AuthentikUser

API version: authentik.weebo.io/v1alpha1
Scope: Cluster
Short names: none

Mirrors authentik_user. Cluster-scoped, like AuthentikGroup.

Deliberately has no credential/password field — Authentik owns its own invite/reset flows. If a bootstrap password is ever needed it goes through SecretStore (generated, never stored in this spec). See .prompt/plan.md.

Example

apiVersion: authentik.weebo.io/v1alpha1
kind: AuthentikUser
metadata:
  name: my-user
spec:
  username: alice
  name: Alice Example
  email: alice@example.com
  groupRefs:
    - weebo_user

Spec fields

Field	Type	Required	Default	Description
`email`	`string`	yes
`groupRefs`	`string[]`	no	`[]`	Groups this user belongs to, by their Authentik name (`AuthentikGroup.spec.name`), not the name of the CR describing them — each is resolved with a `/core/groups/?name=` query, never read from Kubernetes. An unresolvable entry fails the reconcile with `GroupRefNotFound`.
`isActive`	`boolean`	no	`true`
`name`	`string`	yes
`username`	`string`	yes

Build a manifest

Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.

Loading form...

ExampleCopy Anchor Link

Spec fieldsCopy Anchor Link

Build a manifestCopy Anchor Link

Example

Spec fields

Build a manifest