CRD reference
Every kind the operator adds, its fields, and an interactive manifest builder.
Each page lists a kind's spec fields, shows a minimal example, and has a
form that builds a ready-to-apply manifest. These pages are generated from
the CRDs themselves, so they always match the installed version.
| Kind | Scope | Description |
|---|---|---|
AuthentikInstance | Cluster | Connection to a real Authentik server. |
AuthentikLocalInstance | Namespaced | Connection to a real Authentik server, owned by a namespace: its token is that namespace's, and only the AuthentikApplications of this namespace use it unless sharedWith says otherwise. |
AuthentikNamespacePolicy | Cluster | Namespace allow-list enforced by the admission webhook (and double-checked by reconcilers). |
AuthentikGroup | Cluster | Mirrors authentik_group. |
AuthentikUser | Cluster | Mirrors authentik_user. |
AuthentikApplication | Namespaced | Mirrors authentik_application + its protocol_provider. |
AuthentikAccessPolicy | Namespaced | Mirrors authentik_policy_binding. |
AuthentikScopeMapping | Cluster | Mirrors authentik_property_mapping_provider_scope — the OAuth2/OIDC scope mapping, i.e. one entry of the list a provider exposes as propertyMappings. |
AuthentikBrand | Cluster | Mirrors authentik_brand. |
AuthentikFlow | Cluster | Mirrors authentik_flow. |
AuthentikOutpost | Cluster | Deliberately minimal — nothing in the Terraform module being replaced creates a custom outpost, everything attaches to Authentik's embedded outpost by default. |