AuthentikApplication
Mirrors authentik_application + its protocol_provider.
- API version:
authentik.weebo.io/v1alpha1 - Scope: Namespaced
- Short names: none
- Guide: First application walkthrough
Mirrors authentik_application + its protocol_provider. Namespaced —
owned by whichever team/namespace created it, governed by
AuthentikNamespacePolicy.
Example
apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikApplication
metadata:
name: my-application
namespace: team-a
spec:
instanceRef:
name: main
name: Harbor
slug: harbor
provider:
kind: oauth2
oauth2:
authorizationFlow: default-provider-authorization-implicit-consent
invalidationFlow: default-provider-invalidation-flow
allowedRedirectUris:
- matchingMode: strict
url: https://harbor.example.com/c/oidc/callbackSpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
instanceRef | object | yes | The AuthentikInstance or AuthentikLocalInstance this application lives on. | |
metaIcon | string | no | ||
name | string | yes | ||
provider | object | yes | oauth2/proxy are implemented in v1 (both are in real use in the Terraform module being replaced — longhorn.tf uses proxy). saml/ldap are schema-only stubs: accepted by the schema so a future addition isn't a breaking change, but rejected by the reconciler with an explicit error, never silently ignored. See .prompt/plan.md decision 2. Deliberately not a Rust sum type (enum Foo { Oauth2(..), Proxy(..) }) even though that's what it conceptually is: kube-core's CRD schema generation cannot merge an internally-tagged enum whose variants carry different literal discriminator values — each variant's kind property gets a different enum: [...] schema and CustomResourceExt::crd() panics ("Property 'kind' ... must be identical"). This flat-struct-plus-discriminator shape is the standard kube.rs workaround; "exactly one of oauth2/proxy set, matching kind" is validated by the reconciler, not the schema. | |
secretTargets | object[] | no | Where this application's oauth2 credentials are written. When empty (the default), they go to one target named after this CR, in its namespace, on the AuthentikInstance's secretStore.backend. When non-empty, they are fanned out to every listed target; Kubernetes and Vault targets may be mixed. A target stays in this CR's namespace, and a Vault path under <pathPrefix>/<namespace>/ unless the instance's pathGrants open it to this namespace. Only meaningful for provider.kind: oauth2 — proxy providers carry no client secret, so this is ignored for them. | |
slug | string | yes | The application's slug: its URL in Authentik and its identity there (status.authentikId). Changing it renames the application in place; its access policies follow. |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...