AuthentikAccessPolicy
Mirrors authentik_policy_binding.
- API version:
authentik.weebo.io/v1alpha1 - Scope: Namespaced
- Short names: none
- Guide: First application walkthrough
Mirrors authentik_policy_binding. Namespaced.
application_ref is deliberately a bare name with no namespace
field — there is no way to express a cross-namespace reference in
this schema. The reconciler must resolve it via
Api::<AuthentikApplication>::namespaced(policy.metadata.namespace),
never a cluster-wide client. See .prompt/plan.md,
"Confinement au namespace, deux couches".
Example
apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikAccessPolicy
metadata:
name: my-accesspolicy
namespace: team-a
spec:
applicationRef: harbor
groupRef: weebo-userSpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
applicationRef | string | yes | Name of an AuthentikApplication CR in the same namespace. | |
groupRef | string | yes | Group this policy binds, by its Authentik name (AuthentikGroup.spec.name), not the name of the CR describing it — unlike applicationRef above, which is a CR name. It is resolved with a /core/groups/?name= query against the instance; a miss fails the reconcile with GroupRefNotFound. | |
negate | boolean | no | false | |
order | integer | no | 0 |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...