336 lines
12 KiB
YAML
336 lines
12 KiB
YAML
---
|
|
- name: Authentik disabled (set noble_authentik_install=true and .env — see role README)
|
|
ansible.builtin.debug:
|
|
msg: "Skipping noble_authentik (noble_authentik_install is false)."
|
|
when: not (noble_authentik_install | default(false) | bool)
|
|
|
|
- name: Authentik + OIDC stack
|
|
when: noble_authentik_install | default(false) | bool
|
|
block:
|
|
- name: Include Authentik secrets from .env
|
|
ansible.builtin.include_tasks: from_env.yml
|
|
|
|
- name: Require Authentik secrets and bootstrap settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- noble_authentik_secret_key | default('') | length > 0
|
|
- noble_authentik_postgresql_password | default('') | length > 0
|
|
- noble_authentik_bootstrap_token | default('') | length > 0
|
|
- noble_authentik_bootstrap_email | default('') | length > 0
|
|
- noble_authentik_bootstrap_password | default('') | length > 0
|
|
- noble_authentik_client_secret_argocd | default('') | length > 0
|
|
- noble_authentik_client_secret_grafana | default('') | length > 0
|
|
- noble_authentik_client_secret_headlamp | default('') | length > 0
|
|
- noble_authentik_client_secret_oauth2_proxy | default('') | length > 0
|
|
- noble_authentik_oauth2_proxy_cookie_secret | default('') | length > 0
|
|
fail_msg: >-
|
|
Authentik requires secrets in .env (see ansible/roles/noble_authentik/README.md) or matching -e extra-vars.
|
|
|
|
- name: Ensure Ansible temp dir for rendered Helm values
|
|
ansible.builtin.file:
|
|
path: "{{ noble_repo_root }}/ansible/.ansible-tmp"
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Render Authentik Helm extra values (secrets)
|
|
ansible.builtin.template:
|
|
src: authentik-extra-values.yaml.j2
|
|
dest: "{{ noble_repo_root }}/ansible/.ansible-tmp/authentik-extra-values.yaml"
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Apply Authentik and oauth2-proxy namespaces
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- apply
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/authentik/namespace.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/oauth2-proxy/namespace.yaml"
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Install Authentik (Helm)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- authentik
|
|
- goauthentik/authentik
|
|
- --namespace
|
|
- authentik
|
|
- --version
|
|
- "{{ noble_authentik_chart_version }}"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/authentik/values.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/ansible/.ansible-tmp/authentik-extra-values.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- "{{ noble_authentik_helm_wait_timeout }}"
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Wait for authentik server rollout
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- rollout
|
|
- status
|
|
- deployment/authentik-server
|
|
- -n
|
|
- authentik
|
|
- --timeout=15m
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: false
|
|
|
|
- name: Wait for authentik worker rollout
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- rollout
|
|
- status
|
|
- deployment/authentik-worker
|
|
- -n
|
|
- authentik
|
|
- --timeout=15m
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: false
|
|
when: noble_authentik_configure_idp | default(true) | bool
|
|
|
|
- name: Wait until Authentik API accepts bootstrap token (worker finished bootstrap)
|
|
ansible.builtin.uri:
|
|
url: "{{ noble_authentik_api_base }}/core/applications/?page_size=1"
|
|
method: GET
|
|
headers:
|
|
Authorization: "Bearer {{ noble_authentik_bootstrap_token }}"
|
|
Accept: application/json
|
|
status_code: [200, 401, 403, 500, 502, 503]
|
|
timeout: 30
|
|
register: noble_authentik_api_bootstrap_ready
|
|
until: noble_authentik_api_bootstrap_ready.status == 200
|
|
retries: "{{ noble_authentik_bootstrap_api_wait_retries }}"
|
|
delay: "{{ noble_authentik_bootstrap_api_wait_delay }}"
|
|
when: noble_authentik_configure_idp | default(true) | bool
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: Render Authentik API client descriptor (JSON)
|
|
ansible.builtin.template:
|
|
src: authentik-clients.json.j2
|
|
dest: "{{ noble_repo_root }}/ansible/.ansible-tmp/authentik-clients.json"
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Configure Authentik OAuth2/OIDC providers (API)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- python3
|
|
- "{{ role_path }}/files/configure_authentik.py"
|
|
environment:
|
|
AUTHENTIK_API_BASE: "{{ noble_authentik_api_base }}"
|
|
AUTHENTIK_TOKEN: "{{ noble_authentik_bootstrap_token }}"
|
|
BOOTSTRAP_EMAIL: "{{ noble_authentik_bootstrap_email }}"
|
|
CLIENT_JSON: "{{ noble_repo_root }}/ansible/.ansible-tmp/authentik-clients.json"
|
|
AUTHENTIK_OAUTH_AUTHORIZATION_FLOW_PK: "{{ noble_authentik_oauth_authorization_flow_pk | default('') }}"
|
|
AUTHENTIK_OAUTH_INVALIDATION_FLOW_PK: "{{ noble_authentik_oauth_invalidation_flow_pk | default('') }}"
|
|
when: noble_authentik_configure_idp | default(true) | bool
|
|
changed_when: true
|
|
|
|
- name: Create argocd namespace Secret for OIDC client (Argo CD $authentik-oidc:clientSecret)
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
kubectl -n argocd create secret generic authentik-oidc \
|
|
--from-literal=clientSecret="${ARGOCD_OIDC_SECRET}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl -n argocd label secret authentik-oidc app.kubernetes.io/part-of=argocd --overwrite
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
ARGOCD_OIDC_SECRET: "{{ noble_authentik_client_secret_argocd }}"
|
|
no_log: true
|
|
changed_when: true
|
|
|
|
- name: Create Grafana OIDC client secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET)
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
kubectl -n monitoring create secret generic authentik-grafana-oauth \
|
|
--from-literal=GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET="${GRAFANA_OIDC_SECRET}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
GRAFANA_OIDC_SECRET: "{{ noble_authentik_client_secret_grafana }}"
|
|
no_log: true
|
|
changed_when: true
|
|
|
|
- name: Create Headlamp OIDC env secret (OIDC_* env vars)
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
kubectl -n headlamp create secret generic headlamp-oidc \
|
|
--from-literal=OIDC_CLIENT_ID="{{ noble_authentik_client_id_headlamp }}" \
|
|
--from-literal=OIDC_CLIENT_SECRET="${HEADLAMP_OIDC_SECRET}" \
|
|
--from-literal=OIDC_ISSUER_URL="{{ noble_authentik_public_url }}/application/o/headlamp/" \
|
|
--from-literal=OIDC_SCOPES="openid profile email groups offline_access" \
|
|
--from-literal=OIDC_CALLBACK_URL="https://headlamp.apps.noble.lab.pcenicni.dev/oidc-callback" \
|
|
--from-literal=OIDC_USE_PKCE="true" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
HEADLAMP_OIDC_SECRET: "{{ noble_authentik_client_secret_headlamp }}"
|
|
no_log: true
|
|
changed_when: true
|
|
|
|
- name: Create oauth2-proxy credentials Secret (OIDC to Authentik; not BasicAuth)
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
kubectl -n oauth2-proxy create secret generic oauth2-proxy-credentials \
|
|
--from-literal=client-id="{{ noble_authentik_client_id_oauth2_proxy }}" \
|
|
--from-literal=client-secret="${O2_CLIENT_SECRET}" \
|
|
--from-literal=cookie-secret="${O2_COOKIE_SECRET}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
O2_CLIENT_SECRET: "{{ noble_authentik_client_secret_oauth2_proxy }}"
|
|
O2_COOKIE_SECRET: "{{ noble_authentik_oauth2_proxy_cookie_secret }}"
|
|
no_log: true
|
|
changed_when: true
|
|
|
|
- name: Install oauth2-proxy (Helm) — OIDC provider Authentik
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- oauth2-proxy
|
|
- oauth2-proxy/oauth2-proxy
|
|
- --namespace
|
|
- oauth2-proxy
|
|
- --version
|
|
- "{{ noble_authentik_oauth2_proxy_chart_version }}"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/oauth2-proxy/values.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- 10m
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Apply Traefik ForwardAuth Middleware (references oauth2-proxy OIDC session)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- apply
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/oauth2-proxy/middleware-forwardauth.yaml"
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Helm upgrade Argo CD with Authentik OIDC values
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- argocd
|
|
- argo/argo-cd
|
|
- --namespace
|
|
- argocd
|
|
- --version
|
|
- "{{ noble_authentik_argocd_chart_version }}"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/argocd/values.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/argocd/values-authentik-oidc.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- 15m
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Helm upgrade kube-prometheus-stack (Grafana OIDC + ForwardAuth on Prom/AM)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- kube-prometheus
|
|
- prometheus-community/kube-prometheus-stack
|
|
- -n
|
|
- monitoring
|
|
- --version
|
|
- "{{ noble_authentik_kube_prometheus_chart_version }}"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/kube-prometheus-stack/values.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/kube-prometheus-stack/values-authentik-oidc.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- "{{ noble_authentik_kube_prometheus_helm_wait_timeout }}"
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Helm upgrade Headlamp with Authentik OIDC values
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- headlamp
|
|
- headlamp/headlamp
|
|
- --version
|
|
- "{{ noble_authentik_headlamp_chart_version }}"
|
|
- -n
|
|
- headlamp
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/headlamp/values.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/headlamp/values-authentik-oidc.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- 10m
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
changed_when: true
|
|
|
|
- name: Helm upgrade Longhorn with ForwardAuth (oauth2-proxy OIDC)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- helm
|
|
- upgrade
|
|
- --install
|
|
- longhorn
|
|
- longhorn/longhorn
|
|
- -n
|
|
- longhorn-system
|
|
- --version
|
|
- "{{ noble_authentik_longhorn_chart_version }}"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/longhorn/values.yaml"
|
|
- -f
|
|
- "{{ noble_repo_root }}/clusters/noble/bootstrap/longhorn/values-authentik-forwardauth.yaml"
|
|
- --force-conflicts
|
|
- --wait
|
|
- --timeout
|
|
- "{{ noble_helm_longhorn_wait_timeout | default('20m') }}"
|
|
environment:
|
|
KUBECONFIG: "{{ noble_kubeconfig }}"
|
|
register: noble_authentik_longhorn_helm
|
|
retries: "{{ noble_helm_longhorn_retries | default(8) | int }}"
|
|
delay: "{{ noble_helm_longhorn_retry_delay | default(25) | int }}"
|
|
until: noble_authentik_longhorn_helm.rc == 0
|
|
changed_when: true
|