AuthentikLocalInstance
Connection to a real Authentik server, owned by a namespace: its token is that namespace's, and only the AuthentikApplications of this namespace use it unless sharedWith says otherwise.
- API version:
authentik.weebo.io/v1alpha1 - Scope: Namespaced
- Short names: none
- Guide: Connect an AuthentikInstance
Connection to a real Authentik server, owned by a namespace: its token
is that namespace's, and only the AuthentikApplications of this
namespace use it unless sharedWith says otherwise. What an operator
limited to one namespace uses. Credentials of the applications bound to
it are written as Kubernetes Secrets only: the operator's Vault
identity is shared by every namespace, so a namespace's own instance
can't route to Vault.
Example
apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikLocalInstance
metadata:
name: my-localinstance
namespace: team-a
spec:
url: https://login.example.com
tokenSecretRef:
name: authentik-api-token
key: tokenSpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
sharedWith | object | no | Other namespaces (or cluster-scoped objects) allowed to use this instance — and its token. Unset: this namespace only. | |
tls | object | no | {"insecureSkipVerify":false} | TLS verification for the API connection above; the CA Secret lives in this namespace. |
tokenSecretRef | object | yes | The API token the operator authenticates with, in a Secret of this namespace labelled authentik.weebo.io/instance-token: "true". Read on every reconcile: rotating it needs no restart. | |
url | string | yes | Base web URL of the Authentik instance, e.g. https://login.example.com — not the /api/v3 REST endpoint, which is derived from it. |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...