Authelia

# values.yaml — Authelia with SQLite and file-based user database
secrets:
  existingSecret: authelia-master-secrets
  existingSecretJwtKey: jwt-secret # 64+ chars
  existingSecretSessionKey: session-secret # 64+ chars
  existingSecretStorageEncryptionKey: storage-encryption-key # 20+ chars

config:
  session:
    cookies:
      - domain: example.com
        authelia_url: 'https://auth.example.com'
        default_redirection_url: 'https://www.example.com'
  access_control:
    default_policy: one_factor
    rules:
      - domain: 'public.example.com'
        policy: bypass
      - domain: '*.example.com'
        policy: two_factor
  notifier:
    # filesystem notifier logs to /data/notification.txt — email not sent
    # Switch to smtp notifier for production email delivery
    filesystem:
      filename: /data/notification.txt

usersDatabase:
  enabled: true
  users:
    admin:
      displayname: 'Administrator'
      email: '[email protected]'
      # Generate password hash: authelia crypto hash generate argon2 --password 'mypassword'
      password: '$argon2id$v=19$m=65536,t=3,p=4$...'
      groups:
        - admins

persistence:
  enabled: true
  size: 1Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: auth.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: authelia-tls
      hosts:
        - auth.example.com

# values.yaml — Authelia HA: PostgreSQL + Redis (required for multi-replica)
replicaCount: 2 # requires Redis for session coordination

secrets:
  existingSecret: authelia-master-secrets

config:
  session:
    cookies:
      - domain: example.com
        authelia_url: 'https://auth.example.com'
  access_control:
    default_policy: two_factor
  notifier:
    smtp:
      address: 'submissions://smtp.example.com:465'
      sender: 'Authelia <[email protected]>'
      username: '[email protected]'
      password: 'smtp-password' # use extraEnv with secretKeyRef in production

postgresql:
  enabled: true
  auth:
    database: authelia
    username: authelia
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

database:
  type: postgres

persistence:
  enabled: true
  size: 1Gi

backup:
  enabled: true
  schedule: '0 2 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: authelia-backups
    existingSecret: authelia-s3-credentials

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: auth.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Authelia configured for Traefik forwardAuth middleware
# After deploying, create a Traefik Middleware resource in the same namespace:
#
# apiVersion: traefik.io/v1alpha1
# kind: Middleware
# metadata:
#   name: authelia
# spec:
#   forwardAuth:
#     address: http://authelia.authelia.svc.cluster.local/api/authz/forward-auth
#     trustForwardHeader: true
#     authResponseHeaders:
#       - Remote-User
#       - Remote-Groups
#       - Remote-Name
#       - Remote-Email
#
# Then add annotation to protected services:
#   traefik.ingress.kubernetes.io/router.middlewares: <namespace>-authelia@kubernetescrd

secrets:
  existingSecret: authelia-master-secrets

config:
  session:
    cookies:
      - domain: example.com
        authelia_url: 'https://auth.example.com'
  access_control:
    default_policy: one_factor
    rules:
      - domain: 'auth.example.com'
        policy: bypass
      - domain: '*.example.com'
        policy: one_factor

usersDatabase:
  enabled: true
  users:
    admin:
      displayname: 'Admin'
      email: '[email protected]'
      password: '$argon2id$v=19$m=65536,t=3,p=4$...'
      groups:
        - admins

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: auth.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Authelia as OIDC identity provider
secrets:
  existingSecret: authelia-master-secrets
  existingSecretOidcHmacKey: oidc-hmac-secret # required for OIDC

config:
  session:
    cookies:
      - domain: example.com
        authelia_url: 'https://auth.example.com'
  access_control:
    default_policy: two_factor
  identity_providers:
    oidc:
      clients:
        - client_id: grafana
          client_name: Grafana
          client_secret: '$pbkdf2-sha512$310000$...' # hashed client secret
          public: false
          authorization_policy: two_factor
          redirect_uris:
            - 'https://grafana.example.com/login/generic_oauth'
          scopes:
            - openid
            - profile
            - email
            - groups
          userinfo_signed_response_alg: none

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

database:
  type: postgres

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: auth.example.com
      paths:
        - path: /
          pathType: Prefix