp tracecontext,baggage parentbased_always_on service.name=authentik-worker,service.namespace=security,app.type=identity-provider,component=worker`	string
worker.probes.liveness.enabled (1) `true`	boolean
worker.probes.liveness.spec.timeoutSeconds (1) `10`	number
worker.probes.readiness.enabled (1) `true`	boolean
worker.probes.readiness.spec.timeoutSeconds (1) `10`	number
worker.probes.startup.enabled (1) `true`	boolean
worker.probes.startup.spec.timeoutSeconds (1) `10`	number
worker.revisionHistoryLimit (1) `3`	number
worker.serviceAccountName (1) `authentik`	string
worker.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (1) `worker`	string
worker.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1) `authentik`	string
worker.topologySpreadConstraints[].maxSkew (1) `1`	number
worker.topologySpreadConstraints[].topologyKey (1) `kubernetes.io/hostname`	string
worker.topologySpreadConstraints[].whenUnsatisfiable (1) `DoNotSchedule`	string
geoip.enabled (8) `false`	boolean
geoip.existingSecret.secretName (6) `authentik-secret`	string
geoip.existingSecret.accountId (5) `MAXMIND_ACCOUNT_ID`	string
geoip.existingSecret.licenseKey (5) `MAXMIND_LICENSE_KEY`	string
geoip.editionIds (2) `GeoLite2-City GeoLite2-ASN`	string
geoip.updateInterval (2) `48`	number
geoip.accountId (1) `878850`	string
geoip.licenseKey (1) `${SECRET_MAXMIND_LICENSE_KEY}`	string
fullnameOverride (4) `authentik`	string
ingress.enabled (3) `true`	boolean
ingress.hosts[].host (3) `sso.${SECRET_DOMAIN}`	string
ingress.hosts[].paths[].path (3) `/`	string
ingress.hosts[].paths[].pathType (2) `Prefix`	string
ingress.ingressClassName (3) `nginx`	string
ingress.tls[].hosts[] (3) `- sso.${SECRET_DOMAIN}`	string
ingress.tls[].secretName (2) `acme-crt-secret-sparks-codes`	string
ingress.annotations."hajimari.io/icon" (2) `ph:password-bold`	string
ingress.annotations."cert-manager.io/cluster-issuer" (1) `letsencrypt-production`	string
ingress.annotations."external-dns.alpha.kubernetes.io/target" (1) `${CLOUDFLARE_DDNS_RECORD}`	string
ingress.annotations."hajimari.io/appName" (1) `Authentik`	string
ingress.annotations."hajimari.io/enable" (1) `true`	string
serviceAccount.create (2) `true`	boolean
serviceAccount.fullnameOverride (1) `authentik`	string
serviceAccount.nameOverride (1) `authentik`	string
serviceAccount.serviceAccountSecret.enabled (1) `false`	boolean
backups.destinationPath (1) `${s3_destination_path}`	string
backups.enabled (1) `true`	boolean
backups.endpointURL (1) `${s3_endpoint_url}`	string
backups.provider (1) `s3`	string
backups.retentionPolicy (1) `30d`	string
backups.s3.accessKey (1) `${s3_key_id}`	string
backups.s3.secretKey (1) `${s3_key}`	string
backups.scheduledBackups[].backupOwnerReference (1) `self`	string
backups.scheduledBackups[].name (1) `daily-authentik-backup`	string
backups.scheduledBackups[].schedule (1) `0 0 0 * * *`	string
backups.wal.compression (1) `snappy`	string
cluster.affinity.enablePodAntiAffinity (1) `true`	boolean
cluster.affinity.podAntiAffinityType (1) `required`	string
cluster.affinity.topologyKey (1) `kubernetes.io/hostname`	string
cluster.instances (1) `3`	number
cluster.monitoring.enabled (1) `true`	boolean
cluster.storage.size (1) `125Gi`	string
cluster.storage.storageClass (1) `longhorn-fast-unreplicated-strictlocal`	string
cluster.walStorage.size (1) `10Gi`	string
cluster.walStorage.storageClass (1) `longhorn-fast-unreplicated-strictlocal`	string
image.pullPolicy (1) `IfNotPresent`	string
image.repository (1) `ghcr.io/goauthentik/server`	string
image.tag (1) `2023.6.1`	string
kubernetesIntegration (1) `true`	boolean
postgres.enabled (1) `false`	boolean
securityContext.fsGroup (1) `1000`	number
volumeMounts[].mountPath (1) `/media`	string
volumeMounts[].name (1) `media`	string
volumes[].name (1) `media`	string
volumes[].persistentVolumeClaim.claimName (1) `authentik-media`	string

Key

Types

server.ingress.enabled (28)

true

boolean

server.ingress.hosts[] (24)

- auth.${SECRET_DOMAIN}

string

server.ingress.ingressClassName (21)

external

string

server.ingress.tls[].hosts[] (20)

- auth.${SECRET_DOMAIN}

string

server.ingress.tls[].secretName (12)

authentik-tls

string

server.ingress.annotations."external-dns.alpha.kubernetes.io/target" (12)

external.${SECRET_DOMAIN}

string

server.ingress.annotations."cert-manager.io/cluster-issuer" (8)

letsencrypt-production

string

server.ingress.annotations."hajimari.io/icon" (6)

shield-lock

string

server.ingress.annotations."hajimari.io/enable" (5)

true

string

server.ingress.annotations."hajimari.io/group" (3)

Home/Web

string

server.ingress.annotations."traefik.ingress.kubernetes.io/router.entrypoints" (3)

websecure

string

server.ingress.annotations."traefik.ingress.kubernetes.io/router.middlewares" (3)

networking-chain-no-auth@kubernetescrd

string

server.ingress.annotations."external-dns.home.arpa/enabled" (2)

true

string

server.ingress.annotations."gatus.io/enabled" (2)

true

string

server.ingress.annotations."gethomepage.dev/enabled" (2)

true

string

server.ingress.annotations."gethomepage.dev/group" (2)

Networking

string

server.ingress.annotations."gethomepage.dev/icon" (2)

authentik.png

string

server.ingress.annotations."gethomepage.dev/name" (2)

Authentik

string

server.ingress.annotations."gethomepage.dev/pod-selector" (2)

app.kubernetes.io/name=authentik

string

server.ingress.annotations."gethomepage.dev/siteMonitor" (2)

http://authentik-server.networking.svc.cluster.local:80

string

server.ingress.annotations."kubernetes.io/ingress.class" (2)

nginx

string

server.ingress.annotations."nginx.ingress.kubernetes.io/enable-global-auth" (2)

false

string

server.ingress.annotations."nginx.ingress.kubernetes.io/proxy-read-timeout" (2)

string

server.ingress.annotations."nginx.ingress.kubernetes.io/proxy-send-timeout" (2)

string

server.ingress.annotations."coredns.io/hostname" (1)

auth.${XYZ_DOMAIN}

string

server.ingress.annotations.external-dns/is-public (1)

true

string

server.ingress.annotations."external-dns.target/enabled" (1)

true

string

server.ingress.annotations."gethomepage.dev/description" (1)

Identity Provider

string

server.ingress.annotations."gethomepage.dev/widget.key" (1)

{{HOMEPAGE_VAR_AUTHENTIK_TOKEN}}

string

server.ingress.annotations."gethomepage.dev/widget.type" (1)

authentik

string

server.ingress.annotations."gethomepage.dev/widget.url" (1)

http://authentik-server.networking.svc.cluster.local:80

string

server.ingress.annotations."hajimari.io/appName" (1)

Login Settings

string

server.ingress.annotations."hajimari.io/instance" (1)

bloop-xyz,bloop-quarky

string

server.ingress.annotations."hajimari.io/url" (1)

https://auth.${XYZ_DOMAIN}

string

server.ingress.annotations."haproxy.org/allow-list" (1)

${HAPROXY_WHITELIST}

string

server.ingress.annotations."haproxy.org/response-set-header" (1)

Strict-Transport-Security "max-age=31536000"
X-Frame-Options "DENY"
X-Content-Type-Options "nosniff"
Referrer-Policy "strict-origin-when-cross-origin"

string

server.ingress.annotations."haproxy.org/ssl-redirect-port" (1)

string

server.ingress.annotations."nginx.org/websocket-services" (1)

authentik

string

server.ingress.paths[] (6)

- /

string

server.ingress.pathType (2)

Prefix

string

server.ingress.https (1)

false

boolean

server.metrics.serviceMonitor.enabled (23)

true

boolean, string

server.metrics.serviceMonitor.create (1)

true

boolean

server.metrics.enabled (18)

true

boolean

server.metrics.prometheus.serviceMonitor.enabled (4)

true

boolean

server.metrics.prometheus.serviceMonitor.namespace (1)

security

string

server.metrics.metrics.enabled (1)

true

boolean

server.replicas (18)

number

server.resources.requests.cpu (18)

50m

string

server.resources.requests.memory (16)

512Mi

string

server.resources.limits.memory (15)

800Mi

string

server.resources.limits.cpu (3)

string

server.initContainers[].image (14)

ghcr.io/onedr0p/postgres-init:16.8

string

server.initContainers[].name (14)

init-db

string

server.initContainers[].envFrom[].secretRef.name (13)

authentik-secret

string

server.initContainers[].imagePullPolicy (2)

IfNotPresent

string

server.initContainers[].env[].name (1)

INIT_POSTGRES_HOST
INIT_POSTGRES_DBNAME
INIT_POSTGRES_SUPER_PASS
INIT_POSTGRES_SUPER_USER
INIT_POSTGRES_USER
INIT_POSTGRES_PASS

string

server.initContainers[].env[].value (1)

postgres-rw.databases.svc.cluster.local.
authentik
authentik
${AUTHENTIK_DB_PASS}

string

server.initContainers[].env[].valueFrom.secretKeyRef.key (1)

password
username

string

server.initContainers[].env[].valueFrom.secretKeyRef.name (1)

postgres-superuser
postgres-superuser

string

server.initContainers[].limits.memory (1)

1Gi

string

server.initContainers[].requests.cpu (1)

100m

string

server.initContainers[].requests.memory (1)

100Mi

string

server.autoscaling.enabled (5)

true

boolean

server.autoscaling.minReplicas (5)

number

server.autoscaling.maxReplicas (3)

number

server.autoscaling.targetCPUUtilizationPercentage (1)

number

server.pdb.enabled (5)

true

boolean

server.pdb.maxUnavailable (4)

number

server.pdb.minAvailable (4)

number

server.volumeMounts[].mountPath (5)

/media/public/custom

string

server.volumeMounts[].name (5)

authentik-branding

string

server.volumeMounts[].subPath (1)

groovie-melting.png
groovie-background.jpg
custom.css

string

server.route.main.enabled (4)

true

boolean

server.route.main.hostnames[] (4)

- sso.${SECRET_DOMAIN}

string

server.route.main.parentRefs[].name (4)

external

string

server.route.main.parentRefs[].namespace (4)

network

string

server.route.main.parentRefs[].kind (3)

Gateway

string

server.route.main.parentRefs[].group (2)

gateway.networking.k8s.io

string

server.route.main.parentRefs[].sectionName (2)

https

string

server.route.main.annotations."external-dns.alpha.kubernetes.io/target" (2)

external.${SECRET_DOMAIN}

string

server.volumes[].name (4)

authentik-branding

string

server.volumes[].configMap.name (2)

authentik-theme

string

server.volumes[].persistentVolumeClaim.claimName (2)

authentik-branding

string

server.containerSecurityContext.allowPrivilegeEscalation (2)

false

boolean

server.containerSecurityContext.capabilities.drop[] (2)

- ALL

string

server.containerSecurityContext.runAsNonRoot (2)

true

boolean

server.containerSecurityContext.seccompProfile.type (2)

RuntimeDefault

string

server.containerSecurityContext.readOnlyRootFilesystem (1)

true

boolean

server.startupProbe.initialDelaySeconds (2)

number

server.startupProbe.timeoutSeconds (1)

number

server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels."app.kubernetes.io/component" (1)

server

string

server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels."app.kubernetes.io/name" (1)

authentik

string

server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey (1)

kubernetes.io/hostname

string

server.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)

number

server.annotations."secret.reloader.stakater.com/reload" (1)

authentik-secret

string

server.dnsConfig.options[].name (1)

ndots

string

server.dnsConfig.options[].value (1)

string

server.env[].name (1)

OTEL_SERVICE_NAME
AUTHENTIK_TRACING__ENABLED
AUTHENTIK_TRACING__EXPORTER
OTEL_EXPORTER_OTLP_ENDPOINT
OTEL_EXPORTER_OTLP_PROTOCOL
OTEL_TRACES_EXPORTER
OTEL_PROPAGATORS
OTEL_TRACES_SAMPLER
OTEL_RESOURCE_ATTRIBUTES

string

server.env[].value (1)

authentik
true
otlp
http://tempo-distributor.observability.svc.cluster.local:4318
http/protobuf
otlp
tracecontext,baggage
parentbased_always_on
service.name=authentik,service.namespace=security,app.type=identity-provider

string

server.initContainers.init-db.envFrom[].secretRef.name (1)

authentik-secret

string

server.initContainers.init-db.image.repository (1)

ghcr.io/onedr0p/postgres-init

string

server.initContainers.init-db.image.tag (1)

number

server.livenessProbe.failureThreshold (1)

number

server.livenessProbe.initialDelaySeconds (1)

number

server.livenessProbe.timeoutSeconds (1)

number

server.name (1)

server

string

server.podLabels."endpoints.netpols.home.arpa/external-ingress-enabled" (1)

true

string

server.podSecurityContext.fsGroup (1)

number

server.probes.readiness.enabled (1)

true

boolean

server.probes.readiness.spec.failureThreshold (1)

number

server.probes.readiness.spec.initialDelaySeconds (1)

number

server.probes.readiness.spec.periodSeconds (1)

number

server.probes.readiness.spec.timeoutSeconds (1)

number

server.readinessProbe.failureThreshold (1)

number

server.readinessProbe.initialDelaySeconds (1)

number

server.readinessProbe.timeoutSeconds (1)

number

server.revisionHistoryLimit (1)

number

server.securityContext.runAsGroup (1)

number

server.securityContext.runAsUser (1)

number

server.serviceAccountName (1)

authentik

string

server.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (1)

server

string

server.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1)

authentik

string

server.topologySpreadConstraints[].maxSkew (1)

number

server.topologySpreadConstraints[].topologyKey (1)

kubernetes.io/hostname

string

server.topologySpreadConstraints[].whenUnsatisfiable (1)

DoNotSchedule

string

redis.enabled (24)

true

boolean

redis.master.persistence.enabled (4)

true

boolean

redis.master.persistence.size (2)

8Gi

string

redis.master.persistence.storageClass (1)

ceph-block-internal

string

redis.master.resourcesPreset (1)

medium

string

redis.master.securityContext.enabled (1)

true

boolean

redis.auth.enabled (2)

true

boolean

redis.auth.password (1)

${AUTHENTIK_REDIS_PASSWORD}

string

redis.global.defaultStorageClass (2)

longhorn

string

redis.global.storageClass (1)

zfs-iscsi

string

redis.metrics.enabled (2)

true

boolean

redis.metrics.serviceMonitor.enabled (2)

true

boolean

redis.persistence.enabled (2)

false

boolean

redis.commonConfiguration (1)

appendonly no
save ""

string

redis.redis.useAOFPersistence (1)

no

string

global.envFrom[].secretRef.name (23)

authentik-secret

string

global.envFrom[].configMapRef.name (1)

authentik-media

string

global.volumes[].name (12)

authentik-templates

string

global.volumes[].configMap.name (8)

authentik-templates

string

global.volumes[].configMap.defaultMode (1)

440
440

number

global.volumes[].secret.secretName (3)

authentik-sub-secrets
authentik-sub-secrets

string

global.volumes[].secret.items[].key (2)

tls.crt
tls.key

string

global.volumes[].secret.items[].path (2)

fullchain.pem
privkey.pem

string

global.volumes[].secret.defaultMode (1)

440
440
440

number

global.volumes[].secret.optional (1)

false

boolean

global.volumes[].emptyDir.medium (1)

Memory

string

global.volumes[].emptyDir.sizeLimit (1)

64Mi

string

global.volumes[].persistentVolumeClaim.claimName (1)

authentik-media-cephfs

string

global.volumes[].projected.defaultMode (1)

number

global.volumes[].projected.sources[].configMap.items[].key (1)

sound_wave.svg

string

global.volumes[].projected.sources[].configMap.items[].path (1)

sound_wave.svg

string

global.volumes[].projected.sources[].configMap.name (1)

background-image-1

string

global.env[].name (11)

AUTHENTIK_SESSION_STORAGE

string

global.env[].value (6)

db

string

global.env[].valueFrom.secretKeyRef.key (5)

secret_key
password

string

global.env[].valueFrom.secretKeyRef.name (5)

authentik-configsecrets
authentik-postgresql

string

global.volumeMounts[].mountPath (11)

/templates

string

global.volumeMounts[].name (11)

authentik-templates

string

global.volumeMounts[].subPath (4)

custom.css

string

global.volumeMounts[].readOnly (2)

true
true
true
true
true
true
true
true
true

boolean

global.deploymentStrategy.type (10)

RollingUpdate

string

global.deploymentStrategy.rollingUpdate.maxSurge (1)

number

global.deploymentStrategy.rollingUpdate.maxUnavailable (1)

number

global.deploymentAnnotations."secret.reloader.stakater.com/reload" (8)

authentik-secret

string

global.image.repository (7)

ghcr.io/goauthentik/server

string

global.image.tag (6)

gh-version-2025.12

string

global.image.pullPolicy (1)

IfNotPresent

string

global.podAnnotations."reloader.stakater.com/auto" (5)

true

string

global.podAnnotations."secret.reloader.stakater.com/reload" (3)

authentik-secret

string

global.addPrometheusAnnotations (3)

true

boolean, string

global.fullnameOverride (3)

authentik

string

global.securityContext.fsGroup (2)

number

global.securityContext.fsGroupChangePolicy (1)

OnRootMismatch

string

global.securityContext.runAsGroup (1)

number

global.securityContext.runAsUser (1)

number

global.storageClass (2)

ceph-block

string

global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1)

kubernetes.io/arch

string

global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1)

In

string

global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1)

- amd64
- i386
- i686
- x86

string

global.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)

number

global.podLabels."endpoints.netpols.home.arpa/email-sender" (1)

true

string

global.podLabels."spiffe.bloopysphere.arpa/enabled" (1)

true

string

global.postgresql.host (1)

enterprise-postgres-rw.databases.svc.cluster.local

string

global.postgresql.port (1)

number

global.postgresql.read_replicas.0.host (1)

enterprise-postgres-r.databases.svc.cluster.local

string

global.postgresql.read_replicas.0.port (1)

number

global.priorityClassName (1)

security-critical

string

global.redis.host (1)

{{ .Release.Name }}-redis-master

string

global.redis.password (1)

string

global.revisionHistoryLimit (1)

number

global.topologySpreadConstraints[].maxSkew (1)

number

global.topologySpreadConstraints[].topologyKey (1)

kubernetes.io/hostname

string

global.topologySpreadConstraints[].whenUnsatisfiable (1)

DoNotSchedule

string

authentik.log_level (22)

info

string

authentik.error_reporting.enabled (20)

false

boolean

authentik.error_reporting.send_pii (10)

false

boolean

authentik.error_reporting.enable (5)

false

boolean

authentik.error_reporting.environment (4)

beryjuio-test

string

authentik.error_reporting.sample_rate (2)

0.5

number

authentik.error_reporting.sentry_dsn (2)

https://7f785644f04047ea8202df0320bb671d@sentry.beryju.io/3

string

authentik.redis.host (18)

dragonfly.database.svc.cluster.local

string

authentik.redis.db (3)

number

authentik.redis.password (2)

${AUTHENTIK_REDIS_PASSWORD}

string

authentik.redis.port (1)

number

authentik.email.port (16)

number, string

authentik.email.from (15)

Authentik <mail@${SECRET_DOMAIN}>

string

authentik.email.host (14)

smtp-relay.default.svc.cluster.local

string

authentik.email.use_tls (13)

false

boolean, string

authentik.email.use_ssl (7)

false

string, boolean

authentik.email.timeout (5)

string, number

authentik.email.password (2)

${AUTHENTIK_EMAIL_PASSWORD}

string

authentik.email.username (2)

${AUTHENTIK_EMAIL_USERNAME}

string

authentik.postgresql.name (14)

authentik

string

authentik.postgresql.user (12)

authentik

string

authentik.postgresql.host (11)

postgresql.database.svc.cluster.local

string

authentik.postgresql.password (9)

string

authentik.postgresql.port (7)

number

authentik.postgresql.enabled (3)

true

boolean

authentik.postgresql.read_replicas.0.host (1)

postgres16-r.database.svc.cluster.local

string

authentik.postgresql.read_replicas.0.port (1)

number

authentik.postgresql.s3_backup.access_key (1)

${AUTHENTIK_S3_ACCESS_KEY}

string

authentik.postgresql.s3_backup.bucket (1)

authentik-postgresql-backup

string

authentik.postgresql.s3_backup.host (1)

http://s3.minio.storage

string

authentik.postgresql.s3_backup.secret_key (1)

${AUTHENTIK_S3_SECRET}

string

authentik.postgresql.sslmode (1)

disable

string

authentik.avatars (7)

gravatar,initials

string

authentik.secret_key (7)

${SECRET_AUTHENTIK_SECRET_KEY}

string

authentik.outposts.container_image_base (6)

ghcr.io/goauthentik/%(type)s:%(version)s

string

authentik.outposts.docker_image_base (3)

ghcr.io/goauthentik/%(type)s:%(version)s

string

authentik.compliance.fips.enabled (2)

true

boolean

authentik.disable_startup_analytics (2)

true

boolean

authentik.blueprints[].configMapRef.name (1)

authentik-discord-blueprint
authentik-base-blueprints

string

authentik.blueprints[].path (1)

/blueprints/sidecar

string

authentik.footer_links (1)

[]

string

authentik.security_key (1)

string

postgresql.enabled (21)

false

boolean

postgresql.image.tag (4)

15.14-bookworm

string

postgresql.image.registry (2)

docker.io

string

postgresql.image.repository (2)

bitnami/postgresql

string

postgresql.metrics.enabled (3)

true

boolean

postgresql.metrics.serviceMonitor.enabled (3)

true

boolean

postgresql.metrics.image.repository (2)

prometheuscommunity/postgres-exporter

string

postgresql.metrics.image.tag (2)

v0.19.0

string

postgresql.auth.existingSecret (2)

authentik-postgres-secrets

string

postgresql.auth.secretKeys.userPasswordKey (1)

postgres-password

string

postgresql.global.imageRegistry (2)

proxy.registry.beryju.io

string

postgresql.global.defaultStorageClass (1)

openebs-hostpath

string

postgresql.postgresqlPassword (2)

${AUTH_AUTHENTIK_POSTGRESQL_PASSWORD}

string

postgresql.primary.networkPolicy.extraIngress[].ports[].port (2)

number

postgresql.primary.networkPolicy.extraIngress[].ports[].protocol (2)

TCP

string

postgresql.primary.persistence.enabled (2)

true

boolean

postgresql.primary.persistence.size (2)

8Gi

string

postgresql.primary.persistence.storageClass (1)

ceph-block-internal

string

postgresql.persistence.enabled (1)

true

boolean

postgresql.persistence.existingClaim (1)

authentik-postgresql-v1

string

postgresql.postgresqlDatabase (1)

authentik

string

postgresql.postgresqlUsername (1)

authentik

string

prometheus.rules.enabled (20)

true

boolean, string

prometheus.rules.create (1)

true

boolean

prometheus.serviceMonitor.create (1)

true

boolean

prometheus.serviceMonitor.interval (1)

60s

string

prometheus.serviceMonitor.scrapeTimeout (1)

30s

string

worker.replicas (19)

number

worker.resources.requests.cpu (15)

50m

string

worker.resources.requests.memory (15)

512Mi

string

worker.resources.limits.memory (14)

1200Mi

string

worker.resources.limits.cpu (2)

300m

string

worker.autoscaling.enabled (4)

true

boolean

worker.autoscaling.maxReplicas (4)

number

worker.autoscaling.minReplicas (4)

number

worker.autoscaling.targetCPUUtilizationPercentage (2)

number

worker.metrics.enabled (4)

true

boolean

worker.metrics.serviceMonitor.enabled (4)

true

boolean

worker.metrics.prometheus.serviceMonitor.enabled (2)

true

boolean

worker.volumeMounts[].mountPath (4)

/blueprints/sidecar

string

worker.volumeMounts[].name (4)

sidecar-blueprints

string

worker.volumes[].name (4)

sidecar-blueprints

string

worker.volumes[].configMap.name (1)

authentik-blueprints

string

worker.volumes[].emptyDir.medium (1)

Memory

string

worker.pdb.enabled (3)

true

boolean

worker.pdb.minAvailable (3)

number

worker.pdb.maxUnavailable (2)

number

worker.startupProbe.initialDelaySeconds (3)

number

worker.startupProbe.timeoutSeconds (2)

number

worker.startupProbe.failureThreshold (1)

number

worker.startupProbe.periodSeconds (1)

number

worker.containerSecurityContext.allowPrivilegeEscalation (2)

false

boolean

worker.containerSecurityContext.capabilities.drop[] (2)

- ALL

string

worker.containerSecurityContext.runAsNonRoot (2)

true

boolean

worker.containerSecurityContext.seccompProfile.type (2)

RuntimeDefault

string

worker.containerSecurityContext.readOnlyRootFilesystem (1)

true

boolean

worker.extraContainers[].env[].name (2)

FOLDER
LABEL
LABEL_VALUE
NAMESPACE
RESOURCE
UNIQUE_FILENAMES

string

worker.extraContainers[].env[].value (2)

/blueprints/sidecar
goauthentik_blueprint
1
ALL
both
true

string

worker.extraContainers[].image (2)

ghcr.io/kiwigrid/k8s-sidecar:2.5.0

string

worker.extraContainers[].name (2)

sidecar-blueprints

string

worker.extraContainers[].volumeMounts[].mountPath (2)

/blueprints/sidecar

string

worker.extraContainers[].volumeMounts[].name (2)

sidecar-blueprints

string

worker.extraContainers[].imagePullPolicy (1)

IfNotPresent

string

worker.extraContainers[].resources.limits.memory (1)

512Mi

string

worker.extraContainers[].resources.requests.cpu (1)

11m

string

worker.extraContainers[].resources.requests.memory (1)

352Mi

string

worker.livenessProbe.failureThreshold (2)

number

worker.livenessProbe.initialDelaySeconds (2)

number

worker.livenessProbe.timeoutSeconds (2)

number

worker.livenessProbe.periodSeconds (1)

number

worker.name (2)

worker

string

worker.readinessProbe.failureThreshold (2)

number

worker.readinessProbe.initialDelaySeconds (2)

number

worker.readinessProbe.timeoutSeconds (2)

number

worker.readinessProbe.periodSeconds (1)

number

worker.serviceAccount.create (2)

true

boolean

worker.annotations."secret.reloader.stakater.com/reload" (1)

authentik-secret

string

worker.env[].name (1)

OTEL_SERVICE_NAME
AUTHENTIK_TRACING__ENABLED
AUTHENTIK_TRACING__EXPORTER
OTEL_EXPORTER_OTLP_ENDPOINT
OTEL_EXPORTER_OTLP_PROTOCOL
OTEL_TRACES_EXPORTER
OTEL_PROPAGATORS
OTEL_TRACES_SAMPLER
OTEL_RESOURCE_ATTRIBUTES

string

worker.env[].value (1)

authentik-worker
true
otlp
http://tempo-distributor.observability.svc.cluster.local:4318
http/protobuf
otlp
tracecontext,baggage
parentbased_always_on
service.name=authentik-worker,service.namespace=security,app.type=identity-provider,component=worker

string

worker.probes.liveness.enabled (1)