AuthentikFlow
Mirrors authentik_flow.
- API version:
authentik.weebo.io/v1alpha1 - Scope: Cluster
- Short names: none
Mirrors authentik_flow. Cluster-scoped — flows are org-wide
authentication/authorization pipelines referenced by slug from brands
and application providers, not owned by a namespace. Only reachable via
cluster-scoped RBAC (no AuthentikNamespacePolicy governs this kind).
Flows are slug-keyed in Authentik's API (create returns a pk
UUID, but update/delete operate on the slug), so status.authentikId
stores the slug — same convention as AuthentikApplication, whose
applications API is likewise slug-keyed.
This CRD manages the flow object itself (name/title/designation/…). Its
stage bindings and policies are out of scope — the Terraform module
being replaced defines a single custom flow (device-code) and otherwise
references Authentik's built-in flows, so slug-referencing from
AuthentikBrand/AuthentikApplication remains the norm; this CRD just
lets that one custom flow (and any future ones) be declared as a CR
instead of assumed to pre-exist.
Example
apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikFlow
metadata:
name: my-flow
spec:
name: Device code
slug: device-code
title: Sign in to your device
designation: stage_configurationSpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
authentication | string | no | Required level of authentication to access the flow. Defaults to Authentik's own default when unset. | |
background | string | no | Background image shown during flow execution (a URL or a static path served by Authentik). | |
compatibilityMode | boolean | no | Increases compatibility with mobile password managers. | |
deniedAction | string | no | What happens when the flow denies access to a user. | |
designation | string | yes | What the flow is used for (authentication, authorization, …). | |
layout | string | no | Visual layout of the flow's pages. | |
name | string | yes | Internal name of the flow. | |
policyEngineMode | string | no | How the flow's bound policies are combined. Defaults to Authentik's own default (any) when unset. | |
slug | string | yes | Visible in the URL and the identity every other CRD uses to reference this flow (AuthentikBrand.flow*, Oauth2ProviderSpec.authorizationFlow, …). Changing it renames the flow in place: every CR referencing it by the old slug must follow. | |
title | string | yes | Title shown to users on the flow's pages. |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...