Install via Helm

PrerequisitesCopy Anchor Link

• A Kubernetes cluster with cert-manager installed. The chart's ValidatingWebhookConfiguration requires a real TLS certificate for its admission webhook (.prompt/plan.md, "Securite operationnelle & deploiement") — the chart creates a Certificate resource, but never an Issuer/ ClusterIssuer itself. Have one ready before installing.

InstallCopy Anchor Link

The chart lives in this repository at deploy/charts/weebo-authentik.

helm install weebo-authentik deploy/charts/weebo-authentik \
  --namespace weebo-authentik --create-namespace \
  --set certManager.issuerRef.name=<your-cluster-issuer> \
  --set certManager.issuerRef.kind=ClusterIssuer

certManager.issuerRef.name is required — the chart's Certificate template fails to render without it.

What gets installedCopy Anchor Link

• The 10 AuthentikInstance/AuthentikGroup/AuthentikUser/ AuthentikOutpost/AuthentikFlow/AuthentikScopeMapping/ AuthentikBrand/AuthentikApplication/AuthentikAccessPolicy/ AuthentikNamespacePolicy CRDs (see the CRD reference for each kind's fields).
• The operator Deployment (2 replicas by default — see below), Service, and its own cluster-wide ClusterRole/ClusterRoleBinding.
• A cert-manager Certificate for the webhook, and the ValidatingWebhookConfiguration itself (failurePolicy: Fail — an unreachable webhook blocks AuthentikApplication/AuthentikAccessPolicy writes cluster-wide rather than silently letting them through).
• A PodDisruptionBudget and a ConfigMap containing the ArgoCD health.lua script every CRD kind needs (see the chart's NOTES.txt, shown after helm install, for the exact ArgoCD wiring steps — a chart can't write to ArgoCD's own configuration itself).

Replica count and leader electionCopy Anchor Link

replicaCount defaults to 2. The webhook is active on every replica (stateless); the operator's reconcilers use a coordination.k8s.io Lease (weebo-operator-kit's leader election) so only the elected leader reconciles at a time. A replica that loses the lease exits immediately — Kubernetes restarts it, and another replica takes over; on a rollout (SIGTERM) the leader finishes its in-flight reconciles and hands the lease over at once. Each controller runs at most WEEBO_RECONCILE_CONCURRENCY reconciles at a time (default 4).

Deleting a CR whose cleanup can't succeedCopy Anchor Link

Deleting a CR deletes its Authentik object first (the finalizer). When that can't succeed any more — its AuthentikInstance or token is already gone — the CR stays in Terminating, with a Warning Event saying why. Release it without touching Authentik (the object is left behind):

kubectl annotate authentikgroup <name> authentik.weebo.io/force-orphan=true

A Released Event records it.

Next stepsCopy Anchor Link

Connect a real Authentik instance, then walk through your first application.