Operator for Authentik Server

Charmed Authentik Server

Description

Charmed Authentik Server is an open-source, highly versatile Identity Provider focused on flexibility and integration. It provides unified authentication, user management, and authorization out-of-the-box, supporting industry-standard protocols such as OAuth2, OpenID Connect, SAML, and LDAP.

This operator manages the core Authentik Server application on Kubernetes, handling its deployment, configuration, scaling, and integration with required and optional dependencies in a declarative, automated manner using Juju.

Usage & Deployment

Basic Deployment

Authentik Server requires a PostgreSQL database to store its application state and a related Authentik Worker to handle background tasks (such as emails, task synchronization, and outposts).

To deploy a basic, fully functioning Authentik instance:

# Deploy the PostgreSQL database operator
juju deploy postgresql-k8s --channel 14/stable --trust

# Deploy the Authentik Server (this charm)
juju deploy authentik-server --trust

# Deploy the Authentik Worker operator
juju deploy authentik-worker --channel latest/edge --trust

# Integrate Authentik Server with the PostgreSQL database
juju integrate postgresql-k8s authentik-server

# Integrate Authentik Server with the Authentik Worker
juju integrate authentik-server:authentik-cluster authentik-worker:authentik-cluster

You can track the deployment status using:

watch -c juju status --color

Once the charms settle into an active and idle status, the Authentik Server is ready to use.

Terraform Deployment

For environments where infrastructure-as-code is preferred, a production-ready set of Terraform modules (Core, Solution stack, and runnable Tutorial scenarios) are available.

To learn how to provision the complete Authentik stack with a single command, please see the Charmed Authentik Terraform Guide.

Documentation

Please see our comprehensive documentation guides located in the docs/ folder:

• Tutorials: Getting Started with Charmed Authentik
• How-To Guides:
  • How to Bootstrap Charmed Authentik
  • How to Protect OIDC/OAuth Applications
  • How to Protect LDAP Applications
  • How to Integrate Upstream Identity Providers
  • How to Manage Users and Groups
  • Common Operational Administration Tasks
• Reference: Charmed Authentik Configuration Reference
• Explanation: Charmed Authentik Architecture & Security Design

Integrations

PostgreSQL (pg-database)

An integration with postgresql-k8s-operator is required. The Authentik Server stores all configuration, users, and session data in this database.

Authentik Worker (authentik-cluster)

An integration with authentik-worker-operator is required. The Authentik Worker handles background processes, outposts, and other asynchronous tasks for the cluster.

Ingress (traefik-route)

An integration with traefik-k8s-operator is required. The Authentik Server utilizes the traefik_route interface to define precise ingress routing and SSL termination:

juju integrate traefik-k8s authentik-server:traefik-route

Observability

Charmed Authentik Server offers seamless integration with the Canonical Observability Stack (COS) to forward logs, expose metrics, and export traces:

• Logging (logging): Forward workload logs to Loki.

  juju integrate loki-k8s authentik-server:logging
  

• Metrics (metrics-endpoint): Expose Prometheus scrape endpoints.

  juju integrate prometheus-k8s authentik-server:metrics-endpoint
  

• Dashboards (grafana-dashboard): Import built-in Grafana monitoring dashboards.

  juju integrate grafana-k8s authentik-server:grafana-dashboard
  

• Tracing (tracing): Send application trace data to Tempo.

  juju integrate tempo-k8s authentik-server:tracing
  

Scenarios

Retrieving Bootstrap Credentials

On the first start, Charmed Authentik Server automatically generates secure bootstrap credentials for the default administrator account, akadmin.

To retrieve the generated password and token, run the get-bootstrap-admin-credentials action on the leader unit:

juju run authentik-server/leader get-bootstrap-admin-credentials

The output will contain:

• username: The default administrator user (akadmin).
• password: The generated secure administrator password.
• bootstrap-token: The initial API bootstrap token.

Security

Please see SECURITY.md for guidelines on reporting security issues.

Contributing

Please see the Juju SDK docs for guidelines on enhancements to this charm following best practice guidelines, and CONTRIBUTING.md for developer guidance.

License

The Charmed Authentik Server is free software, distributed under the Apache Software License, version 2.0. See LICENSE for more information.