Kubernetes operator · Authentik

weebo-authentik

Manage Authentik groups, users, applications and access policies as native Kubernetes custom resources, with GitOps-friendly status and a namespace-scoped allow-list enforced by an admission webhook.

Get started Read the docs Build a manifest View on GitHub

1 · Install the chart

helm install weebo-authentik \
  oci://ghcr.io/batleforc/charts/weebo-authentik \
  --namespace weebo-authentik --create-namespace \
  --set certManager.issuerRef.name=<issuer>

2 · Declare an application

apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikApplication
metadata:
  name: harbor
  namespace: team-a
spec:
  instanceRef: main
  name: Harbor
  slug: harbor
  provider: { kind: oauth2, … }

Declare Authentik

Groups, users, applications, brands, flows, scope mappings and outposts are Kubernetes resources. Apply YAML, and the operator keeps Authentik in line with it.

First application

Hand out credentials

An application’s OAuth2 client ID and secret are written straight into a Secret (or Vault) in its namespace — never pasted by hand.

Connect an instance

Fence namespaces

An allow-list says which namespaces may declare applications. It is enforced by an admission webhook, before anything reaches Authentik.

Allow-list guide