AuthentikNamespacePolicy

• API version: authentik.weebo.io/v1alpha1
• Scope: Cluster
• Short names: none
• Guide: The allow-list

Namespace allow-list enforced by the admission webhook (and double-checked by reconcilers). Cluster-scoped. Default-deny: a (namespace, kind) pair is only allowed if some rule across every AuthentikNamespacePolicy explicitly allows it — see domain::allow_list::evaluate, which this CRD's rules map directly onto.

ExampleCopy Anchor Link

apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikNamespacePolicy
metadata:
  name: my-namespacepolicy
spec:
  rules:
    - namespaces:
        - team-a
      allowedKinds:
        - AuthentikApplication
        - AuthentikAccessPolicy
      effect: Allow

Spec fieldsCopy Anchor Link

Build a manifestCopy Anchor Link

Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.

Loading form...